Privacy policy

Last updated: 2026-10-17.

Tales of Museums and talesof.app are provided by Adrienn Sepa, an individual based in Hungary, under the brand Talesof. She is the controller of your personal information. This policy explains how your information is handled when you use the app or talesof.app. For privacy questions or requests, contact hello@talesof.app.

We use the information described here to provide, operate, secure and support the app and website, to prevent misuse, to fix problems, and to improve existing features such as label recognition and narration quality. Some practices below are planned rather than current; these are marked as planned, and we will update this page before they take effect.

Legal bases: we process information to provide the app and the purchases you ask for (performance of a contract); to secure the service, prevent fraud and misuse, fix problems and improve existing features (our legitimate interests in running a safe, working service); to keep purchase and accounting records (legal obligations); and, where we ask for it, with your consent, which you can withdraw at any time.

Your camera and museum labels

The app recognises label text on your device. For a new reading, it sends a captured image, available recognised text, your language and reading options to our server. Images can include people or other details around the label. Take care about what you include in the frame.

Photos you choose from your library or share into the app are processed the same way as camera scans; location and other hidden metadata are removed before upload.

The app attempts to delete temporary photo files after reading them. Our server normally processes images in memory. If diagnostic capture is enabled in both the app and server, it also saves images and model responses to investigate problems.

Planned: we intend to store captured images — on our own infrastructure or with a service provider such as Supabase — to operate the reading service and improve recognition and narration quality. Routine image storage is not current practice; we will state a retention period here before it begins.

AI services

Readings, translations, narration, extra facts and term explanations are generated by AI. The voice you hear is synthetic, not a recording of a person. AI output can contain mistakes.

AI and speech service providers may include Google, OpenRouter, Fish Audio, Cartesia and Speechify, as well as model providers accessed through OpenRouter. These services process images or text to recognise labels, translate content and generate narration. The providers used depend on the feature and configuration; not every provider receives every reading.

Planned: If Google’s label-reading service is unavailable, we may send the same captured image, available recognised text and reading instructions to OpenRouter and the model provider selected for that request as a one-time fallback. That provider may be different from Google.

Daily summaries send saved exhibit text to an AI provider. Failed readings can send text excerpts and failure details to an AI provider to explain the problem.

To offer optional background facts about an exhibit, we ask a Google search-grounded model to look up publicly available information about the person, object, place or period a label describes, using the label's text and available recognised text. Our server also searches Wikipedia for the label's title and may show a short summary of a matching article. We show these facts only when you choose to view them, and include a link to the source we relied on. The facts come from public sources rather than from the museum and may be inaccurate or incomplete. We use the search only to find and present the fact, not for advertising.

When you tap a term in a reading to learn more, we send that term and a short excerpt of the label's text to an AI provider to write a longer explanation in your chosen language. We request and cache the explanation only when you ask for it, and we do not use it for advertising.

On supported Apple devices, the app may use Apple’s on-device speech transcription and Desert Ant Labs’ Align model to improve the timing of words in generated narration. Guide audio and the resulting timing data stay on the device and are not sent to our server or Desert Ant for this feature. If Apple’s on-device transcription asset is not already installed, the device downloads it from Apple. Apple may receive normal model-download request data such as IP address and device or network information; guide audio is not sent to Apple for this feature. The app downloads the small Align model when needed; Desert Ant and the download host may receive normal download-request data such as IP address and device or network information. We use this only to improve text highlighting during playback, not for advertising. Android does not use this feature.

Accounts and purchases

Our account provider manages your account, including an account created before you add an email address. Email signup and login send your email and password to that provider. Your login session is saved on your device.

When you create an anonymous account, sign in with an email and password, request an email sign-in link, or reset a password, the app uses Cloudflare Turnstile in an embedded browser to check for automated abuse. Cloudflare processes technical signals including IP address, TLS fingerprint, user-agent, the Turnstile site key and associated origin. We send the one-time result to our account provider to verify before completing the account request. We use this only to prevent automated account activity and abuse, not for advertising. Cloudflare also uses these signals to improve its bot-detection service; see Cloudflare's Turnstile Privacy Addendum and Privacy Policy for Cloudflare's current terms and disclosures. We have not independently verified Cloudflare dashboard retention or widget-mode settings.

