Privacy Policy

A reading convenience for diffing in GitHub, not the document itself. -->

Last updated: 23 August 2026

Cloud and Culture Ltd · Company number 15128080 · 7 Bell Yard, London, WC2A 2JR, United Kingdom

1. About this policy

This policy explains what we do with your personal information when you use Pocket Museum, wherever you use it: the app from the App Store and Google Play, the web app at pocket.museum, and our company site at cloudandculture.co. It replaces our previous Website Privacy Policy of 6 December 2025, which described the company website rather than the product.

Wherever you meet it, the Service is the same product run by the same company, and this one policy covers all of it. Some of our published documents (this policy, the Terms and Conditions, and the Cookie Policy) are hosted on cloudandculture.co and linked from the app, so a link may take you to that domain.

Cloud and Culture Ltd is the data controller. We are registered in England and Wales, company number 15128080, at 7 Bell Yard, London, WC2A 2JR. We are not required to appoint a Data Protection Officer and have not appointed one.

Contact us about anything in this policy at [email protected], or by post at the address above. You can also complain to the Information Commissioner's Office at ico.org.uk, though we would rather you came to us first so we can put it right.

2. What we collect

If you browse without an account

You can read published museums without signing in, and we do not ask who you are. We do still record how the museum was used:

Visit data. When you open a museum we create a visit session recording a visitor identifier, when you arrived and left, and which museum, exhibition, story and exhibit you viewed. The identifier is generated on your device and stays the same across visits, so we can tell a returning visitor from a new one. We treat it as personal information even though it is not tied to your name.

Device and technical data. IP address, browser type and version, operating system, device type, language and time zone.

Cookies and similar storage. See section 10.

If you create an account

Account data. Your name, email address, and a one-way hash of your password. We never store the password itself. From August 2026 we also ask for your date of birth and keep only the age band it puts you in, not the date.

Content you post. Comments and replies you write, and the museums, exhibitions and stories you save or like. Your display name appears next to anything you post publicly.

Moderation and safety data. If you report a comment or a person, or block someone, we record it. We also keep the outcome of moderation on your own posts: whether a comment was approved or rejected, the reason, and the score our automated tools gave it.

Support and feedback data. Messages you send us, feedback you submit in the app, and your email preferences.

If you pay us

The Service is free today. When we introduce paid plans: purchases made in the iOS and Android apps are handled by Apple and Google, who take the payment and share only confirmation and a transaction record with us. We never see your card. Purchases made on the website will be handled by Stripe, who will hold your card details; we will keep the name on the card, the billing country and a record of the transaction.

What we never collect

We do not collect special category data: race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, health, genetic or biometric data. Nor do we collect information about criminal convictions and offences. We do not collect your gender, your bank account or sort code, or your postal address, and we do not hold card numbers.

3. Why we use it, and our legal basis

To give you the Service: showing you museums, keeping you signed in, saving what you save, publishing your comments. Legal basis: performance of a contract with you, or steps taken at your request before entering into one.

To keep the Service safe: moderating comments, acting on reports, blocking abusive users, preventing fraud and misuse. Legal basis: legitimate interests in protecting our users and our platform, and legal obligation where online safety law requires it.

To understand how the Service is used: which museums are visited, how long people spend with a story, which exhibits hold attention. We use this to improve the product and to work out what our Contributors are owed. Legal basis: legitimate interests. You can object; see section 11.

To run and secure our business: hosting, backups, troubleshooting, security monitoring, and keeping accurate records. Legal basis: legitimate interests, and legal obligation for records we must keep.

To contact you: service messages such as email verification and password resets (contract), and marketing about new museums and features only if you have opted in (consent, withdrawable at any time).

To take payment, once paid plans exist. Legal basis: contract, and legal obligation for invoicing and tax records.

4. Children

You must be at least 13 to create an account.

