Privacy

What Galler stores

Galler is operated by Studio AM. You can explore the public museum without an account. When you sign in, we store your email address, an account identifier, and a secure session so you can return without entering a new code each time.

If you choose Google sign-in, we receive your verified email address and store a stable Google account identifier to connect it to your Galler account. Google handles authentication; Galler does not receive your Google password. See the Google privacy policy.

We store your newsletter preference separately from your account and membership. Joining Galler or purchasing a membership does not subscribe you to the Galler newsletter.

Membership is available only to adults aged 18 and over. Before membership checkout, we ask you to confirm that you meet this requirement. We record the confirmation date and the version of the age requirement with your checkout record. This is your declaration, not independent age verification; we do not ask for your birth date or identity documents for this check.

Favorite artwork selections are saved to your account and are not listed publicly. You can remove a favorite from its artwork page or from Gallery. Removing a favorite does not remove an artwork already added to your private gallery.

Signed-in accounts, including free accounts, can save a private note of up to 500 characters for a collection artwork. We store the note with your account and the artwork identifier in Cloudflare’s database so you can read and edit it later. Notes are separate from favorites and galleries. Removing a favorite, a gallery item, or a gallery does not delete the note.

Why we use your data

We use your data only for the reasons below. Data protection laws such as the GDPR call these legal bases.

• To provide what you ask for (our contract with you): your account and sign-in, favorites, private galleries and photos, artwork notes, membership, and Dawson’s replies.
• With your consent: the newsletter, Dawson’s visit memory, and sharing text exchanges for quality review. You can withdraw your consent at any time in Account. This does not affect what we did before you withdrew.
• For our legitimate interests in keeping Galler secure, working and useful: sign-in and request limits, request fingerprints, security logs, counts of how Dawson’s help is used, and counts of web visits and page speed.
• To meet legal duties: billing records, and the 18+ confirmation kept with your checkout record.

Your private space

Photos uploaded to your personal gallery and its saved arrangement are stored in Cloudflare. They are accessible through your signed-in account and are not listed in the public museum. Galler needs to process and store these files to display your gallery; private does not mean end-to-end encrypted.

When you add an artwork from Galler’s collection, we save a reference to that artwork in your gallery. Its original collection image stays public; your selection and arrangement are private.

Private artwork notes are available only through their owner’s signed-in account. Galler does not send note text to AI providers or include it in Dawson requests, conversations, source citations, quality-review sharing, model training, or analytics events.

The editor prepares smaller copies for display, up to 2048 pixels per side. Keep your original files elsewhere. Ending membership does not automatically erase your saved spaces. One space remains free to edit. In additional spaces, you can continue viewing, downloading, and deleting saved photos; membership is needed to add photos or change their arrangement.

Email and payment providers

Resend delivers sign-in and newsletter confirmation emails. It receives the recipient address and email contents. Lemon Squeezy handles membership checkout, recurring payments, receipts, and billing management. We store the subscription identifiers and status needed to provide member access. Galler does not receive your full card number.

These providers and Cloudflare process information to provide their services. See the Resend privacy policy, Lemon Squeezy privacy policy, and Cloudflare privacy policy.

Galler is run from the United States. Cloudflare, Resend, Lemon Squeezy and Fireworks process data in the United States and other countries.

Cookies and browser storage

A secure, essential cookie keeps you signed in for up to 30 days. Signing out removes that browser’s session. A short-lived cookie protects a Google sign-in while it completes.

Your browser also keeps the following on your device:

• your language, your theme and the audio guide’s speed;
• your place in the museum, the last room you visited, and your display settings for the museum and artwork pages;
• in Tell them apart, the artworks you missed and when each comes back for review, until you choose Clear practice history;
• for this tab only, the rooms you visited on the museum map, where to return after browsing, and whether Dawson’s invitation and style notes were shown;
• for this tab only, your last three exchanges with Dawson, so Back and the next page can show them, and the artworks you opened, which Dawson offers to compare. Closing the tab clears them, and signing in or out clears the exchanges;
• a brief signal that tells your other open Galler tabs when you sign in or out.

None of this is used for tracking. Dawson’s recent exchanges and the artworks you opened are sent to Galler only with a question you send, as the Dawson section explains. When Visit together is active, your current place and connection details are shared as the Visiting together section explains. The other preferences listed above stay in your browser. No third party tracks your activity across sites through Galler. The earlier Workspace and visitor-room prototypes can also keep arrangements in the browser; these are separate from your account’s private gallery.

Artwork notes and unsaved note drafts are held temporarily in page memory. Galler does not save them in persistent browser storage.

Security and retention

Sign-in codes expire after 10 minutes and work once. We store protected hashes of codes, session tokens, and addresses used for request limits. Our hosting and email providers may also keep technical delivery or security records.