Signing in with Apple or Google uses that company's own sign-in screen on your device. Apple returns an identifier for your Apple account and, if you allow it, an email address, which may be a private relay address; the app asks Apple for no other profile information. Google returns a sign-in token containing your Google account email address, an account identifier and basic profile details. The app sends the returned token to our account provider, which verifies it and records the linked account. We receive no password from either company. Apple may notify our server when you revoke access or change whether your private relay address forwards email; we use these notifications to keep your account access and contact status current.

Our email provider receives your email address and account messages, including confirmation and password-reset links.

Where purchases are enabled, our purchase service and your app store handle purchase information. Our purchase service receives your app account ID. Our server receives product and transaction IDs, including whether Apple verified the transaction as Sandbox or Production, and records verified purchases and credit changes against your account. Apple Sandbox transactions are used only to test purchases and are not real charges. Designated release-review accounts and their test credits are marked separately from ordinary customer accounts. Test credits cannot be transferred to customer accounts, and a release-review account cannot be converted into an ordinary paid account.

Usage and device information

Planned: We will use a diagnostics service to find crashes, errors and slow steps in the app and server, including startup, navigation, sign-in, purchases, device checks, label scanning, narration, playback and shared visits. Reports will contain technical error categories and code locations, event times, step durations and outcomes, app and server versions, device model and operating-system version, service and model names, and numerical resource-use information. Random identifiers will link the steps of an operation across the app and server. We will exclude photos, label text, audio, account and persistent device identifiers, email addresses, credentials, purchase receipts and transaction identifiers, and shared-visit codes. Screenshots, session recordings and unrestricted console logs will be disabled. The service will receive your IP address when your device transmits reports. We will verify report fields, retention and processing locations, and publish the verified details before enabling this feature for visitors.

The app sends usage analytics to our server, including an installation ID, event times, screen and playback actions, settings changes and errors. Events can include exhibit headlines and visit IDs. Operational logs include request identifiers, response status, timing, the app version and build number reported by the app, and sometimes recognised-text excerpts. These records support usage analysis and troubleshooting.

Planned: If you have enabled story preparation, and the owner selects your account to prepare a story, the app will upload an existing reading's text, audio, language and timing information to our server while the app is in the foreground. It will not upload a new photo for this feature. You can turn story preparation off in the app. Source text and audio will be deleted after 24 hours; a finished video and poster will be deleted after seven days. The story is prepared for you to review and share; the app will not post it to Instagram, WhatsApp or another service automatically. Share actions and your responses, such as opening, replaying, dismissing or choosing a share destination, will be linked to your account for 30 days. A separate owner audit record will be kept for 90 days. After that, anonymous aggregate counts may be kept for 12 months.

Planned: If you separately opt in to story-ready notifications, we will send a generic notification that a story is ready. It will not include your reading text or story details. Apple or Google may receive a device push token and the information needed to deliver the notification. You can turn notifications off at any time. Referral records may connect the inviter and invited account and show whether the invitation met its eligibility conditions. These relationship and eligibility records will be deleted no later than 90 days after they expire or an account is deleted. Credit ledger records for awarded credits will be retained for financial record-keeping.

We record scan performance information to find delays and errors. This includes a random scan identifier, app and server versions, language, the narrator voice requested, image and text sizes, processing times, the AI and speech services and models used, server decisions, and whether on-device text recognition, retries or repairs were used. The app also reports which steps of each scan were reached (such as camera, upload, translation and playback), how long each took, the time of the scan to the minute, and a general error category if a step failed. These records do not include your photos, label text, audio, IP address or account and device identifiers. We temporarily save these records on your device and our server so interrupted uploads can be retried. Your device keeps records for at most 20 scans, each for no more than 24 hours, and removes them sooner after successful upload or when you sign out. Pending records on our server expire within seven days. We store detailed records with our database provider for 30 days from collection, and keep daily summaries without scan identifiers for 12 months.

