GoMuseum Privacy Policy

Effective: 2026-10-26 · Applies to: GoMuseum (com.gomuseum.app)
If the language versions differ, the English version prevails.

1. Who we are

GoMuseum ("we") is a museum guide app that offers artwork recognition by photo, AI-generated narration, audio playback and Q&A. The app is operated by APPCRAFT008 LTD, a company registered in England and Wales (company number 16529564, registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom), which is the data controller. Contact: appcraft008@gmail.com.

2. What data we collect and why

Data	Purpose	Retention
Account information: email address and username (or the basic profile of your Google or Apple account)	To create and sign in to your account and to recover access	Until the account is deleted
Artwork photos (when you take a photo to identify a work)	Used only to recognize the artwork in real time. Processed temporarily by default; the original photo is not stored and is discarded as soon as processing finishes	Not retained
Photos you choose to send us (when recognition misses, the app asks "Send us this photo?", unchecked by default; we keep a photo only if you tick it), plus an optional note you add, the text you searched for or the text on the wall label, and the artwork you eventually found	Used for three things only: adding works we have not catalogued yet, finding licensed images for works that lack one and checking that they show the same work, and finding out why recognition failed. Never shown to anyone and never added to the reference library used for recognition. Not ticking the box affects no feature	At most 90 days, deleted earlier once handled; deleted together with your account (see section 4). After a photo is deleted, only a record without the image is kept (recognition scores and the work you found)
Recognition events: image fingerprint, the recognized artwork and its confidence, museum, language	Two purposes: ① to improve recognition accuracy and to count which exhibits are photographed but not recognized, so that we know where to add material first; ② to build your "Footprints" — when you take a photo while signed in, your account is recorded so that you can look back at the works you photographed inside the app. You can delete entries one by one on the Footprints page, and export them at any time	The link to your account is kept until the account is deleted or you delete the entry yourself; statistics from which the account link has been removed are kept long-term
Usage events on our own servers: which artwork page you opened and from where (recognition, search, collection, history, home or a link), which museum you used, when a paywall was shown, purchases and pass activation. Recorded with your account ID and/or device identifier. We also count views of shared-artwork links (with the browser's user-agent string, to filter out bots), not tied to any person	To understand which features are used and where people drop off, to measure the purchase flow and to fix errors. These events contain no photos, no text you typed and no location	The link to your account or device is kept until the account is deleted (see section 4); counts from which the link has been removed are kept long-term
Device identifier	Free-quota management and abuse prevention	After the account is deleted, the device identifier and the free recognitions that device still has left are kept (no longer linked to any account), to stop people from deleting and re-creating an account to claim free quota again (see section 4)
Approximate location (only if you grant location permission)	To show the museums near you on the home screen. Your location is used only on your phone to compute the distance to each museum; it is never uploaded to our servers and never shared with any third party. You can turn off the location permission at any time in your system settings	Not retained (it never leaves your device)
Diagnostic data (crash logs, performance)	To improve the stability of the app	At most 90 days
Usage statistics: app opens, screen views, session length, plus device model and system version	To understand which features are used and to improve the product. Collected by Google Firebase (see section 3). We do not collect the advertising ID	Per Firebase default settings
Feedback you submit: the text you write yourself in the feedback box, what the feedback points at (which museum, artwork, language and type of problem), the app version and system, and the device identifier; when you are signed in, your account is also recorded	To fix errors in the content and audio and to improve the app. This is the only way we learn that "the narration of this work is wrong / mispronounced" — AI-generated content is protected by automatic checks, but in the end errors are found through users telling us. Please do not put personal information in your feedback; we do not need it	The text is kept until the account is deleted (see section 4); the defect coordinates, once the link is removed, are kept until that content has been fixed
Transaction records: time of purchase, product, amount, order number	To grant and verify pass entitlements, to process refunds, and to meet accounting and tax record-keeping obligations	Kept after the account is deleted (see section 4)

