MuseScope Privacy Policy

Effective date: 13 July 2026 · Last updated: 6 August 2026 · Version: 1.3

MuseScope is operated by Igor Fomin ("MuseScope", "we").

This policy explains what information the MuseScope website (musescope.app) and the MuseScope iOS application process, why, and what your choices are. MuseScope does not sell personal information, and we do not send marketing emails.

Privacy and support contact: support@musescope.app

This document has three parts: A — the website, B — the iOS application, C — provisions common to both.

Part A — Website (musescope.app)

A.1 What the website is

The website is a read-only art catalogue. It has no user accounts, no registration, no contact forms, no newsletter, and it does not display advertising. You can browse the website without creating an account or actively submitting personal information.

A.2 What the website processes

When you visit the website, our infrastructure and analytics may process:

• your IP address and the approximate country or region derived from it;
• browser type, device type and operating system;
• the pages you view, the date and duration of your visit, and the site you arrived from (including advertising-campaign attribution parameters, if present in the link);
• server request and security logs;
• your cookie-consent choice.

Server access and security logs are retained for up to 90 days.

A.3 Analytics (Google Analytics 4)

We use Google Analytics 4 to understand page views, traffic sources, approximate visitor geography, browser and device statistics, and site performance.

We use Google Consent Mode. In the European Economic Area, the United Kingdom and Switzerland, analytics consent is required: Google Analytics does not store Analytics cookies or a client identifier until you grant consent by choosing "Accept" in the consent banner. "Decline" is always as easy to choose as "Accept", and the website remains fully functional if you decline. Outside those regions analytics may run by default; in every region you can opt out or change an earlier choice at any time via the permanent Cookie settings control in the website footer.

Advertising storage, ad personalisation and remarketing are disabled everywhere. We do not use Google Ads remarketing, Meta Pixel, TikTok Pixel, session recording, heatmaps or A/B-testing tools. Google Analytics data retention is limited to 14 months.

A.4 Cookies and local storage

The website language is part of the page address (for example /de/…) and is not stored in a cookie.

Part B — iOS Application

B.1 Account and sign-in

You can use large parts of the app without an account. If you sign in, MuseScope creates an account and may store:

• your email address;
• if you use Google Sign-In: your Google account identifier, the name Google provides, and your Google profile photograph;
• if you use Sign in with Apple: your Apple identifier and, at your choice, your name and email address, which may be Apple's private relay address;
• your chosen display name and a profile image or avatar you upload;
• an internal MuseScope account identifier, the account creation date, and authentication timestamps and security logs.

Email is used only for signing in (one-time codes), restoring access, security notices and essential account communications — never for marketing.

Account and profile information is kept while your account is active and removed when you delete the account (see B.9).

B.2 Preferences and activity

Linked to your account, MuseScope may store: favourite artworks, artists and museums; likes; your recognition history (see B.3); interface language, guide language and voice selection; search queries and viewed content; and your subscription or entitlement status.

We use this to sync your experience across devices, restore your preferences, improve search, recommend relevant artworks, artists, museums and stories, and understand aggregate feature usage. Your profile, favourites and activity are not visible to other users. Search and viewing activity and recognition metadata are retained for up to 12 months unless you delete your account earlier.

B.3 Camera, photos and artwork recognition

When you scan an artwork or a museum label, the app uses your camera or a photo you select. Museum-label text recognition (OCR) normally happens on your device but may be processed on MuseScope infrastructure when server-side recognition is required. For artwork recognition the image is uploaded to MuseScope infrastructure (Microsoft Azure, United States regions) and processed by MuseScope recognition services together with Microsoft Azure AI Vision, Google and OpenAI commercial APIs.

Recognition history. If you are signed in, your account may record the outcome of a recognition: the recognised artwork, a link to the relevant artwork record, the date and time, and related recognition metadata — for example, that you recognised a particular Leonardo da Vinci painting on a particular day. Your recognition history never contains the photograph you submitted.

Uploaded photographs. The original photograph is uploaded to temporary storage and processed separately from your account history. It may be used for recognition, label-text extraction, artwork cropping, embeddings and similar temporary technical representations, detecting recognition failures, automatically measuring and improving the quality of the recognition pipeline, and investigating security or technical incidents. Once this processing workflow separates the photograph from your request, the photograph is no longer associated with your account; it is not placed in your history, is not retained as part of your profile, and is deleted automatically under the retention schedule in this policy — in all cases within 90 days. Temporary crops and embeddings derived from your photo are likewise deleted when no longer needed.

External recognition providers do not receive your MuseScope account identifier, email address, profile information or other persistent identity information; only an opaque technical request identifier is used.