To prevent repeated free-credit claims, we associate a device identifier with your account. On iOS, the device-verification service also receives a token to check whether the device has claimed credits.

To create and protect anonymous accounts, prevent fraud and limit misuse, the app sends Apple App Attest data on iOS and Google Play Integrity data on Android to our server. Apple or Google verifies whether the request came from a genuine version of our app on an eligible device. We store limited security records, such as an attested app-key identifier and counter, an integrity-verdict result, an account-device link and an anti-abuse decision. We also keep a truncated or keyed-hash network rate-limit value for up to 24 hours. We retain raw proof data for up to seven days, keep security records while the account or device is active, and retain them for up to 90 days after deletion or revocation. We do not use these records for advertising.

To limit automated or excessive requests for optional explanations and fact narration, we keep a short-lived counter associated with a keyed hash of your account identifier. The counter records the number of requests in a daily window, not the explanation text or audio. It expires at the end of that window, within 24 hours of creation, and is removed by our scheduled security cleanup. A cleanup outage or backlog may delay removal. We use it only to protect the service and control misuse, not for advertising.

The app does not request GPS location. Photos and exhibit text can still reveal where you are.

Planned: shared museum visits

When shared visits become available in the app, creating or joining a visit will link your account to that visit. Our server will keep the visit code, participant membership, chosen languages, whether participants are listening together or on their own, and a visit log of readings. Other participants will be able to see readings in the visit log. Audio will be delivered to the participants listening together in their chosen languages; a reading made while you are “On my own” will play only to you, but its entry will still appear in the visit log. “On my own” is not a private-reading mode.

Your device will save complete shared readings you receive as text and audio in History, within the same limit of 50 recent readings. These saved readings will remain after you leave a visit until you delete them or newer readings replace them. Incomplete shared recordings will not be saved as complete readings. Shared-visit History will not contain plaque photos.

We will remove temporary visit membership and replay records when the host ends the visit or the last participant leaves. After four hours without visit activity, a visit will expire and its records will be removed on the next visit cleanup; unrelated visits will not extend that retention. Temporary server audio will remain subject to the separate server-audio retention period described below. Ending a visit will not delete readings already saved on participants' devices, financial records, or separately retained operational records.

Planned temporary shared-audio storage

We will send generated shared-visit audio to Cloudflare for temporary storage in a private Cloudflare R2 bucket so the server can deliver it to authorized participants and support replay during the visit. We will not store plaque photos in this bucket. The server will deny reads once audio is past its 15-minute retention period, then request deletion and retry if deletion fails. Cloudflare service outages or repeated deletion failures may delay removal, so we cannot guarantee deletion at an exact minute. See the service-provider information for Cloudflare's role.

To limit attempts to guess visit codes, we will keep a temporary count of failed join attempts for your account. It will expire five minutes after the latest failed attempt. We will use it only to protect shared visits from misuse.

Storage and deletion

We store account and device identifiers, account creation details, credit balances, purchase records and credit history. Account, device, purchase, usage and operational records have no fixed automatic deletion schedule.

We record which version of this privacy policy your account has accepted, and when, as part of your account information. Unlike purchase and credit records, which we keep for financial record-keeping even after account deletion, this acceptance record is deleted along with the rest of your account information if you delete your account.

Your device keeps up to 50 recent readings with text and audio. You can delete readings individually; adding more removes the oldest entries. Server audio is temporary and becomes eligible for removal after 15 minutes, on subsequent checks.

Planned: Story source text and audio will be removed after 24 hours, and finished story videos and posters after seven days. Account-linked story reaction events will be removed after 30 days, and owner audit records after 90 days; anonymous aggregate totals may remain for 12 months. Referral relationship and eligibility records will be removed within 90 days after expiry or account deletion. Credit ledger records remain for financial record-keeping.

