Last updated: 12 September 2026
This policy explains what patternbuilderwp.com and the Pattern Builder plugin’s cloud features collect about you, why, and what you can do about it. It is written to be read. Twenty Bellows operates the Service and is the controller of the personal data described here; reach us at support@twentybellows.com.
1. What we collect
Your account
When you create an account we store your email address, your display name, your handle, and a hash of your password (never the password itself). We record whether you said yes to news and offers, and when and where you said it. We send a confirmation email and keep the time it was sent and whether it was confirmed.
Connected sites
Connecting a site from the plugin creates an access token for that site and that WordPress user. We store the site’s address, the WordPress username that connected, a hash of the token (the token itself exists only on your site), and when it was created and last used. You can revoke a connection from your account page or from the plugin.
Your patterns
Patterns you upload are stored with their titles, descriptions, keywords, the images they use (we keep our own copies so a pattern does not depend on your site staying up), the design tokens and block styles they carry, and the collection they are in. Every collection is private unless a publisher makes it public.
Billing
Pattern Builder Pro is sold through Freemius, Inc., the merchant of record. Freemius collects your payment details and billing address under its own privacy policy; we receive and store the licence that results — its identifier, plan, status and dates — and never your card number. Your email address is passed to Freemius, read-only, so the licence can be matched to your account.
Analytics on this website
This website measures page views with PostHog in cookieless mode: nothing is stored in your browser, and visitors are told apart for a day by a salted hash that cannot be turned back into an address. That is why there is no cookie banner. We also record, server-side and against your account, the moments only the Service can see: an account created or confirmed, a subscription started or cancelled, an account deleted.
Usage data from the plugin
Pattern Builder asks once, on each site, whether it may report anonymous usage, with Allow and No thanks. Nothing is sent unless an administrator chooses Allow. When allowed, the plugin sends which parts of it are used and the environment — its own version, the WordPress and PHP versions, locale, theme, whether the site is a multisite — under a random identifier minted when you allow it. It never sends your site’s address or name, your patterns, or anything about your visitors.
Logs and rate limits
Like every web service we keep short-lived server logs with IP addresses and request details, for security and to diagnose problems, and we count requests per IP address for a few minutes at a time to limit abuse of sign-in and sign-up.
2. Why we use it
- To run the Service: store and deliver your patterns, know which sites are yours, apply your plan’s limits, and show the directory.
- To keep it safe: confirm addresses, hash secrets, limit abuse, and act on reports.
- To bill you, through Freemius, when you subscribe.
- To write to you: emails about your account — confirmation, password resets, changes to these terms — are sent to every account. News and offers are sent only if you said yes, and every such email has an unsubscribe link.
- To understand use, in aggregate, from cookieless analytics and opt-in usage data.
Where data-protection law asks for a legal basis: running the Service and billing are performance of our contract with you; safety, logs and aggregate analytics are our legitimate interest in operating the Service well; marketing email is your consent, which you can withdraw at any time from your account page.
3. Who else sees it
We do not sell personal data. We share it only with the providers that run the Service on our behalf — our hosting provider, our email delivery provider, Freemius for payments and PostHog for analytics — each bound to use it only for that purpose; with a site you have connected, which receives the patterns you install through it; and where the law requires it. Published collections carry their publisher’s handle and display name; that is the one thing about an account that is public, and only for accounts we have invited to publish.
4. Cookies
This website sets a cookie only when you sign in, to keep you signed in; it is the ordinary WordPress authentication cookie and it is removed when you sign out. There are no advertising or analytics cookies.
5. How long we keep it
For as long as your account exists. Deleting your account, from your account page, removes your patterns, collections and connections; billing records are kept as long as tax law requires; copies in routine backups are rotated out on their own schedule; logs are kept for a short, fixed period. Usage data from the plugin is aggregate and carries no account.
6. Your rights
You can see and change your display name, password and marketing choice, disconnect sites, and delete your account, all from your account page. Your patterns can be installed onto any site you connect, which is how you take them with you. For anything else — a copy of the data we hold about you, a correction, an objection, or a complaint — email support@twentybellows.com. If you are in the EU, the UK or another place with a data-protection authority, you may also complain to it.
7. Security
Passwords and access tokens are stored as hashes; connections between your site and the Service, and between your browser and this website, use TLS; every pattern is checked on the way in and again on the way out. No system is perfectly secure, and if a breach affects you we will tell you as the law requires.
8. Children, transfers and changes
The Service is not directed at children under 16 and we do not knowingly hold their data. The Service is hosted in [country]; using it from elsewhere means your data travels there, under the safeguards the law requires. We may update this policy; a material change is announced on this page and by email to account holders before it takes effect.