English · 한국어 · 日本語 · 繁體中文

DocentLens Privacy Policy

Effective: 2026-07-31 · Last updated: 2026-09-24

DocentLens (formerly MuseLens, the "app") turns photos of museum labels and artworks into spoken docent commentary in the language you choose, and answers your follow-up questions. The app works without an account, shows no ads, and does not collect advertising identifiers. We never sell your information.

1. Who we are

The controller of your personal information is Sugaryple, a sole proprietorship registered in Japan (N&E BLD.6F, 1-12-4, Ginza, Chuo-ku, Tokyo 104-0061, Japan). Privacy contact (also acting as the person responsible for data protection): contact@sugaryple.com.

2. What we process, why, and on what legal basis

• Photos — photos you take or pick from your gallery are sent through our server to Google's Gemini API to generate the commentary. Before upload the app re-encodes the image and strips its metadata (location, capture time, device model). Our server does not store photos; it relays them and discards them when the request ends. For how long Google keeps them, see section 3. Basis: performing the service you request.
• Questions — the text of your question is sent the same way, together with the context needed to answer it: the label text and commentary of that exhibit, your earlier questions and answers about it, the museum name if known, and in some cases the exhibit photo again. Our server does not store any of it. Basis: performing the service.
• Voice — when you ask by voice, your speech is converted to text by your device's operating system speech recognition (Apple or Google). Depending on your device, language and settings, that recognition may take place on Apple's or Google's servers under their own privacy policies. Our server never receives your voice — only the resulting text.
• Commentary and answer text — sent to Google Cloud Text-to-Speech to produce the audio. Our server does not store it. Basis: performing the service.
• Network and security data — like any internet service, our infrastructure provider (Cloudflare) processes your IP address and basic request data (time, path, status) to deliver and protect the service. Our own request logs contain the path, time, a request sequence number, processing metrics (such as the AI model used and token counts) and error information — never photos, questions, commentary or audio. Rate limiting uses a short-lived hash of the app-attestation token. Basis: our legitimate interest in running a secure, abuse-resistant service.
• App integrity (Firebase App Check) — verifies that requests come from a genuine, unmodified copy of the app (Play Integrity on Android, App Attest on iOS). It handles device and app integrity signals only. Basis: legitimate interest (security, fraud prevention).
• Purchases — the 24-hour pass is sold and charged by Apple's App Store or Google Play. We never receive your payment details, name or email. To confirm that a purchase is genuine and to avoid granting it twice, the store's purchase receipt is verified by our purchase-management provider, RevenueCat, which receives the receipt and transaction identifiers, a random identifier created for this installation of the app, your IP address, country, and device, operating system and app version. No account is created and the identifier is not linked to your name or email. The app also keeps the identifiers of purchases it has already applied on your device. Basis: performing the contract.
• Usage statistics (Google Analytics for Firebase) — which screens and features are used (screen views; counts and outcomes of captures, questions, playback controls and purchases; settings such as language and commentary length), plus device model, OS version, app version and approximate region (country/city level, derived from your IP address, which is not stored), tied to a random per-installation identifier. It never includes your photos, questions, commentary, titles, museum names, or an advertising identifier. This data is pseudonymous: we cannot and do not try to link it to who you are. Basis: your consent in the EEA, the United Kingdom and Switzerland (off by default there — you can turn it on in Settings); elsewhere our legitimate interest in improving the app, with an off switch in Settings.
• Crash reports (Firebase Crashlytics) — when the app crashes or hits an error: the stack trace, device model, OS and app version, and a random per-installation identifier. Never photos, questions or commentary. Controlled by the same Settings switch and the same regional default as usage statistics.
• Diagnostic logs you choose to share — the app keeps a technical log on your device. It leaves the device only if you tap "Send log files" in the diagnostics screen and pick a recipient yourself. Those files contain commentary and answer sentences and exhibit titles (your own question text is recorded only as a length); the app tells you this before sharing.

We do not collect your name, email, phone number, contacts, precise location, or advertising ID, and we do not make decisions about you by automated means that produce legal or similarly significant effects. The commentary itself is generated by AI and may be inaccurate (see the Terms of Use).

3. Processors, recipients and international transfers

We are based in Japan and our providers process data in the United States and other countries where they operate. Data is transmitted over encrypted connections at the moment you use each feature.

Apple and Google additionally process purchases and speech recognition as independent controllers under their own policies (Apple, Google).

For transfers from the EEA, the UK and Switzerland we rely on the recipients' certification under the EU–U.S. Data Privacy Framework (and its UK and Swiss extensions) and, where applicable, on Standard Contractual Clauses in their data processing terms. Japan benefits from an EU and UK adequacy decision. You can refuse these transfers by not using the app; you can refuse the analytics and crash-report transfers alone by switching them off in Settings.

4. Data stored on your device

Your visit history (photos, label text, commentary, questions and answers, audio cache), app settings, the daily free count, pass expiry and diagnostic logs are kept only in the app's private storage on your device — never on our servers. On Android they are excluded from device backups; on iOS they may be included in your own iCloud or computer backup, depending on your device settings. Deleting a record in the app, or deleting the app, erases them.

5. How long we keep data

We keep no database of users or content. Our server discards photos, questions and text as soon as each request completes. The only data retained off your device is what section 3 lists, for the periods stated there.

6. Your rights

Depending on where you live (for example under the GDPR/UK GDPR, Japan's APPI, Korea's PIPA, or the CCPA/CPRA), you may have the right to access, correct, delete, restrict or object to the processing of your personal information, to data portability, to withdraw consent at any time, and to lodge a complaint with your data protection authority.

• Content lives on your device: delete records in the app or delete the app.
• Usage statistics and crash reports: switch them off in Settings at any time. Doing so stops collection and resets the installation identifier. Deleting the app also discards it.
• Because there are no accounts, we usually cannot tell which data belongs to you. If you write to contact@sugaryple.com we will help as far as we can; switching the statistics off (above) is the reliable way to detach and stop that data. We respond within one month.

California residents: we do not sell or share personal information, do not use it for cross-context behavioral advertising, do not process sensitive personal information to infer characteristics, and will not discriminate against you for exercising your rights.

7. Age

The app is intended for adults. You must be at least 18 years old (or the age of majority where you live, if higher) to use it. We do not knowingly collect personal information from anyone under 18; if you believe a minor has used the app, contact us and we will delete what we can.

8. Security

All traffic is encrypted (TLS); requests are accepted only from attested copies of the app; the server stores no user content; access to provider consoles is restricted to the operator. No method of transmission is perfectly secure, and we cannot guarantee absolute security.

9. Changes and languages

When this policy changes we post the new version here and update the date above; material changes are also announced in the app or its store listing. This policy is provided in several languages; if they differ, the English version prevails unless the law where you live requires otherwise.

See also the Terms of Use.