Anyone can browse published museums without an account, so children may use the Service that way. We design for that: we do not profile children for advertising, we do not show advertising at all, and we do not use nudge techniques to encourage anyone to weaken their privacy settings. If you believe a child's information has reached us in a way it should not have, tell us and we will remove it.

5. AI, and what of yours reaches it

Your comments are read by an AI model. Every comment posted to the Service is sent to Anthropic (the Claude API) to be scored for illegal, abusive or otherwise objectionable content, before a member of our staff makes the actual decision. What is sent is the text of the comment. Your name, email address, account identifier and browsing history are not sent with it.

We do this to keep the Service safe for a general, all-ages audience. Legal basis: legitimate interests, and legal obligation where online safety law requires us to act. Section 6 explains what happens to the score, and how to challenge a decision.

Anthropic processes comment text on our behalf as a service provider, under their commercial terms and data processing agreement. Processing takes place outside the UK; see section 8.

Spoken-word narration you hear in a museum is often synthesised rather than recorded, using a text-to-speech model. Only the museum’s own written text is sent for that, never anything of yours, and the audio is generated once by the Contributor and stored with the museum. It is a disclosure about the content rather than about your data, so our Terms and Conditions cover it rather than this policy.

6. Moderation, and how it uses your information

Everything published on the Service is reviewed by us. Museums are checked before they go live, and comments are moderated by us, not by the Contributor whose museum they sit on.

Moderation uses both automated tools and people. The automated step is the AI scoring described in section 5. Where that tool judges a comment to break our rules, for example because it is abusive or gratuitously profane, the comment stops being shown to other readers straight away, before a person has looked at it. Where the tool is unsure, the comment is held for a person to decide instead.

Two limits on that apply in every case. We never restrict or suspend an account by automated means; only a person does that. And you can always see your own comment, whatever we have decided about it, marked with the decision we reached.

A member of our staff also reviews what the automated tools have decided at least once a month, and we correct anything we find to be wrong.

If we restrict something you posted we will tell you why, including whether automated tools were involved, and how to challenge it. You can challenge any such decision free of charge for six months, and a person, never a tool, decides the challenge. Our Terms and Conditions set out that process in full.

We keep moderation and safety records (reports, blocks, outcomes and scores) because we need them to run the appeal process, to recognise repeat behaviour, and to answer regulators. They survive deletion of your account; see section 9.

7. Who we share it with

We do not sell your personal information, and we do not share it for anyone else's marketing.

We use these processors, each under a contract that restricts them to our instructions:

Google Cloud: hosting, databases, file storage and backups, in Google's United Kingdom region.

Anthropic: AI scoring of comments for moderation, as described in section 5.

Cloudflare: content delivery, bot protection, DNS and security for pocket.museum and cloudandculture.co. Every request to those sites passes through Cloudflare, so it handles your IP address and request details, and caches copies of pages, images and audio. It operates a global network and will usually serve you from the location nearest to you.

Amazon Web Services (Amazon Simple Email Service): sending verification, password reset and other service email. Your email address and the content of that mail pass through it. SES runs in the United Kingdom, so this mail does not leave the UK.

Apple and Google: payment processing for in-app purchases, when paid plans launch. They are independent controllers for the payment itself.

Stripe: card payments made on the website, when paid plans launch. Stripe holds the card details; we keep the name on the card, the billing country and the transaction record.

We also share information where the law requires it, to establish or defend legal claims, or to protect someone's safety. If our business or part of it is sold or transferred, information may transfer with it; we will tell you if that happens and the buyer will be bound by this policy until they publish their own.

8. Where your information is held

Your information is stored in the United Kingdom. Our servers, databases, file storage and backups run in Google Cloud's United Kingdom region, and the service that sends our email runs in Amazon's United Kingdom region.

Two of our processors operate outside the UK, so some information does leave it:

Cloudflare, which sits in front of both sites and serves you from the point on its global network nearest to you. Your IP address and request details, and cached copies of pages and media, are handled wherever that point is.

