Privacy policy

Controller

The operator named below is responsible for processing your personal data on this website. You can reach them by email with questions about privacy and with your requests.

Operator

Applicable law

This policy follows the Swiss Federal Act on Data Protection (FADP). Where the EU General Data Protection Regulation (GDPR) applies, for example because you visit the website from the EU or EEA, its requirements apply as well.

Where the GDPR requires a legal basis, we process data based on our legitimate interest in running the website securely, reliably and without errors (Art. 6(1)(f) GDPR). If you write to us, the legal basis is answering your request (Art. 6(1)(b) or (f) GDPR).

Hosting with Cloudflare

The website runs on Cloudflare Workers, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare delivers the pages through a worldwide network of data centers and protects them against attacks.

When you open a page, Cloudflare processes technically necessary data: your IP address, date and time, the requested address, the previously visited page (referrer), and your browser and operating system (user agent). This data is used for delivery, security and troubleshooting. We do not analyze it to identify you.

Data may be transferred to the USA and other countries in the process; see the section “Transfers abroad”.

Statistics with Cloudflare Web Analytics

To understand which pages are used and how fast they load, we use Cloudflare Web Analytics. The service works without cookies and without local storage in your browser and, according to Cloudflare, creates no profiles and no fingerprint of your device.

A small script from static.cloudflareinsights.com sends the following to Cloudflare when a page is opened: the page address without query parameters, the previously visited page, browser, operating system and device type, the country (derived from the IP address), and load times and page speed metrics. We only see aggregated numbers, never individual visits.

The script only runs on the public website, not on preview or test environments.

Error reports with Sentry

To find and fix bugs, we use Sentry, a service of Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA. We chose the EU data region: error reports are stored in data centers in the EU (Germany).

Sentry is only loaded when an error occurs on a page. An error report contains the error message, the location in the program code, browser and operating system, the page address without query parameters and without the part after the # sign, and the time. There are no cookies, no recording of your session and no performance tracking.

Your IP address has to be processed technically for the transfer. We configured Sentry not to store IP addresses or any other personal details. Error reports are deleted automatically when the retention period of our Sentry plan ends.

No cookies, only local settings

Musterli sets no cookies. So you don’t have to pick your theme and your preferred export format every time, your browser keeps these two settings in local storage (localStorage). They stay on your device, are not sent to us, and you can delete them at any time in your browser settings.

Designs you save, the editor’s automatic drafts and your Brand Kit (palettes, logos, shapes) are kept in your browser’s database (IndexedDB). This data also stays on your device and is not sent to us. You can delete it in Musterli itself or, like the settings, in your browser settings.

Images stay in your browser

When you load an image or file into a converter or create a color palette from an image, the file is processed only in your browser. It is neither uploaded nor stored, and it is gone as soon as you close the tab.

Images you use in a tool (for example your own motif in Seamless Patterns) or add to your Brand Kit are never uploaded either. If you save the design or the Brand Kit, they stay in your browser (see above). They only leave your device when you export a file yourself, and they are never part of a share link.

Share links

A share link holds your motif’s settings in the part of the address after the # sign. Your browser does not send this part to our server. Anyone with the link can see the motif. Colors derived from an image are not included in the link.

Contact by email

If you write to us, we process your email address and the content of your message to answer your request. We delete the message once it is resolved and no legal retention obligation applies.

Donations

Musterli is free and funded by voluntary donations. On the “Support” page we link to an external donation provider. Musterli itself accepts no payments and receives neither payment nor account details from you.

You only leave Musterli when you follow the link. The donation provider is responsible for processing your data there, and its privacy policy applies. The provider may tell us the amount donated and any details you explicitly choose to share with us.

Transfers abroad

Cloudflare and Sentry are based in the USA. Cloudflare may also process data in other countries where it operates data centers. For the USA we rely on the providers’ certification under the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework, and on the European Commission’s standard contractual clauses in the providers’ data processing agreements.

We store Sentry error reports in the EU. Access from the USA, for example by the provider’s support, still cannot be ruled out.

Retention

We keep personal data only as long as needed for its purpose or required by law. We only see statistics in aggregated form. The providers delete technical logs and error reports automatically according to their retention periods.

Your rights

You have the right to access your personal data and to have incorrect data corrected. You can ask us to delete data or restrict its processing, and you can object to processing. Where applicable, you also have the right to receive your data in a common format.

To do so, write to us at the email address above. We may ask for proof of your identity.

You can also lodge a complaint with a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU the authority of your country of residence.

Changes

We update this policy when the website or the services we use change. The version published on this page applies.