Privacy Policy

01Who we are

Collections. (the “App”) and the website collectionsapp.co.nz (the “Site”) are developed and published by the team behind Collections. (“we”, “us”, “our”). We are subject to the New Zealand Privacy Act 2020 and its Information Privacy Principles.

You can contact us about anything in this policy at hello@collectionsapp.co.nz.

02The short version

• We do not collect, receive, store, or sell your catalogue data. It stays on your devices and in your personal iCloud account.
• The App requires no account, registration, or sign-in with us.
• We run no analytics or tracking in the App or on the Site. The one place the Site asks for personal information is the advertising application form, where payment is handled by Stripe.
• The optional Curator assistant sends data directly from your device to Anthropic using your own API key. We are never in that path.
• Because we hold no personal information about you, there is nothing for us to lose, leak, or sell.

03Information the App stores, and where

Your catalogue

Everything you enter into the App — artworks, artists, collections, valuations, acquisition details, provenance records, locations, loans, sales, notes, images, 3D captures, and attached documents — is stored locally on your device in the App's private container.

iCloud sync and sharing

If you enable sync, your catalogue is also stored in your private iCloud database using Apple's CloudKit service, so it is available across your Apple devices. That data sits in your iCloud account, under your Apple Account, governed by Apple's privacy policy and terms. It is encrypted in transit and at rest by Apple. We have no ability to access, read, or retrieve it.

If you share a collection with another person, Apple's iCloud sharing delivers it to the people you choose, with the read or contribute permission you set. Sharing is entirely under your control and can be revoked from the App.

Settings and security

Preferences, your optional PIN, and biometric-gate settings are stored locally on your device. Biometric authentication (Touch ID / Face ID) is performed by the operating system; the App never receives your biometric data.

04The Curator assistant

The Curator is an optional, off-by-default AI assistant. To use it you supply your own Anthropic API key, which is stored in the device Keychain — Apple's encrypted credential store — and never leaves your device except to authenticate requests to Anthropic.

When you ask the Curator a question, your query and the relevant parts of your catalogue are sent directly from your device to Anthropic's API over an encrypted connection. That processing is governed by Anthropic's privacy policy and usage policies under your own agreement with Anthropic. We do not proxy, receive, log, or retain any of it.

You can disable the Curator, or remove your API key, at any time in Settings ▸ Curator.

05Information we actually receive

Almost none. The only information we may receive is:

• App Store data. Apple provides us with aggregated, anonymised statistics (downloads, crash reports, device types) if you have opted in to sharing analytics with developers in your device settings. This never includes your catalogue or identity.
• Correspondence. If you email us, we receive your email address and whatever you choose to tell us. We use it only to respond, and we do not add you to any mailing list.

06Advertising applications and payments

If you apply for a Partnerships placement on the Site, we ask for the business name, a contact name, an email address, a website, an optional phone number, a short description of the business and the placement you want. Those details, and the payment of the application fee, are handled by Stripe, our payment processor, and stored in our Stripe account as a customer record and against the payment. We see them there and use them only to assess, run and bill your placement, and to write to you about it.

Card details are entered into a form served by Stripe and go directly to Stripe. They never reach our servers and we cannot see them. Stripe keeps a saved payment method against your customer record so that, if your placement is approved, the monthly fee can be charged without asking again.

On the application page Stripe may set cookies and read device signals to detect fraud. That processing is governed by Stripe's privacy policy at stripe.com/privacy. Stripe is certified to PCI DSS Level 1 and may transfer data outside New Zealand under its own safeguards.

We keep application and billing records while a placement is under review or live, and afterwards for as long as New Zealand tax law requires, which is generally seven years. Write to hello@collectionsapp.co.nz to ask for anything not needed for those records to be deleted.

07The Site

collectionsapp.co.nz is a static website. Apart from the advertising application page described below, it sets no cookies, runs no analytics, and embeds no third-party code. Our hosting provider may keep standard, short-lived server logs (IP address, user agent, pages requested) for security and operational purposes.

08Your rights

Under the Privacy Act 2020 you have the right to request access to, and correction of, personal information an agency holds about you. Because your catalogue is held by you — on your devices and in your iCloud account — access and correction are always directly in your hands within the App. For the little we may hold (such as email correspondence), contact us at hello@collectionsapp.co.nz and we will respond promptly.

To delete your data entirely: delete the App's data from within Settings ▸ Backups, remove the App, and delete its iCloud data from your device's iCloud storage management screen.

If you are not satisfied with our response to a privacy concern, you may complain to the Office of the Privacy Commissioner (New Zealand).

If you are located outside New Zealand, including in the United Kingdom or European Union, you may have additional rights under local law (such as the UK/EU GDPR). Given the App's architecture, we act as a processor of nothing — your data never reaches us — but you may contact us with any request and we will assist where we can.

09Children

The App is not directed at children under 13, and we do not knowingly collect personal information from anyone, children included.

10Backups and retention

We retain nothing, so we have no retention schedule to disclose. Your catalogue persists on your devices and in your iCloud account until you delete it. Backups you export from Settings ▸ Backups are files you own and store wherever you choose.

11Changes to this policy

If we change this policy, we will update it at collectionsapp.co.nz/privacy with a revised date. Material changes — for example, if a future feature ever involved us operating a service that receives data — will be flagged clearly in the App before you use that feature.

12Contact

Questions about this policy can be sent to hello@collectionsapp.co.nz.