Diagnostic-image cleanup runs when another image is saved. It removes images older than seven days or beyond the newest 200, together with their associated diagnostic records. Files can remain longer if no further capture triggers cleanup.

Deleting a saved reading does not delete your account or server records. You can request account deletion in the app, including for an account created before you add an email address, or by emailing hello@talesof.app. We keep a minimal pending-deletion record containing your account ID, request time and processing state so we can finish or retry your request. We remove completed deletion-job records within seven days. Successful deletion removes your sign-in information and policy-acceptance records; purchase and credit records remain for financial record-keeping, and limited security records follow the retention periods above. A fixed backup-deletion timetable is not yet available.

Children

The app is for a general audience and is not directed at children. You must be 13 or older to use it. A child under 13 may use it only with a parent or guardian who uses the app with them and agrees for them. The app does not verify age. If we learn that a child under 13 created an account without a parent or guardian, we delete it. Parents and guardians can contact hello@talesof.app to request deletion.

Hosting and international processing

Hosting, account, email, purchase and AI providers process the information needed for the functions described above. Information may be processed outside your country. Processing locations and provider retention arrangements depend on the service used.

The service providers named in this policy and on the service-provider page are current examples. We may add, remove or replace providers within these categories as the app develops.

If the app or its assets are transferred to another organisation — for example through a merger, acquisition or reorganisation — information may be transferred as part of that change and would remain subject to a policy at least as protective as this one.

Visiting talesof.app

The website has no ads, cookies or third-party analytics. Our website host, Cloudflare, processes each request, including your IP address, browser user agent and the page requested, to deliver and protect the site. Your browser may also send Cloudflare automatic error reports when a page fails to load. We rely on our legitimate interests in running a working, secure website. The retention period of these hosting logs is not yet confirmed.

To learn which pages are useful, the website counts page views on the server. For each page viewed in a regular browser, it adds one to a daily total for the date, the page address (without anything after "?"), the country that Cloudflare derives from your IP address, and either the name of the website you came from or, if the link you followed carried a campaign tag such as "utm_source=chatgpt.com", that tag. Pages that an AI assistant fetches because one of its users asked a question are counted separately, under the assistant's name. When you tap a "Download on the App Store" button or scan its QR code, the website adds one to a daily total for the date, the button's page and position, and your country, and then sends you to the App Store; the link names that page and position as an App Store campaign, so that Apple can show us how many downloads each position brought, as totals only. Only these totals are stored, in a Cloudflare database located in Western Europe: no IP address, cookie, browser details or other identifier, and nothing runs in your browser for this. We rely on our legitimate interests in improving the website. We delete totals after 24 months.

When you follow a link from our website to another website, your browser tells that website that you came from talesof.app: the site name only, not the page you were reading.

If you choose a language in the website's language menu, your browser stores that choice on your device under the name "museums-lang", so the page opens in that language next time. It is not sent to us, and you can remove it by clearing this site's data in your browser.

If an account email opens our confirmation page, our website host receives its request URL, including any temporary sign-in code in that URL. The page passes the code to the app to finish the account action. Its script does not save the code in browser storage or send it to analytics. The request URL may appear in hosting logs; their retention period is not yet confirmed.

Your rights

Depending on applicable law, you may have rights to access, correct, delete or obtain a portable copy of your information, restrict processing, or object to certain uses. Where applicable, you may opt out of sale or sharing and exercise your rights without unlawful discrimination. These rights have legal conditions and exceptions.

Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. You may complain to the data-protection authority where you live or work, or to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH).

Send requests to hello@talesof.app. We may ask for information needed to verify your identity and locate your records. Do not send your password or payment-card details.

Changes to this policy

We will update this page and its date when this policy changes. If a change is significant, we will give additional notice where the law requires it. Changing this page does not by itself remove any separate obligation to notify you or to ask for your consent. Our Terms of Service set out the rules for using the app.