Uploaded photographs are not used to train MuseScope models or third-party AI models and are not added to a permanent training dataset; they are not used for advertising or marketing profiles, for facial recognition, or to identify museum visitors. People who incidentally appear in a photo are treated as irrelevant visual noise and are not identified or analysed. Routine manual review of user photographs is not part of the service.

B.4 AI art guide and chat

The app includes an AI-powered art guide you can ask about artworks, artists, museums, architecture, history and related cultural and educational topics. Questions outside these subjects may be refused or redirected.

To answer, MuseScope sends to a commercial AI provider (OpenAI, Anthropic or Google, depending on configuration): your question, recent conversation context, the name of the relevant artwork, artist, museum, or place explicitly selected or mentioned by you, related MuseScope editorial information, label text or recognition results where relevant, and an opaque conversation identifier. We do not send your email address, account or Google/Apple identifiers, profile, or subscription transaction identifiers, and we do not send your device location or location data collected by the app.

We use these providers under commercial API terms that do not use customer content to train their general-purpose models by default, and we do not enable optional data-sharing settings. Providers may retain limited technical or abuse-prevention records under their own service terms.

Your conversations with the AI guide are stored as part of your account, so the guide can remember earlier discussions and you can revisit them in Chat History. They are kept until you delete them: the Delete Conversation action in the app removes the text of all your chat messages, and deleting your account removes them as well. After deletion we keep only anonymised usage records — message counts, token counts, technical cost metrics and timestamps, with no message text — for fair-use, billing and service-quality purposes. We do not use chat content for training models, marketing, advertising profiles, or routine manual review.

B.5 Location

While you are using artwork recognition, MuseScope may ask for your approximate location. It is used to estimate which museum you are visiting, narrow the set of candidate artworks, and improve recognition accuracy.

Granting location access is optional, and the app remains fully usable without it. Location is not stored in your recognition history, is not permanently linked to your account, is not used for advertising or long-term visit tracking, and is not sent to conversational AI providers. It is discarded after the relevant recognition request is complete. The app does not request precise location.

B.6 App analytics and diagnostics

We rely on Apple App Analytics and Apple-provided crash and diagnostic reports (controlled by your iOS "Share with App Developers" setting), plus MuseScope's own server-side operational and security logs. The app contains no third-party analytics, crash-reporting or advertising SDKs, collects no advertising identifiers (IDFA) and does not track you across other companies' apps or websites — which is why it never shows the App Tracking Transparency prompt.

Server-side logs may contain IP address, request identifier, app and OS version, device model, response status, error information and authentication/security events. Ordinary backend logs are kept up to 90 days; authentication and security logs up to 12 months.

B.7 Subscriptions and purchases

Subscriptions and in-app purchases are processed by Apple through the App Store and StoreKit. MuseScope never receives your payment-card numbers, bank details or Apple Account password.

To provide Premium access and restore it on your other devices, MuseScope may receive from Apple and store, linked to your account: the purchased product and subscription type, transaction and original-transaction identifiers, start and expiration dates, and trial, renewal, cancellation, refund and current entitlement status.

Transaction records needed for fraud prevention, accounting, dispute handling, refunds or legal compliance may be retained after account deletion, de-identified and disconnected from the deleted account where reasonably possible. Deleting your MuseScope account does not by itself cancel an Apple subscription — manage or cancel subscriptions in your Apple Account settings.

B.8 Support requests and issue reports

The app lets you report a problem with an artwork, artist, museum, story or article, and contact support from your profile. When you send one, we store the category you chose, the optional text you wrote, which item it was about and how that item appeared at that moment, plus basic technical context: app version and build, platform and operating-system version, device model, your interface and guide languages, and your subscription tier. A report sent from a story or an article also records where in it you were — the scene or the position in the text — so a problem with a particular image or pronunciation can be found without asking you.

You can send a report without signing in. It is then linked to an identifier for your installation of the app rather than to you. If you later sign in on the same device, requests sent from that device may be attached to your account so that you keep their history; requests sent from another device, or from an installation you have since removed, cannot be recovered.

We do not store payment-card details, full purchase receipts, authentication tokens or unrelated personal data in a support request. Replies from MuseScope appear inside the request in the app: we do not email you about them, and there are no push notifications.

Messages in a support request are kept for up to 24 months after the request is closed. Deleting your account deletes the text you wrote and detaches the request from you; what remains is an anonymous record that a particular artwork or page was reported for a particular reason, which we keep as a catalogue-quality record and which cannot reasonably be connected to you.

B.9 Deleting your account

The app has a built-in Delete Account function. Deletion immediately disables the account and removes your email address, Google and Apple identifiers, name, display name, profile image, favourites, likes, recognition-history records and their links to artwork records, search and viewing history, your chat conversations with the AI guide, and all other account-linked personal data.