3. How data is processed (third-party processors)

• AI providers. Recognition and narration are processed by AI providers on our instructions. OpenAI receives the photo you take to identify an artwork (only when our own matching cannot decide) and artwork names, and translates text. Anthropic reads photos of wall labels, and writes and checks the narration and Q&A from public reference material (which contains no personal data). Under their API data policies, neither provider uses this data to train its models.
• Speech. Narration audio is produced by our own servers or by Google Cloud Text-to-Speech. Google receives only the narration text, which is public information about the artwork and contains no personal data.
• Sign-in with Google is provided by Google, and Sign in with Apple by Apple. Crash reports and usage statistics are provided by Google Firebase (Firebase Crashlytics and Firebase Analytics): we use only its default automatic events (app open, screen view, session); we have no custom events in Firebase and have removed the advertising-ID permission; on iPhone we never ask for tracking permission, and the data is not used for advertising or cross-app tracking.
• In-app purchases are processed by Google Play Billing on Android and by Apple's App Store on iPhone. We never see or store your payment method (card number and so on) — payment happens entirely inside Google Play or the App Store. We receive only a purchase receipt from Google or Apple, used to verify the purchase and grant the pass, and we store the order number, product, amount and time.
• Photos you choose to send us are kept in private Cloudflare R2 storage, restricted to the European Union (the R2 EU jurisdiction); they are not bound to any public address and only we can access them, with a dedicated key.
• We do not sell your personal data to anyone, and we do not use it for advertising.

4. Your rights (GDPR/CCPA)

• Delete your account: in the app, go to Settings → Delete account. It takes effect immediately after you confirm and cannot be undone.
• What happens after deletion:
  • Permanently deleted: your account profile (email, username) and the list of free audio works you unlocked.
  • The device's free quota is kept, unlinked: the device identifier and the free recognitions that device still has left are kept with the account link removed. If the same device signs in again, it continues with what was left and is not given a new allowance — otherwise anyone could delete and re-create an account to claim free quota again.
  • Your footprints and usage events are unlinked from you: the account identifier is removed from recognition events and usage events (and the device identifier from usage events), so these records no longer point to anyone; the statistics without the link (image fingerprints, recognized works, counts of screens and purchases) are kept for recognition accuracy and product statistics.
  • The text you wrote in feedback is deleted; the defect coordinates are kept, unlinked: the text you wrote in feedback is really deleted; what the feedback pointed at (which museum, artwork, language, type of problem) is kept with the account and device identifiers removed — that record says "this language of this artwork has a problem", and it has to stay for us to fix the content; deleting it would also erase an error that has not been fixed yet.
  • The photos you chose to send us are deleted: the photo itself, the note you wrote and the text you searched for are all deleted; only records that contain no image and point to no one are kept (recognition scores, the work you found).
  • Any pass you bought is voided immediately and cannot be recovered — not even by registering again; you would have to buy it again. A pass is a consumable product that is redeemed on the store's side (Google Play or the App Store) the moment it is granted, so "Restore purchases" will not bring it back. Before you delete, make sure your pass has been used up or is no longer needed.
  • Transaction records are kept: because of accounting and tax record-keeping obligations, purchase records (order number, product, amount, time) are not deleted, but they are unlinked from your identity and the personal data in them (the original purchase receipt) is removed. This is an exception permitted by a legal obligation, and it is not used for any other purpose.
• Export your data: email appcraft008@gmail.com to request it. We will provide it in a machine-readable format within 30 days. It includes your account profile, free quota, footprints, the feedback you submitted, the photos you chose to send us (photos still within the retention period are provided as time-limited download links) and your transaction records.
• You can also exercise your rights of access, rectification, erasure, portability and so on through the same email address; we will respond within 30 days.

5. Data security and where it is stored

Data is encrypted in transit with TLS; personal data such as accounts and transactions is stored on servers located in the European Union (France), and passwords are stored encrypted with bcrypt. Content assets such as artwork images and audio are kept in Cloudflare R2 object storage (they contain no personal data); the photos you choose to send us are kept in a separate private Cloudflare R2 storage, restricted to the European Union and not publicly accessible. We protect data with access control, rate limiting and daily backups.

6. Children's privacy

This app is not designed for children under 13, and we do not knowingly collect personal information from children. If you believe we have inadvertently collected data from a child, please contact appcraft008@gmail.com and we will delete it.

7. Changes to this policy

If the policy changes materially, we will announce it in the app or on this page. Continuing to use the app means you accept the updated policy.