Service providers

Last reviewed: 2026-09-28.

These services support Tales of Museums. AI and purchase integrations depend on configuration and enabled features; not every service receives every reading. This list identifies integrations, not a verified list of providers active for your particular request. The providers here are current examples and may change as the app develops; this page is kept up to date.

Accounts, email and hosting

Supabase manages authentication and the database. It handles account credentials and identifiers, credit balances, device-credit checks, purchase records and, when enabled, scan performance statistics.

Resend is the account-email provider recorded in our email setup. It handles recipient addresses and message contents, including account links.

Oracle hosts our API according to deployment records. The API handles images, text, audio generation, usage events and account-related requests. When scan-performance statistics are enabled, it also temporarily holds pending records so interrupted uploads to the database can be retried.

Planned: For owner-selected story preparation, Oracle will receive existing reading text, audio, language and timing data from the app and run the story preparation worker. Cloudflare R2 will store the private source files temporarily and finished story videos and posters for seven days. Story preparation and storage are not enabled for visitors.

Cloudflare hosts talesof.app and provides DNS. As website host, it receives page requests, including temporary account codes in confirmation-page request URLs. Visitors' browsers may also send it automatic error reports (Network Error Logging), and its email-address protection adds a small script to pages that show an email address. Our website code on Cloudflare also keeps daily page-view totals (date, page, country, referring site's name; no IP address or identifier) in a Cloudflare D1 database located in Western Europe, deleted after 24 months. Hosting-log retention has not yet been confirmed. Cloudflare Turnstile checks for automated abuse during anonymous-account creation, email/password sign-in, email sign-in-link requests and password-reset requests in an embedded browser. It may receive the verification token and technical request data, such as IP address, browser or device information, network and country information, and short-lived anti-abuse identifiers. The result is used only to permit or refuse the relevant account request. See Cloudflare's Turnstile Privacy Addendum and Privacy Policy for Cloudflare's current terms and disclosures. Turnstile retention and dashboard widget-mode settings have not yet been confirmed.

Planned: Cloudflare R2 will temporarily store generated shared-visit audio in a private bucket so our API can deliver it to authorized participants and support replay. It will not receive plaque photos for this feature. The API will deny reads once audio is past its 15-minute retention period, then request deletion and retry failures; outages or repeated deletion failures may delay removal, so exact deletion timing is not guaranteed.

AI and speech

Google handles label images and reading instructions, narration text and voice instructions, and text excerpts and failure details used to explain unsuccessful readings. For optional background facts, a Google search-grounded model receives the label's text and available recognised text.

Wikipedia (Wikimedia Foundation) receives search requests from our server containing a label's title when we look up optional background facts. Requests come from our server, not from your device.

OpenRouter passes label images, reading instructions, summary text or speech requests to model providers on our behalf. The model and host can vary by request.

Planned: If Google’s label-reading service is unavailable, OpenRouter and the model provider selected for that request may receive the same captured image, available recognised text and reading instructions for one fallback attempt. The selected model provider may differ from Google.

Fish Audio, Cartesia and Speechify are alternative speech integrations. The selected service receives narration text and voice settings.

Apple provides the optional on-device transcription asset that Align uses on eligible iOS playback. If the asset is not already installed, the device downloads it from Apple. Apple may receive normal model-download request data; it does not receive guide audio for this feature.

Desert Ant Labs supplies the optional Align on-device word-timing model for eligible iOS playback. It processes generated guide audio and timing data locally. The SDK downloads the small model from its configured model host when needed; it does not receive guide audio. The model-download host may receive normal download-request data; its retention and processing details have not yet been confirmed.

Purchases and device checks

RevenueCat receives the app account ID and purchase information when purchases are configured. Apple App Store or Google Play handles the platform purchase. Our server integration verifies Apple transactions with Apple.

Apple DeviceCheck receives an iOS device token to check and record whether free credits have been claimed.

Planned: If you opt in to story-ready notifications, Apple Push Notification service or Firebase Cloud Messaging may receive your device push token and generic delivery information so the notification can be delivered. Notifications will not contain reading text or story details. Push delivery is not configured or active.

Planned: Apple App Attest and Google Play Integrity will support anonymous-account security and abuse prevention. The app will send App Attest data or a Play Integrity token to our server; Apple or Google verifies whether it came from a genuine eligible app and device. Our server will record the resulting limited security information, including account-device links and anti-abuse decisions, as described in the Privacy policy.

Apple and Google act as sign-in providers when you choose to sign in with their accounts. Apple receives your sign-in request and returns an account identifier and, if you allow it, an email address that may be a private relay address; the app requests no further profile details. Google receives your sign-in request and returns a token containing your Google account email address, an account identifier and basic profile details. Both tokens are sent to Supabase for verification and to record the linked account.

Sentry

Planned: Sentry will process app and server crash, error and performance reports to diagnose failures and delays. Reports will include technical step names, timings, outcomes, versions, device and operating-system information, service and model names, numerical resource-use information, and random operation identifiers linking related steps. Sentry receives the sender’s IP address when reports are transmitted. Reports may be processed outside your country. Our projects’ processing locations and retention settings will be verified and published before activation. Photos, label text, audio, account and persistent device identifiers, email addresses, credentials, purchase receipts and transaction identifiers, and shared-visit codes will be excluded; screenshots, session recordings and unrestricted console logs will remain disabled.

Usage analytics

The app sends usage events to our own API and event storage. These include installation identifiers, actions, settings and errors. Hosting providers handle this traffic and storage.

Processing locations

Information may be processed outside your country. The complete processing locations, retention periods and transfer arrangements of these providers and their downstream services remain to be confirmed.