Privacy policy

Last updated 3 November 2026

Art Decoded has no accounts, no cookies and no ads, and sells nothing about you. This page says what does happen when you use it at artdecoded.app.

Who is responsible

The “controller” under the EU General Data Protection Regulation (GDPR).

When you open the app

Your browser fetches the app, its images and its texts from the servers below. Like every request on the internet, each one carries your IP address, what is requested and when, and your browser’s name and version. These are used only to deliver the app and to protect it from attacks.

• Cloudflare (Cloudflare, Inc., USA) delivers the app, its fonts and the painting images (artdecoded.app, tiles.artdecoded.app).
• Supabase (Supabase, Inc., USA; servers in Ireland) delivers the texts, thumbnails and audio. It keeps technical logs with IP addresses for at most a week.

Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in delivering the app reliably and securely.

Usage statistics

To learn which paintings and details people look at, and where the app is confusing, it records anonymous usage events with PostHog (PostHog, Inc., USA), on PostHog’s EU servers in Frankfurt, through our address relay.artdecoded.app.

Recorded: which paintings, details and stories are opened and closed, and how you got to them (from the gallery, a link, a tap on the painting or a suggestion); which details were suggested to you to see next; where on a painting you tap, and which part of it is on screen; shares and expanded articles; which control you use for each action — the name of a key you press, a button, or a gesture such as a click, swipe, pinch or turn of the mouse wheel — and whether it was a mouse, touch screen, trackpad or keyboard; how long the gallery took to appear, which paintings you filter it to, and how far down it you scroll; that the feedback form was opened and sent, never what you wrote in it; the page address and the site you came from; your browser, operating system and device type, with their versions; screen and window size, language and time zone.

Not recorded: your IP address, your name, or anything you type: no key is recorded while you are in a text field, and mouse movements are not recorded. No cookies are set and nothing is stored in your browser, except the note that you turned statistics off, if you do. To count visits, PostHog computes a code from your IP address, your browser and a key that changes every day; the IP address itself is not kept, and a visitor cannot be recognised from one day to the next. Events are kept for up to one year.

Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in improving the app. You can object at any time:

Turning statistics off needs JavaScript.

The app also records nothing when your browser sends a “Do Not Track” or “Global Privacy Control” signal.

When you send feedback

The app’s form (“Suggest an edit” under an article, “Send feedback” in About) sends us your message, the images you attach, if any, and your email address, if you give one. It also sends what the form lists before you send it: the painting or detail it is about and its link, the app’s version, your browser and operating system, and the size of your window. Images are redrawn in your browser before they leave it, which removes the place a photo was taken and all other metadata.

Reports are stored with Supabase (servers in Ireland), where only we can read them, and are deleted 12 months after we have dealt with them. Your email address is used only to reply to you. To keep the form from being flooded, reports are counted per IP address for the day, under a code that changes every day; the count is deleted the next day, and the address itself is not stored.

Each report is also emailed to our mailbox (Gmail), sent through Resend (Resend, Inc., USA), which then carries the report, its link to your images (valid for seven days) and your email address, if you gave one.

Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in correcting the app’s texts, improving the app, and protecting the form from abuse.

When you email us

If you write to [email protected], we use your address and message only to answer you, and delete them once the matter is settled unless the law requires us to keep them. The mailbox is provided by Google (Gmail). Legal basis: Art. 6 (1) (f) GDPR.

Transfers outside the EU

Cloudflare, Supabase, PostHog, Google and Resend are US companies. Where data reaches the USA, it is protected by the EU–US Data Privacy Framework (the European Commission’s adequacy decision of 10 July 2023) where the company is certified under it, and otherwise by the EU’s Standard Contractual Clauses.

Your rights

You may ask for access to the data about you (Art. 15 GDPR), for its correction (Art. 16) or deletion (Art. 17), for its use to be restricted (Art. 18), for a copy in a portable form (Art. 20), and you may object to its use (Art. 21). Write to [email protected]. Because the app does not identify you, we usually cannot tell which data is yours (Art. 11 GDPR).

You may also complain to a data protection authority, such as the one responsible for us: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

Otherwise

You do not have to provide any data to use the app, and no decision about you is made automatically. Links to museums and other sites lead to their own privacy policies. This page changes when the app does; the date at the top says when it last did.

See also the legal notice.