Privacy

Last updated: 2 August 2026

Your patterns stay on your device. When you import a pattern, Rowline saves it in your browser's own storage on the device you used. It does not upload the PDF, the photo, the pasted text, your rows, your notes, or your row-by-row progress anywhere, unless you choose to sign in and sync, which is off unless you turn it on.

What Rowline keeps on your device

Rowline is a local-first app. The following live in your browser's local storage, on that browser, on that device:

• the project you're currently working on, and your saved project library, including the imported pattern text, the rows you reviewed, colors, warnings and import diagnostics;
• your follow-along progress: which rows are done, counters, and per-row notes;
• your preferences: theme, comfort/display settings, which panels you've collapsed, whether you dismissed the welcome or install prompt, and when you last downloaded a backup;
• your choice about the anonymous usage events described further down.

Rowline's own code does not set any cookies. Your browser also keeps a copy of the app's own files (the page, the stylesheet, the scripts, the icons) in a service-worker cache so the app keeps working offline. That cache holds Rowline's program files, not your patterns.

Because this is ordinary browser storage, clearing your browser data, using private browsing, or switching device or browser will lose it. Rowline has a "Download backup" button that writes your saved projects to a JSON file you keep, and a "Restore backup" button that reads one back. During beta, please use them.

What happens when you import a pattern

PDFs and photos

PDF reading and image handling happen inside your browser. Rowline loads its PDF reader from its own server first, and only falls back to a public code CDN (cdnjs, jsDelivr) if that copy fails to load. In either case what travels is Rowline's program code, in one direction: your file is not sent to Rowline or to anyone else.

OCR (reading text out of an image)

If a PDF is image-only, Rowline offers a "Try OCR" button. OCR only runs when you press it. The recognition itself runs in your browser; to do that, your browser downloads the OCR engine from jsDelivr and the English language data from tessdata.projectnaptha.com. Those hosts see a request for their own files, and can see your IP address as any web request would. The page image is not uploaded to them or to Rowline.

Website imports

If you paste a link to a pattern page, Rowline can't fetch that page directly from your browser, so the address you paste is sent to Rowline's own server, which fetches the page and hands the HTML back to your browser to parse. The request is made without your cookies or credentials. That endpoint does not store the page and does not write the address to a database; it refuses anything that isn't a public http/https address. If a site blocks it, you can paste the pattern text instead, and nothing leaves your device at all.

Pasted and typed text

Nothing leaves your device.

Anonymous beta usage events

During the private beta, Rowline sends a small anonymous event when you pass certain points in the flow, so it's possible to see where the app is losing people. There are exactly nine such points, and each is sent at most once per visit:

• page opened
• an import was begun: one of the four import buttons was pressed, and which one is not recorded
• import started
• review opened
• review accepted
• follow view reached
• first row marked done

Two more are sent from this site's own pages rather than the app, so it's possible to tell whether anyone finds them at all:

• the About page was opened
• the testers page was opened

Each event carries exactly five things and nothing else: the word funnel, which of those nine step names it is, a random session number, the app's build version (the two events sent from this site's pages carry no version, because those pages don't have one), and one word for how you arrived. The random session number is generated fresh each time the page loads, is not tied to any account, and is not stored anywhere in your browser. It exists only so the steps from one visit can be read together. No pattern text, pattern title, file name, link, email address or account identifier is included, and the server that receives it copies only those five named fields before storing them. Your IP address and your browser's user-agent string are not part of the stored event.

The word for how you arrived is one of exactly these nineteen, and never anything else: direct, rowline, ravelry, lovecrafts, etsy, kofi, reddit, facebook, instagram, threads, pinterest, youtube, tiktok, bluesky, discord, email, ai, search, other. It exists so Rowline can tell which places are worth posting in, without which there is no way to know whether anyone is finding it at all. The address of the page you came from is not sent, and never leaves your device. Your browser works out which of those ten words applies and sends only the word, so the page address, anything after the ? in it, and any words you typed into a search box are discarded before anything is sent. If you came from somewhere not on the list, that is other: the name of the site is not recorded. If your browser sends no referrer at all, which many do, that is direct.

These events are kept in Rowline's own database, and are also written to the hosting provider's function log, which that provider discards within a day. They are not shared with anyone. There is no analytics product, no advertising network, and no tracking pixel anywhere in Rowline: counting these eight steps is the only way Rowline knows whether the app is being used at all, which is why the list stays this short.

