Privacy Policy

Last updated 8 August 2026

StitchNArt is accounting software. You put your business records into it, and we hold them for you. This page says exactly what we collect, what we do with it, who can see it, and how you get it back or have it deleted. It is written to be true rather than reassuring — where something is a real limitation, it says so.

Who we are

StitchNArt ("we") operates the software at app.stitchnart.pk and the Android app of the same name. Contact: support@stitchnart.pk, Karachi, Pakistan. For anything on this page, that address reaches a person.

What we collect

Your account

Your email address, and your name if you give one.
If you sign in with Google: your email address, name and profile picture, from Google. We request only email and profile — nothing else, and never access to your Google data.
Sign-in times, the device description your browser reports, and the IP address a request came from.

Your business records

Everything you enter: companies, customers and suppliers, invoices, quotes, receipts, payments, credit and debit notes, purchase bills, expenses, items, tax settings, and any files you attach. If you use the optional production modules, that includes production, machine, operator and payroll records.

We do not buy data about you, and we do not enrich your records from anywhere else. Everything in your account is either something you typed, something you uploaded, or something computed from those.

Technical records

An audit log of actions in your account — who changed what, and when. It is a feature: you can read your own.
A record of each email we send you (for example a sign-in code), so we can tell you whether it left our server.
Error reports when something in the app breaks.

What we do with it

Run the product: store your records, compute your balances, and produce your documents.
Sign you in and keep your session.
Send you what you ask us to send — a sign-in code, or a document you chose to email to a customer.
Keep backups so your data survives a failure.
Answer you when you contact support.

We do not sell your data, share it with advertisers, or use your business records to train machine-learning models.

Optional features that involve someone else

Google Drive backup

If you choose to connect it, we upload a copy of your own company's backup into your own Google Drive, so your data survives even if our servers do not.

We request the drive.file scope only. That scope can see and manage solely the files this app itself creates in your Drive. We cannot read, list or touch anything else in your Google account.
We create one folder, StitchNArt Backups, and write backup archives into it. Those archives are encrypted before they leave our server.
This is a separate permission, asked at a separate moment. Signing in with Google never requests Drive access.
You can disconnect it at any time in Backup & restore, which deletes the access token we hold. You can also revoke it yourself at myaccount.google.com/permissions. Files already in your Drive are yours and stay there.

Reading a document with AI

When you press "Read with AI" on a document you have attached, that one file is sent to Google's Gemini API to extract its details, and the result is offered to you as a form to confirm or discard. It happens only when you press it — never automatically, and nothing is saved until you save it.

Sharing a document to WhatsApp uses your own device's share sheet or a wa.me link. We do not send WhatsApp messages on a subscriber's behalf.

Who can see your data

You and the people you invite. Each company is a separate space; a person you have not invited cannot see it.
Our staff: not by default. Support access to a company's data requires an explicit grant, is read-only, expires by itself, and every action is written to that company's own audit log, where you can read it.
Our hosting provider (Hostinger) operates the servers your data sits on.
Google, only for the optional features above, and only to the extent described.
Nobody else, unless we are legally required to.

Security — what is true

Traffic between you and us is encrypted in transit (HTTPS).
Each company's records are separated by company, and that separation is enforced on the server, not in your browser.
Backups taken off-site are encrypted before they leave our server.
Our staff have no read access to your records without an explicit, logged, expiring grant.

We do not claim end-to-end encryption, because it would not be true. Our servers render your documents and compute your reports, so they can read your records while doing so. Any product that generates your PDFs on a server and claims end-to-end encryption is describing something else.

How long we keep it

Your records are kept while your account exists.
Deleting a record puts it in your Recycle Bin, where you can restore it.
If you delete your company account, it enters a 30-day grace period during which you can cancel and get everything back. After 30 days, records, attachments and sessions are permanently deleted.
Backups roll off on their own schedule; a copy may persist in a backup for up to 30 days after deletion.
When you ask for a copy of your data, that zip is held on our server for 7 days so you can download it again on another device, then removed automatically. You can remove it yourself at any time from Backup & restore — the file you already downloaded is yours and is not affected.
The audit log and records of emails sent are kept as the account's history.

Your choices

Get everything back. Backup & restore (in the left menu) exports your entire company — every record, including deleted ones, plus every attached file — as a zip you download.
Delete it all. Backup & restore → Close this company. We make you take a copy first. The company then stays readable but unchangeable for 30 days, so a deletion made in error can be undone; after that it is deleted permanently and cannot be recovered by us or by you.
Correct it. It is your ledger; you can edit any record.
Ask us. support@stitchnart.pk for anything the app cannot do for you.

Where your data lives

On servers in the European Union operated by our hosting provider. If you connect Google Drive, your backup copy also sits wherever Google stores your Drive.

Children

StitchNArt is business software and is not directed at children under 16.

Changes

If this policy changes in a way that affects you, we will say so in the app rather than quietly editing this page. The date at the top always reflects the current version.