Privacy Policy – Artfluvia

Effective: November 2026

Controller: Florian Mahrl, Traklgasse 9/1, 1190 Vienna, Austria · florian.mahrl@gmail.com

Artfluvia does not collect or store any personal data, and we receive no data from you.

• No data collection: no usage data, no analytics or tracking, no identifiers, no ads, no account.
• No servers for everyday use: all content (map, works, texts) ships inside the app; only artwork images are loaded on demand from Wikimedia Commons or from the open access collections of a few museums (see “Artwork images”), in music mode audio previews are streamed from Apple's servers (see “Audio previews”), and in literature mode LibriVox readings are streamed from archive.org (see “Readings”). Only when you order a printed poster does the app send order data to our order server (see “Ordering a poster”).
• Favorites: works you mark are stored on your device and, if iCloud is on, synced between your devices through Apple's iCloud key-value store. Apple runs that sync under its privacy policy; we have no access to it.
• Exports: images and PDFs are created on your device and go only where you send them via the share sheet.

Network

The app communicates with Apple services – the App Store for prices and purchase status, if iCloud is on, the iCloud key-value store for favorites, and, if you are signed in to Game Center, Game Center for the quiz leaderboards (your score and your Game Center name, under Apple's privacy policy) – and, for artwork images, with the image servers of the Wikimedia Foundation and of the museums listed below, for audio previews in music mode, with Apple's media servers (see “Audio previews”), and, for readings in literature mode, with the Internet Archive's servers (see “Readings”). There is no connection to servers of ours.

On iPhone, iPad and Mac the app also asks weekendpilot.at (hosted on Google Firebase and Cloud Run) once at launch whether poster ordering is currently available. For technical reasons this involves your IP address and the time; the app sends no other data with it. The legal basis is our legitimate interest in offering ordering only when it is possible (Art. 6(1)(f) GDPR).

Up to version 1.8.7 the screensaver can play music if you choose. If you switch this on and allow access, you listen through Apple Music, and Apple's privacy policy applies.

Artwork images from Wikimedia Commons and museums

For many works, the work's card (on Apple TV, the screensaver) shows a freely licensed image from Wikimedia Commons with its credit. Small thumbnails ship inside the app, the larger images do not: only when a work is shown does the app load its image directly from the Wikimedia Foundation's servers (upload.wikimedia.org or thumb.wikimedia.org). For technical reasons the Wikimedia Foundation receives your IP address, the image address, the time, and the app's name and version (user agent). The app sends no identifiers and sets no cookies; we do not receive this data.

The Wikimedia Foundation, Inc. (San Francisco, USA) processes this data under its privacy policy; data may be transferred to the USA. The legal basis is our legitimate interest in presenting the works vividly (Art. 6(1)(f) GDPR). Loaded images stay only in your device's cache. Without an internet connection, works appear without images; everything else keeps working.

For works without an image on Commons, the app shows a public domain image (CC0) from a museum's open access collection; the credit then names the museum instead of Wikimedia Commons. These images, too, are loaded only when shown, directly from the respective museum's image server, which receives the same technical data (IP address, image address, time, user agent; no identifiers, no cookies):

• The Metropolitan Museum of Art, New York, USA – images.metmuseum.org
• Art Institute of Chicago, USA – www.artic.edu
• Cleveland Museum of Art, USA – openaccess-cdn.clevelandart.org
• Smithsonian Institution, Washington, USA – ids.si.edu

The museums process this data under their own privacy policies; for the museums in the USA, data may be transferred to the USA. The legal basis is again our legitimate interest in presenting the works vividly (Art. 6(1)(f) GDPR). On iPhone, iPad and Mac, the museum's name in the credit links to the museum's object page; it opens in your browser only when you tap it.

Audio previews in music mode (from version 1.5)

In music mode, a work's card can play a preview of about 30 seconds for many works and composers. The previews are not part of the app: only when you tap “Play” does the app stream the preview directly from Apple's media servers (iTunes/Apple Music, e.g. audio-ssl.itunes.apple.com or mzstatic.com). For technical reasons Apple receives your IP address, the preview's address, the time, and the app's name and version (user agent). The app sends no identifiers and sets no cookies; we do not receive this data. Which preview belongs to which work is stored inside the app and is not looked up online.