Anthropic, which scores comments for moderation as described in section 5. Their data processing addendum includes the UK Addendum, which covers processing subject to the UK GDPR.

Where information leaves the UK we rely either on UK adequacy regulations for the destination, or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment. We do not rely on your consent for these transfers, and you do not have to agree to them to use the Service.

9. How long we keep it, and what happens when you delete your account

Retention

Account data: for as long as your account is open, then removed on deletion.

Comments and replies: for as long as the museum is published, unless removed sooner.

Visit data: 25 months, after which it is deleted.

Moderation and safety records: 3 years from the decision, so we can handle appeals, recognise repeat behaviour and answer regulators.

Support messages: 2 years from the last contact.

Transaction records: 7 years, as tax law requires.

Backups: up to 30 days, after which a periodic sweep removes them permanently.

Deleting your account

You can delete your account at any time from Account → Data & Privacy → Delete account, or by emailing us. Deletion is permanent.

We remove your profile, your login details and the content you created, and we disconnect your name from anything that remains. Some information survives, and only for these reasons:

(a) comments you left on other people's content may stay in place with your name removed, so the surrounding conversation is not destroyed;

(b) moderation and safety records are kept for the period in the table above, because an appeal or a repeat-behaviour check is worthless if the record disappears on request;

(c) records we must keep by law, or to establish or defend a legal claim, are kept for as long as that purpose lasts;

(d) backups are overwritten on our normal cycle, so content may remain in backups for up to 30 days.

Visit sessions linked to your account are de-identified rather than deleted: we sever the link to you and keep the anonymous usage record. The replacement label is a random value that is stored nowhere, so the record cannot be traced back to you.

Deleting the app from your device does not delete your account.

10. Cookies and similar technologies

We use a small number of cookies and similar storage: strictly necessary ones that keep you signed in and remember your cookie choices, and analytics storage that holds the visitor identifier described in section 2. Non-essential storage is set only with your consent, which you give or refuse through the banner and can change at any time.

This storage is set on the site you are using, either pocket.museum for the web app or cloudandculture.co, and each site asks separately, so a choice you make on one does not carry to the other. The mobile apps use the equivalent on-device storage rather than browser cookies.

Our Cookie Policy at cloudandculture.co/cookie-policy lists each one, what it does and how long it lasts.

11. Your rights

You can ask us to: give you a copy of your information; correct it; delete it; restrict how we use it; object to our use of it where we rely on legitimate interests, including analytics; and transfer it to you or someone else. Where we rely on your consent you can withdraw it at any time, without affecting what we did before.

Email [email protected] to exercise any of these. There is no charge. We will respond within one month, and will tell you if we need longer because the request is complex. We may ask you to confirm your identity first. Copies are provided by email in a commonly used format; there is no self-service download today.

Some rights are not absolute. We will always explain if we cannot do what you have asked, and why.

12. Keeping your information secure

We encrypt information in transit and at rest, restrict access to the staff who need it, log that access, and follow standard practice for the cloud services, databases and software we use. We also commission third-party audits of the application and its infrastructure.

No transmission over the internet is completely secure, and we cannot guarantee the security of information you send us. If you think your account has been compromised, tell us immediately.

13. Changes to this policy

We keep this policy under review. If we make a material change we will give you at least 30 days' notice before it takes effect, by email or in the app. That is the same notice period our Terms and Conditions use. Minor changes take effect when published here. Continued use of the Service is not treated as your agreement to a material change.

This version is dated 23 August 2026.

14. California residents

Under California Civil Code sections 1798.83 to 1798.84, California residents may ask us for a notice identifying the categories of personal information we share with affiliates or third parties for their direct marketing purposes, and the contact details of those parties. We do not currently share personal information for anyone else's marketing, but you may request that notice in writing at [email protected].

15. Contact

[email protected], or Cloud and Culture Ltd, 7 Bell Yard, London, WC2A 2JR.

You have the right to complain to the Information Commissioner's Office (ico.org.uk) at any time.