Turning it off

• There is a checkbox in the app's footer: "Share anonymous usage steps." Clear it and no further events are sent, from the app or from this site's pages. The choice is remembered in your browser and covers all eight, so you are never asked twice.
• If your browser sends a Do Not Track signal, Rowline sends nothing regardless of the checkbox, and the app tells you so.
• If Rowline can't read your browser storage at all (private mode, storage blocked), it treats that as "no", and sends nothing.

Crash reports

If the app hits an unexpected error, it automatically sends a short report so the bug can be found: the error message, the technical stack trace, the file and line it came from, the path of the page you were on, the app version, and your browser's user-agent string. These are capped at five per visit, repeats are skipped, and they are written to the hosting provider's function log rather than a database.

Feedback you send

Nothing is sent unless you press Send. When you do, the feedback form sends: your message, the email address you optionally typed, a subject, the app version, a short description of your browser and operating system, and the path of the page you were on. It is emailed to feedback@rowline.app.

A copy of those same fields is also stored in Rowline's Supabase database. Email alone used to be the only copy, which meant a report could vanish if the delivery failed. The stored copy is not public: the table is configured so that browsers can neither read nor write it, and only Rowline's own server can add to it. There is no automatic deletion yet. If you want a report you sent removed, email feedback@rowline.app and it will be deleted.

If you're reporting a bad import, Rowline attaches an import diagnostic summary and tells you on the form that it is doing so. That summary describes how the import went (source type, how many rows were found, confidence, and Rowline's own warning messages) and deliberately excludes the raw pattern text. For a website import it does include the address of the page you imported, so the problem can be reproduced.

Your email address is used to reply to you about your feedback. There is no mailing list and no newsletter.

If you sign up as a tester

The form on the testers page asks for your email address, and optionally a short note about what you crochet. Submitting it also records the same context the feedback form does: the app version, a short description of your browser and operating system, and the path of the page you were on.

Those are stored in a tester_signups table in Rowline's Supabase database, and a notification is emailed to feedback@rowline.app so the sign-up gets seen. As with feedback, the table is configured so that browsers can neither read nor write it; only Rowline's own server can add to it.

Signing up is not the same as signing in, and it does not create an account. Your email is used to send you an invite and to write back to you about the beta. To be taken off the list, email feedback@rowline.app and the row will be deleted.

If you sign in

Signing in is optional, and Rowline works fully without it. If you do:

• You enter an email address and Rowline asks Supabase (the hosted database and authentication service it uses) to email you a one-time sign-in link. There is no password. Your email address is held by Supabase as your account identity.
• Once signed in, your saved projects sync to a saved_projects table in that database. That row does contain your pattern content (the imported and cleaned instructions, the rows, your notes, modifications, progress and warnings), because that is what syncing a project means.
• The database is configured so that a signed-in user can read, write and delete only the rows whose user id matches their own.
• Your projects saved in the browser stay where they are; signing out leaves them available.

If you never sign in, none of this applies and no account exists.

Services Rowline relies on

These are the only third parties named anywhere in the code, and what each one is for:

• Vercel: hosts the site and runs the small server endpoints. Like any web host it sees the requests that reach it, including IP addresses.
• Supabase: the hosted database. Sign-in and project sync, if you sign in; it also stores feedback you send and tester sign-ups, neither of which needs an account.
• Gmail's mail servers: used to deliver the feedback email.
• jsDelivr, cdnjs, unpkg, tessdata.projectnaptha.com: public file hosts for the PDF reader and OCR engine. Contacted only as fallbacks, or when you run OCR.

The app ships a strict content-security policy that only permits connections to those hosts, so a stray request somewhere else would be blocked by your browser rather than silently allowed.

Your patterns and your copyright

Patterns you import are yours (or their author's). Rowline claims no rights over them, does not train anything on them, and does not share or sell them. By default they never leave your device, which is the strongest form of that promise Rowline can make.

Children

Rowline is a tool for people following crochet patterns and is not designed for or aimed at children. It does not ask your age and has no way of knowing it. If you are a parent and believe a child has created an account, email feedback@rowline.app and it will be deleted.

Deleting your data

• On your device: delete projects in the app, or clear Rowline's site data in your browser settings. That removes everything Rowline stored locally.
• In your account, if you have one: deleting a project in the app deletes that row from the database. To have the account itself removed, email feedback@rowline.app.
• Feedback you sent, or a tester sign-up: email feedback@rowline.app and the stored row will be deleted.
• Rowline does not yet publish a fixed retention schedule for hosting logs and crash logs. That is honest rather than reassuring: it is a private beta and that policy has not been set.

Changes to this page

If this page changes, the "Last updated" date at the top changes with it. There is no mailing list, so Rowline cannot notify you; the date is the notice.

Contact

One address for everything, including privacy questions and deletion requests: feedback@rowline.app.