Privacy policy for Art Says Hi

Images and visual readings

When you choose an image and tap Analyze in the app, the app prepares a bounded working copy and sends the selected photo view, scan target, scan goal, and technical request metadata to the Qomza gateway so it can return a visual reading. Photos are not sent to analytics or advertising services.

The app keeps captured image copies in its private Documents area so saved discoveries can be reopened. Reading text, notes, collections, settings, request identifiers, and related archive data are kept locally. Images are not stored as base64 in the local database.

The browser scanner prepares a working copy in your browser and sends it to the gateway only when you start a reading. That request carries the prepared image media, your chosen scan target and goal, the image count, request identifiers, app, release, and build identifiers (the site's source revision and build time, its Cloudflare build and Worker version, and the open page's own release label), contract and metadata versions, platform, a fixed English language tag, and fixed labels identifying the operation, request source, feature area, deployment environment, and where the request ran and how the site was delivered. Some identifiers are repeated in request headers. Browser history keeps written result fields locally. Raw images and base64 data are not stored in that history. Optional browser feedback drafts and pending revisions are stored in this browser until sent or discarded. The browser also keeps an accepted-feedback receipt locally so you can edit accepted feedback. It retains the submitted message, category or rating, reason, optional reply email and contact permission, product context, result version, screen, revision, Gateway references, and acceptance time until you discard it or clear this browser's site data. Sending feedback transmits the submitted fields to the Qomza gateway; removing a local draft or receipt does not retract a revision already sent.

Qomza's gateway keeps reading submissions, including submitted image media, request details, and returned readings, and related service information. It also keeps feedback submissions, including messages, reasons, contact details you chose to provide, request metadata, and related service information. These records are not deleted automatically; they stay there until the gateway operator removes them. Local erase in the app or browser cannot recall a request already sent to the gateway. Do not submit secrets or confidential material.

For web requests sent through our Cloudflare service connection, Cloudflare provides your connection IP to our Worker. In production, the Worker forwards that platform-provided address to Qomza's gateway as X-Forwarded-For. Locally trusted runs and requests using the public gateway URL do not forward visitor IP headers. Qomza's archive may include the connection IP, but a separate searchable IP field may not be present.

Permissions and sharing

The app requests camera or photo library access only after you choose an action that needs it. Notification access is optional and is used for Daily Spark reminders when you enable them. The app opens the native share sheet only after you choose to share a result or share card.

The website stores your analytics choice and local reading history in this browser. PostHog analytics and session replay run by default on eligible production visits until you save a rejection or a privacy signal turns them off. Browser Sentry does not run until you explicitly accept analytics. Global Privacy Control and Do Not Track are treated as a rejection and are never saved as a choice.

• Camera and photo access lets you select or capture an image for a reading.
• Notification access lets the app schedule optional Daily Spark reminders.
• You can change permission choices in your device settings.

Browser analytics and session replay

PostHog, in the EU region, measures page views, page-leave, Web Vitals, clicks, changes and submissions on page controls, heatmap interactions, dead/rage-click measurements, and a small set of fixed usage events on eligible production visits, and it records session replays. This measurement runs by default until you save a rejection or a privacy signal (Global Privacy Control or Do Not Track) turns it off; a privacy signal is never saved as a choice. The footer reopens the choices, which control Analytics and Session replay independently, and turning Analytics off also turns Session replay off. Events carry fixed names such as analysis started, analysis completed, analysis failed, analysis cancelled, feedback submitted, and call-to-action clicks, with low-cardinality scalar values about scanner activity such as image dimensions, chosen target and goal, and recovery status.

Session replay records broad visible page content and public imagery, but it excludes passwords, authentication and payment fields, tokens, credential-bearing URLs, console output, and request or response headers and bodies. The selected scanner image is excluded from replay and never becomes an analytics event; it is sent to the Qomza gateway only when you start a reading. PostHog's current free plan keeps replays available for 30 days.

