Last updated 31 August 2026

Privacy Policy

KandiCon is an app for making bead patterns and sharing what you make. This page says exactly what we keep, where it is kept, and how to get rid of it.

The short version

• We never sell your information, and we never hand it to advertisers.
• There are no ads and no ad networks in KandiCon.
• There are no third-party analytics or tracking kits in the app. Nobody is following you around.
• There are no passwords. We could not leak one if we tried, because we never have one.
• You can delete your account yourself, in the app or by email.

How signing in works

KandiCon is passwordless. You type your email address, we email you a 6-digit code, and you type the code back. That is the whole thing. You can also use Sign in with Apple, including Apple's hide-my-email option, in which case we only ever see the forwarding address Apple gives us.

The code itself is never stored in a readable form and it stops working after 10 minutes or after five wrong guesses. Your email address is stored so that the same address always brings you back to the same account.

What we store

Your account

• Your email address, or your Sign in with Apple identifier, used to get you back into your account.
• Your profile: handle, display name, bio, avatar emoji and avatar photo if you add one.
• When the account was made and last changed, and whether it is active, suspended or deleted.

What you make and share

• Patterns — the title, category, grid size and the pattern itself, plus any source photo or finished-piece photo you attach.
• Posts — the text, and the photo or video on them, plus the video's thumbnail.
• Comments you write, and likes you give.
• Follows — who you follow and who follows you.
• Direct messages — the text, who sent it, who it went to, and whether it has been read.
• Tutorials and events, if you write or submit one.

Keeping the app safe

• Reports — what you reported, the reason you gave and any detail you typed.
• Blocks — who you have blocked. This is kept on our side so a block survives you getting a new phone.
• A record of moderator actions, so we can show our working if something is questioned.

Notifications

If you turn notifications on, we store the notification token your phone gives us, along with your app version, language and time zone so alerts arrive at a sensible hour. Turn notifications off and the token is removed.

If you buy beads

Payment is handled by Stripe on Stripe's own checkout page. KandiCon never sees or stores your card number. What comes back to us is the order: what was bought, the amount, the email address you gave Stripe, and the name and shipping address the parcel goes to. We keep that so we can actually send you your beads.

What is public, and what is not

This part matters, so it is spelled out plainly. Public by design, visible to anyone using the app: your handle, display name, bio and avatar; your posts and the photos or video on them; your comments; your patterns when you share them; and who you follow.

Not public: your email address, and your direct messages, which are only seen by you and the person you sent them to. Moderators can look at reported content, including a reported message, when checking a report.

Please treat a post like a poster in a school corridor. Don't put your address, your school, your phone number or your last name on it.

Where your information lives

KandiCon runs on Cloudflare. The database is Cloudflare D1, photos and video are in Cloudflare R2, and notification tokens are in Cloudflare KV. Everything travels encrypted.

The only other companies involved are Stripe, which handles payments, and Apple and Google, whose notification services deliver alerts to your phone. Sign-in code emails are sent through Cloudflare's email service. That is the complete list.

Young makers and parents

Lots of people who make kandi are kids, and we build with that in mind. Here is what a parent should know.

• Profiles, posts and comments are public inside the app. Anyone with KandiCon can see them.
• The app has direct messages, so makers can message each other.
• Every post, comment and profile has a Report button and a Block button. Reports go to a real person and are acted on.
• We can hide a post, comment, pattern or message, and suspend an account, from our side.

If you are a parent or guardian and you want your child's account or any of their content taken down, email alexander@uniquephoto.com from an address you can be reached at and say which handle it is. We will remove it. You do not need a reason and we will not argue with you about it.

Your choices

• See it — your profile, patterns, posts, comments and messages are all shown to you in the app. Ask us by email if you want a copy of anything else we hold.
• Fix it — edit your handle, display name, bio and avatar in the app at any time. Email us if something else is wrong.
• Delete it — delete a post, comment or pattern in the app, or delete the whole account. See Delete your account.
• Stop notifications — turn them off in the app or in your phone's settings.

Email alexander@uniquephoto.com for any of these and a person will answer.

How long we keep things

Your account and what you have made stay until you delete them. Sign-in codes disappear after 10 minutes. Order records are kept because they are a record of a real purchase. When an account is deleted, its content is hidden and its sign-in details are erased — the detail is on the deletion page.

Changes

If this page changes, the date at the top changes with it. If a change is a big one, we will say so in the app.

Contact

KandiCon · alexander@uniquephoto.com. Email is read by a person, not a bot.