Privacy policy

If you're visiting a museum

You don't need an account to use a museum's guide. We don't use advertising or tracking cookies, and we don't build profiles of visitors. Vercel Analytics gives us aggregate counts of page views and referrers; it doesn't use cookies, doesn't track you across other sites, and doesn't identify you personally.

Like any website, our hosting provider automatically records basic technical information when your phone loads a page, such as your IP address, browser type and the page requested. These logs are used to keep the service running and secure, and are kept only for a limited time.

A guide can save itself on your phone — its pages, photos and recordings — so it keeps working in rooms with no signal, it keeps a list of the exhibits you opened, under “Your visit”, and it remembers the language you chose. All of this stays on your phone: nothing about which objects you looked at is sent to us or to the museum. Clear your browser's data for the site, or tap “Forget this visit”, and it is gone.

If you use “Scan the next label”, your phone asks for permission to use its camera. The picture is read on the phone to find the QR code and is never sent anywhere or stored.

If you work at a museum that uses Titulus

When you create a staff account we store:

• your name and email address;
• your password, stored only in a scrambled (hashed) form that we can't read, or, if you use “Continue with Google”, the name, email address and profile picture Google shares with us;
• if you turn on two-step sign-in, the secret your authenticator app uses and a set of one-time backup codes, both stored encrypted;
• sign-in sessions, including the IP address and browser they came from, so you stay signed in and we can spot misuse;
• which museums you belong to and your role there.

We also store what your museum adds: exhibit details, notes, photos, text and audio. Anything you publish is public, because visitors need to see it. Drafts and notes are visible only to your museum's staff.

The audit log

So that a museum can see what happened on its account, and so we can investigate misuse, Titulus records staff and billing actions in an audit log: signing in and failed sign-in attempts, password and two-step changes, inviting, removing and changing the role of staff, publishing and deleting exhibits, importing and exporting data, changes to settings, languages, web addresses and plan, and subscription changes reported by our payment provider. Each entry holds who did it (an internal account number, not a name or email address), what they did, when, which museum it concerned, a few plain facts such as a role or a plan name, and a one-way hash of the network address it came from. The hash cannot be turned back into the address; the address itself is not stored in the log. Failed sign-ins and invitations are recorded against a one-way hash of the email address, not the address. Passwords, codes and free text are never recorded. A museum's owners can see the latest entries for their own museum; they are not shown to visitors.

Entries can't be edited or removed, and there is no time limit on them: they are kept for as long as the service runs, including after an account or museum is deleted, because a record that disappears with the thing it is about is no use. What remains after a deletion is the internal account number and the facts above, not the deleted content.

Services that process data for us

• Vercel hosts the website.
• Neon hosts our database (accounts and museum content).
• Cloudflare runs our domain's DNS, stores photos and audio, and forwards email sent to hello@titulusguide.com.
• Anthropic writes AI drafts. When staff click “Draft with AI”, that exhibit's catalogue details and notes are sent to Anthropic's Claude API to produce a draft.
• Google provides “Continue with Google” sign-in and, when enabled, turns exhibit text into spoken audio.

These providers may process data in the United States and other countries. We share data with them only to run Titulus. We don't sell personal information or use it for advertising.

How long we keep it

Staff accounts and museum content are kept while the museum uses Titulus. Sign-in sessions expire on their own. You can delete a museum or your own account from Settings at any time.

Your choices

You can ask us for a copy of the personal information we hold about you, or ask us to correct or delete it, by emailing hello@titulusguide.com.

Children

Museum guides can be used by visitors of any age without an account. Staff accounts are for adults working with a museum, and we don't knowingly collect personal information from children.

Deleting your data

You can delete an exhibit, your museum or your account yourself, in Settings — you don't need to ask us. Deleting a museum removes its exhibits, translations, photographs and recordings, and its guide stops answering. The audit log entries described above stay.

We keep encrypted nightly backups for thirty days, so for up to a month after a deletion your data still exists in a backup. Email us if you need it destroyed sooner than that.

Changes and contact

If we change how we handle information, we'll update this page and the date at the top. Questions: hello@titulusguide.com.