ArtEcho — Privacy Policy

Last updated: April 24, 2026

1. Who we are

ArtEcho is a mobile app (the “App”) that recognizes artworks and helps you keep and share notes about what you see. “We”, “us”, and the “Operator” refer to the legal entity publishing ArtEcho on the Apple App Store.

2. What data we collect

Account data: email address, display name, avatar image, and account identifiers used by Firebase Authentication (Email/Password, Sign in with Apple, Google Sign-In). Guest mode is local-only and can be reset when the app is removed.
Artwork content you upload: photos you scan or select from your library, and the AI-generated interpretation we return for that photo.
Social content: posts, comments, likes, follows, and reports you submit to the in-app Art Square. When cloud sync is enabled, these are stored in Firebase Cloud Firestore.
Device & diagnostics: crash logs, device model and iOS version, non-advertising app identifiers, and the UI language you chose. Crash logs are collected by Google Firebase Crashlytics on Release builds only.
Optional data: approximate location (only if you grant Location permission and attach it to a post), microphone access (for voice-guide features), and photo library access (only when you pick/save images).

We do not collect contacts, health data, financial data, advertising identifiers, or precise background location.

3. How we use it

To recognize the artwork in the photo you submit and return an interpretation (via Google Firebase Vertex AI / Gemini).
To authenticate you (via Google Firebase Auth, Sign in with Apple, or Google Sign-In) and sync your account across devices.
To run social features you opt into (posting, following, commenting).
To moderate user-generated content and enforce our Community Guidelines. Reported posts are automatically downgraded to publisher-only visibility and a content snapshot is retained for up to 30 days for investigation.
To stabilize the App using crash diagnostics.

We do not use your data for advertising, we do not sell your data, and we do not train third-party AI models on it outside of the individual inference requests described above.

4. Third-party processors

Google LLC — Firebase Auth, Firebase App Check, Firebase Crashlytics, Firebase Vertex AI (Gemini).
Google Sign-In (if you use Google sign-in).
Apple Inc. — Sign in with Apple (if you use it).
Wikimedia Foundation — read-only Wikipedia API for enrichment.

These processors receive only the minimum data they need to perform the requested operation. They do not receive your ArtEcho email unless you explicitly authenticate through them.

5. Data retention

Your account and content are kept until you delete the account from Settings → Delete Account. Deletion removes account-linked scanned/favorited artworks, posts, comments, likes, and cached AI summaries within 30 days.
Reported-post snapshots are kept for up to 30 days to support moderation and comply with applicable UGC recordkeeping duties (e.g. Singapore IMDA COP-OSS).
Crash diagnostic records are kept by Firebase Crashlytics for up to 90 days.

6. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete the personal data we hold about you, and to withdraw consent for optional processing. Residents of Singapore may exercise rights under the Personal Data Protection Act 2012 (PDPA). Residents of the EEA/UK may exercise rights under the GDPR/UK GDPR. Residents of mainland China may exercise rights under the Personal Information Protection Law (PIPL). To exercise these rights, contact the Data Protection Officer (DPO) at fujia623@gmail.com.

7. Children

ArtEcho is not directed at children under 13. Users under 18 must use the in-app “Minors Mode” which disables posting, commenting, direct messages, and location sharing. We do not knowingly collect personal data from children without verifiable parental consent.

8. International transfers

Firebase services are operated in regions selected by Google; your data may therefore be processed in the United States and other jurisdictions. Where required, we rely on Standard Contractual Clauses approved by the European Commission.

9. Changes

If we change this policy materially we will update the “Last updated” date above and, where required, surface a notice in-app on next launch.

10. Contact

Data Protection Officer: fujia623@gmail.com.

1. 我们是谁

ArtEcho 是一款识别艺术品并帮助你记录、分享观展笔记的移动 App（下称“本应用”）。本政策中的“我们”与“运营方”指在 Apple App Store 发布 ArtEcho 的法人实体。

2. 我们收集哪些数据

账户数据：邮箱地址、昵称、头像，以及 Firebase Authentication 使用的账户标识（邮箱密码、Apple 登录、Google 登录）。访客模式为本地模式，卸载应用后可能重置。
你上传的作品内容：你扫描或从相册选取的照片，以及我们为该照片生成的 AI 解读。
社区内容：你在“艺术广场”发布的帖子、评论、点赞、关注和举报。启用云端同步时，上述数据会存储在 Firebase Cloud Firestore。
设备与诊断数据：崩溃日志、设备型号与 iOS 版本、非广告类 App 标识符、当前 UI 语言。崩溃日志仅在 Release 构建中通过 Google Firebase Crashlytics 收集。
可选数据：大致位置（仅在你授予定位权限并主动附加到帖子时）、麦克风权限（用于语音导览功能）、相册访问（仅在你选取/保存图片时）。

我们不会收集你的通讯录、健康数据、金融数据、广告标识符或后台精确位置。

3. 我们如何使用这些数据

识别你上传的艺术品并返回解读结果（通过 Google Firebase Vertex AI / Gemini）。
完成账户认证（Google Firebase Auth、使用 Apple 登录或 Google 登录）并跨设备同步。
运行你主动启用的社区功能（发帖、关注、评论）。
对用户生成内容进行审核并执行《社区规范》。被举报的帖子会自动下调为“仅发布者可见”，内容快照最多保留 30 天以配合调查。
通过崩溃诊断数据稳定 App。

我们不会将你的数据用于广告投放、不会出售你的数据，也不会在上述单次调用之外用你的数据训练第三方 AI 模型。

4. 第三方数据处理者

Google LLC —— Firebase Auth、Firebase App Check、Firebase Crashlytics、Firebase Vertex AI（Gemini）。
Google Sign-In（当你使用 Google 登录时）。
Apple Inc. —— 使用 Apple 登录（当你使用时）。
Wikimedia Foundation —— 只读的 Wikipedia API，用于补充百科信息。

以上处理者仅会获得完成对应任务所必需的最小数据。除非你主动通过其完成登录，否则他们不会收到你的 ArtEcho 邮箱。

5. 数据留存期限

账户与内容在你从《设置 → 注销账号》删除前持续留存。注销会在 30 天内清除与账号关联的扫描/收藏作品、广场帖子、评论、点赞以及 AI 结果缓存。
被举报帖子的快照最多保留 30 天，以配合内容审核及相关监管留痕要求（如新加坡 IMDA COP-OSS）。
崩溃诊断记录由 Firebase Crashlytics 留存最多 90 天。

6. 你的权利

根据你所在地区的法律，你可能有权访问、更正、导出或删除我们掌握的个人信息，以及撤回你对可选处理活动的同意。新加坡居民可依据《个人数据保护法》（PDPA）行使相关权利；欧盟/英国居民可依据 GDPR/UK GDPR；中国大陆居民可依据《个人信息保护法》（PIPL）。如需行使上述权利，请联系数据保护官（DPO）：fujia623@gmail.com。

7. 未成年人

本应用不面向 13 周岁以下儿童。18 岁以下用户必须使用 App 内置的“未成年人模式”，该模式会关闭发帖、评论、私信与位置分享。未经可核实的监护人同意，我们不会有意收集儿童的个人信息。

8. 跨境传输

Firebase 服务由 Google 在其选定的地区运行，你的数据可能因此在美国或其他司法辖区被处理。如适用，我们将依赖欧盟委员会批准的标准合同条款（SCCs）进行合规传输。

9. 政策变更

若本政策发生重大变化，我们会更新顶部的“Last updated”日期，并在必要时于 App 下次启动时弹出提示。

10. 联系方式

数据保护官（DPO）：fujia623@gmail.com。