Cloudflare Web Analytics is a separate hosting-level measurement and is not controlled by this PostHog choice; whether an edge beacon is injected for a given visit is not asserted here. Browser Sentry is a separate explicit opt-in diagnostic tool that loads only after you accept analytics. Consent-gated Sentry sends errors and samples 5% of browser traces, with its replay feature disabled pending captured-envelope privacy verification. Error events omit request details and raw exception messages; traces may include page path and browser/device context.

Worker operational diagnostics run independently of browser consent to support the service: Sentry receives Worker errors, 5% of Worker traces, and terminal scan/feedback logs with outcomes, duration, bounded request and Gateway references, and token counts only when the Gateway supplies them. Worker telemetry excludes request bodies, submitted image media, query strings, headers, and raw exception messages.

If you reject analytics, this site clears the optional PostHog identifiers it set and stops further optional capture. Rejection does not delete hosting logs, the gateway archive, or records already held by a provider; those follow their own retention. Saved choices have no application-set expiry, and clearing this browser's site data may remove them.

• PostHog Privacy Policy (opens in a new tab)
• Cloudflare Web Analytics (opens in a new tab)

Planned mobile advertising with Google AdMob

In a production app build that enables mobile advertising, Google Mobile Ads or AdMob may process app and device information, IP address, advertising or app identifiers, ad delivery and interaction information, and coarse location or similar signals where permitted by device settings and Google configuration. Google may use this information for ad delivery, measurement, fraud prevention, and personalization where allowed.

Ad placements are not used during onboarding, image capture, or the first completed result. Planned in app consent choices, device controls, and applicable regional requirements will govern whether personalized or non personalized ads can be shown. Google may present its own consent choices where required.

• How Google uses data when you use our partners' sites or apps (opens in a new tab)
• Google Privacy Policy (opens in a new tab)

Planned Firebase Analytics and Google Analytics 4

In a production app build that enables the planned analytics integration and its required permissions, Firebase Analytics and Google Analytics 4 may receive fixed event names about app use, such as onboarding, scan lifecycle, saves, shares, Daily Spark, and review prompts. They may also receive app instance, device, operating system, app version, runtime, language, and similar technical metadata.

Analytics is designed not to receive selected photos, image bytes or base64, full readings, free form notes, credentials, payment information, or authentication headers. Google controls its own processing and retention under its published terms and privacy documentation.

• Firebase Privacy and Security (opens in a new tab)

Sentry diagnostics for app and website

When the planned mobile integration is enabled, Sentry may receive crash and error diagnostics, app version and build, platform and operating system, device or runtime details, bounded operation stage and status, and request identifiers needed to investigate reliability. The browser site can also send optional error diagnostics when browser consent is accepted and a public Sentry configuration is present.

The app diagnostics contract excludes authentication headers, credentials, API keys, session cookies, payment data, raw image bytes or base64, and full image content. Sentry processing is governed by Sentry's own privacy documentation and our configuration of its data scrubbing controls.

• Sentry Privacy Policy (opens in a new tab)

Storage, deletion, and retention

Erase all data in the app's Settings removes local discoveries, collections, notes, captured image copies, settings, scheduled Daily Spark reminders, local diagnostics, and local review state from that device. It does not delete information already held by the gateway, Google, Sentry, an app store, or another provider. Contact us if you need a provider deletion request routed to the appropriate service.

On the website, you can decline optional analytics, clear browser storage, and delete locally stored reading history through your browser. Essential operation and the consent choice may still require local storage.

• Local app archive: private device storage, with no cloud archive in the current development build.
• Gateway processing: scans are sent only when you start a reading. See Images and visual readings for details about gateway records and retention. Do not submit secrets or confidential material.
• Other provider data: retention and deletion are subject to the relevant provider's terms, configuration, and legal obligations.

Children and privacy requests

Art Says Hi is not directed to children under 13, or the higher minimum age required in a user's location. We do not knowingly ask children to create an account or submit personal information. If you believe a child has provided personal information, contact us so we can review it.

You may contact hello@artsayshi.app to ask about access, correction, deletion, or other privacy rights. We may need enough information to verify and safely handle a request. We respond subject to applicable law and reasonable legal or security exceptions.

• Contact Art Says Hi

Changes to this policy

We may update this policy when the app, website, providers, or legal requirements change. The date below identifies the latest version published on this page.