Recognition history associated with the account is deleted immediately. Original photographs and temporary technical representations that have already been separated from the account are not individually linked to the account and are deleted automatically under the retention schedule described in this policy.

Residual copies may persist in encrypted backups for up to 7 days before being overwritten. Aggregated statistics that cannot reasonably be connected to you cannot be individually deleted. Transaction records that must be retained (see B.7) are kept in de-identified form where reasonably possible.

Part C — Our Instagram account

C.1 What this part covers

We run an Instagram account, @musescope.app. This part explains what happens to the messages people send it, and it applies to you even if you have never visited our website or installed our app — leaving a comment or sending a direct message is enough.

C.2 What we receive

When you comment on one of our posts or send us a direct message, Instagram passes us:

• your Instagram username and the account identifier Instagram assigns for our account;
• the text of your comment or message, and when you sent it;
• which post or reel the comment sits under;
• your profile picture, where Instagram makes it available.

We do not receive your email address or your phone number, and we never see your Instagram password.

C.3 Why we process it

To read what you wrote and answer it. That is the whole purpose. Some replies are drafted with the help of the AI providers listed in Part D and are reviewed by a person before they are sent — nothing is published or sent to you without a person approving it.

Our legal basis is our legitimate interest in running our own social media presence and replying to people who contact us there. We do not use these messages for advertising, we do not build profiles from them, and we do not sell them.

C.4 Keyword giveaways

Some posts invite you to comment a keyword to receive a free guide. If you do, you receive one direct message containing the links, and nothing after it. There is no follow-up sequence and no further unsolicited messages.

C.5 Retention and your choices

We keep comments, direct messages and our replies for up to 24 months, then delete them. Write to support@musescope.app and we will delete our copy sooner. You can delete your comment or message on Instagram at any time, and you can block the account to stop hearing from us.

Instagram is operated by Meta, which processes your data as its own controller under its own policy. This part covers only what we do with what Instagram passes to us.

Part D — Common Provisions

D.1 Legal bases for processing

Where the law requires a legal basis, we rely on:

• performance of a contract — creating and operating your account, authentication, subscriptions, saved preferences, synchronisation across devices, and the app features you request;
• consent — optional Google Analytics cookies on the website;
• legitimate interests — security, fraud prevention, technical logs, diagnostics, service reliability, and product improvement;
• legal obligations — transaction, accounting, tax and compliance records.

D.2 Service providers

Providers that process user information in production:

• Microsoft Azure — hosting, storage, database, logging, email delivery of sign-in codes, and recognition infrastructure;
• Microsoft Azure AI Vision — image recognition;
• Google — Google Sign-In, Google Analytics (website), and Google AI services used in recognition and the AI guide;
• Apple — Sign in with Apple, App Store purchases, App Analytics and crash diagnostics;
• OpenAI — commercial APIs used in recognition verification and the AI guide;
• Anthropic — commercial APIs used in the AI guide.

We use these services under commercial terms that do not permit our content to be used to train their general-purpose models by default, and we do not enable optional data-sharing settings. Providers may retain limited technical or abuse-prevention records under their own service terms. Pre-generated editorial content (for example narration audio) is produced without any user data, so the tools used to create it are not listed here.

D.3 International processing

MuseScope is available internationally. Primary infrastructure is hosted in Microsoft Azure regions in the United States, and providers may process information in the United States and other countries where they operate; privacy protections may differ between countries. We use reasonable contractual, organisational and technical safeguards where applicable.

D.4 Retention schedule

D.5 Your rights

You may contact us to ask whether we process your data and to request a copy, correction, deletion, restriction, objection, withdrawal of optional consent, or portability where applicable. Write to support@musescope.app; we acknowledge privacy requests within three business days and complete them within the timeframe required by applicable law. Account deletion is also available directly in the app.

You may also have the right to lodge a complaint with the data protection authority in the country where you live or work.

D.6 Children

MuseScope is not directed to children under 13 and does not knowingly collect personal data from them. Users below the applicable age of digital consent must have any legally required parental or guardian authorisation.

D.7 Support correspondence

If you email support@musescope.app, we process your email address, name, message content, attachments and any technical details you volunteer, and retain the correspondence for up to 24 months after resolution for support continuity, dispute handling, fraud prevention, security and legal recordkeeping. An email-service provider processes this correspondence on our behalf.

D.8 Security

We protect information with encrypted network communication, restricted and role-based administrative access, secure authentication, encrypted and protected backups, logging and monitoring, separation of user identity from temporary recognition and AI requests, vendor-security controls and regular maintenance and review. No online service can promise absolute security.

D.9 Changes to this policy

We may update this policy as MuseScope evolves. The effective date, last-updated date and version above always reflect the current revision, and we will provide notice of material changes where reasonably appropriate or legally required.

Terms of Use are a separate document.

Terms of Use →