Apple processes this data under its privacy policy; data may be transferred to the USA. The legal basis is our legitimate interest in making the music audible (Art. 6(1)(f) GDPR). Nothing is stored on your device. The link “Open in Apple Music” opens the Apple Music app or your browser; from then on Apple's privacy policy applies. Without an internet connection there are no previews; everything else keeps working. Kids mode uses the same previews for its listening game, without links.

Readings in literature mode (from version 1.5)

In literature mode, a work's card can play the beginning of a LibriVox reading for public domain works (volunteer readers, recordings in the public domain). The readings are not part of the app: only when you tap “Play” does the app stream the recording directly from the servers of the Internet Archive (archive.org), where LibriVox stores its files. For technical reasons Internet Archive, Inc. (San Francisco, USA) receives your IP address, the recording's address, the time, and the app's name and version (user agent); its privacy policy applies, and data may be transferred to the USA. The app sends no identifiers and sets no cookies; we do not receive this data. The legal basis is our legitimate interest in making the works audible (Art. 6(1)(f) GDPR). Nothing is stored on your device. Kids mode uses the same readings for its story game.

“Read” links to public domain texts

On iPhone, iPad and Mac, a work's card can show a “Read” button for public domain works that opens the text at Project Gutenberg, Standard Ebooks or Wikisource in your browser. The app itself loads nothing and sends no data; once opened, that site's privacy policy applies. Kids mode contains no external links.

Feedback by email

When you write to us via “Send feedback” or “Report a mistake”, the app opens your email app with a prepared message; only what you send yourself is transmitted (for “Report a mistake” also the entry ID, art form, year, stream, app language and app version). We use such messages only to handle them.

Links to Wikipedia

On iPhone, iPad and Mac, a work's card can show a link to the matching Wikipedia article. Tapping it opens the article in your browser; from then on the Wikimedia Foundation's privacy policy applies. The app itself sends no data. Kids mode contains no external links.

In-app purchases

The one-time purchases are processed entirely by Apple through the App Store. Payment and account data are handled by Apple under Apple's privacy policy; we never see your payment details. To check whether you own a purchase, the app asks Apple's App Store service on your device.

Ordering a poster (from version 1.4)

On iPhone, iPad and Mac you can order your current view as a printed poster. Only then do we process personal data, and only what the order requires:

• Print file and order: the app renders the print file on your device and uploads it with the order data (size, orientation, edition, period, streams, language, order number) to our order server. It runs on Google Cloud Run in Belgium (Google Cloud EMEA Ltd., Dublin); the print file and the order record are kept in private storage in the EU and deleted 90 days after shipping.
• Payment: payment by Apple Pay or card is handled by Stripe (Stripe Payments Europe Ltd., Dublin). Stripe receives payment data, amount, shipping address and email address under its privacy policy; we never see card or Apple Pay details. For card payments the app opens a Stripe payment page. Stripe emails you the receipt.
• Shipping address: we store the name, address and email from the Apple Pay sheet or the Stripe payment page with the order record and pass them, together with the print file, to our print and fulfilment partner Prodigi (Prodigi Group Ltd., United Kingdom; print partners in the delivery area) – the EU has an adequacy decision for the United Kingdom. Prodigi processes the data under its privacy policy.
• Order status: the app keeps your order numbers on your device and asks the order server for the status (paid, in production, shipped, tracking).

The legal basis is performance of the contract (Art. 6(1)(b) GDPR); we keep invoice data for the statutory retention period (seven years). There is no customer account and no advertising.

Children

Kids mode collects no data, shows no ads and contains no external links. Purchases are protected by a parental gate.

Email support

If you contact us by email, we process your sender address and the content of your message solely to handle the request (Art. 6(1)(b) and (f) GDPR) and delete the correspondence once it is resolved. Email delivery runs via Google (Gmail); data may be transferred to the USA (safeguarded by the EU-US Data Privacy Framework and standard contractual clauses).

Website hosting

This website is served via Firebase Hosting (Google Ireland Ltd.). When you visit, the host processes technically necessary server logs (including IP address, timestamp, requested page) to provide and secure the service (Art. 6(1)(f) GDPR). We use no cookies and no analytics tools.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR). Under Art. 77 GDPR you also have the right to lodge a complaint with the supervisory authority:

Österreichische Datenschutzbehörde (Austrian Data Protection Authority)
Barichgasse 40–42, 1030 Vienna, Austria
dsb@dsb.gv.at · dsb.gv.at

Contact: florian.mahrl@gmail.com · Legal notice (Impressum) · Support