Privacy Policy

Effective date: March 14, 2026

S4S (hereinafter "Company") complies with applicable data protection regulations. This Privacy Policy describes how we collect, use, and protect your personal information when you use the YarnPocket service.

We will notify users at least 7 days before any material changes to this policy take effect.

Article 1 (Purposes of Processing)

The Company processes personal information for the following purposes. Data will not be used for purposes other than those stated below; if the purpose changes, prior consent will be obtained.

Member registration, identity verification, and account management
Providing, maintaining, and improving the Service and developing new features
Sending emails, including password reset messages
Preventing fraudulent use and maintaining service security
Compliance with legal obligations

Article 2 (Retention Periods)

Category	Retention Period	Legal Basis
Member account data	Until account deletion	Service agreement
Login attempt records	Up to 30 days	Fraud prevention
E-commerce transaction records	5 years	Electronic Commerce Act
Access logs	3 months	Communications Privacy Act

When a member deletes their account, personal data is deleted immediately. Data that must be retained under law is kept separately for the required period and then deleted.

Article 3 (Sharing with Third Parties)

The Company does not share personal information with third parties as a general rule, except in the following cases:

The user has given prior consent
Required by law or requested by law enforcement through legally prescribed procedures

Payment processing is handled independently by Paddle.com, and Paddle's own privacy policy applies to payment data.

Article 4 (Data Processing Sub-processors)

The Company uses the following sub-processors to provide the Service:

Sub-processor	Purpose	Country	Retention
Cloudflare, Inc.	Server infrastructure	United States	Until account deletion
Brevo (Sendinblue)	Transactional email delivery	France (EU)	Deleted after sending
Paddle.com	Payment processing	United Kingdom	Per Paddle's policy

The Company ensures that all sub-processors are contractually bound to protect personal data in accordance with applicable law. Users are notified of any changes to sub-processors through this policy or service announcements.

As these sub-processors are located outside the country of origin, data may be transferred internationally in accordance with applicable law.

Article 5 (Your Rights)

You have the following rights regarding your personal data:

Right of access: View your personal data and how it is processed
Right to rectification: Request correction of inaccurate data
Right to erasure: Request deletion of your personal data
Right to restriction: Request restriction of processing
Right to withdraw: Delete your account at any time via the in-app account deletion feature

To exercise your rights, use the in-app features or contact us at contact@yarnpocket.com. We will respond within 10 days.

Article 6 (Data We Collect)

Type	Data	Purpose
Required	Email address, name, password (stored as hash)	Registration and authentication
Optional	Language preference	Service personalization
Automatically collected	IP address, access timestamps, usage logs	Security and service operation
Premium payment	Payment data (collected and processed directly by Paddle; not passed to the Company)	Subscription billing

Article 7 (Data Deletion)

When personal data is no longer needed or the retention period has expired, the Company deletes it without delay. Electronic data is permanently deleted in a non-recoverable manner. Data required to be retained by law is stored separately and deleted upon expiry of the required period.

Article 8 (Security Measures)

Passwords are stored as cryptographic hashes.
All data in transit is encrypted.
Access rights are minimized and strictly managed.
Authentication tokens are deleted immediately upon logout or account deletion.

Article 9 (Data Protection Officer)

Data Protection Contact	S4S
Email	contact@yarnpocket.com

Article 10 (Changes to This Policy)

This Privacy Policy is effective from March 14, 2026. We will notify users of any material changes at least 7 days before they take effect.