Expired sign-in challenges and request-limit records are cleaned up daily; expired sessions are removed. Account details, saved work, subscription records, and newsletter consent history remain while needed to operate the service, handle billing, and respect your preferences. Deletion requests may leave records that need to be retained for billing or legal obligations. Membership checkout records, including the age declaration, are retained with billing records after account deletion; your email address is removed from the associated Galler account record.

Deleting an artwork note clears its text from the active database. A record with no note text keeps your account and artwork identifiers, a revision number, and the last-change time to prevent an older edit from restoring deleted text. Deleting your account removes all of its artwork-note records.

Database backups held by our hosting provider expire within 30 days. If we restore one, we apply deletions again.

Visiting together

When you enter the shared museum, visitors nearby can see a nameless figure where you are. They cannot see your account or send you messages. Turn on Visit alone to stop appearing to strangers and hide their figures. If you are in a group, you and your group can still see each other.

A group is for people aged 16 or older. A signed-in host starts it and admits each person who asks to join. Guests choose a display name. PIN groups do not require guest accounts; groups limited to invited email addresses require guests to sign in with the invited address. Your group can see your display name and your place in the museum. Group messages are visible only to members of that group.

For an email invitation, the host submits the intended address so Galler can match it to the guest’s signed-in account. Invitation records contain a keyed, salted email hash, a token hash, a masked address label, an expiry and a claim status; the invited member’s record also keeps the email hash for reconnection. These records last until the group ends. The full invited address is not saved in group records or shown to other members. A link is for one guest request, expires within one hour or when the group ends, and can be revoked. Host approval is still required. Galler does not send invitation emails: the host copies the link or opens their own email app, which receives the address and link. The host’s browser holds the full address while preparing that invitation.

We use Cloudflare to connect visitors. Current positions are used to show nearby figures, not to build a record of your movements. The last reported position can remain attached to an open connection and is discarded when that connection closes. A temporary browser identifier and hidden-person list help keep people you hide from appearing again. Temporary hiding can end when browser identifiers change, browser storage is cleared, or the hiding token expires.

Your browser remembers the Visit alone setting. For this tab, it keeps a temporary presence identifier and hidden-person list, plus your group PIN, display name and a secret used to reconnect to your group. A pending email invitation is also kept in this tab so it survives sign-in, with a one-hour deadline. It is cleared when you cancel or receive your group reconnect details, or when next checked after that deadline. These connection details are sent to Galler when needed for the visit. Leaving the group clears its saved reconnect details; closing the tab clears the tab’s storage.

To keep a group together, zone placement records use temporary group and member identifiers. Unused connection reservations expire after 30 seconds. Unused zone reservations for groups and zone-removal markers expire within ten minutes. A connected group keeps its placement while it is needed. Scheduled cleanup runs even when nobody is active; service outages can delay deletion.

The group keeps a limited message history while it is open. It ends when the host ends it, after it has been empty for 15 minutes, or at its four-hour limit. Group history is then deleted, apart from messages included in a report. We do not record audio, and this version has no voice chat.

If you report a group member, we keep the reason, the people involved, the group identifier and up to 20 of the reported person’s recent messages. A report about a stranger keeps temporary identifiers, the reason, the museum zone and the time, but no coordinates or messages. Reports expire after 30 days and are removed by the next successful daily cleanup. Failed delivery is retried without extending that deadline.

Cloudflare processes connection information, including IP addresses. Group removal uses a salted address hash and a member secret to help prevent rejoining that group. These removal records are kept until the group ends. We do not put display names, messages, group PINs, invitation tokens or presence identifiers into analytics.

Dawson

Dawson is Galler’s guide. Its free museum guide does not contact an AI provider. When an adult member asks Dawson’s AI art guide a question, Galler sends the question, up to six recent conversation messages, relevant public artist, artwork and museum notes, the page category, and any image they attach to that message to Fireworks AI to generate a reply. We do not automatically access or send your private gallery photos, account email, favorites, payment information, or URL queries. Fireworks processes this data for Galler under its Data Processing Addendum, in the United States or other countries, and may run automated safety checks.

The Galler Android app does not include Dawson’s chat or the AI art guide. The app does not send messages, photos or audio to Fireworks, and it has no dictation. It can read guide texts aloud with your phone’s own voices; nothing is sent to Galler or Fireworks for this.

Messages and images can contain identifying information you include yourself. Galler also sends a pseudonymous account token to isolate prompt caches; this token is derived with a server secret and is not your email or account ID. Fireworks documents no persistent prompt or response logging by default for open-model inference, with prompt caches held in temporary memory for several minutes. Our sharing preference does not opt you into Fireworks training or content logging. See Fireworks data handling.

Attached images are resized and re-encoded in your browser before sending, removing the original file’s embedded metadata. Selecting an image alone does not upload it; it is sent only when you send the message. Galler processes the image for that reply and does not save it to your account or gallery.

Optional microphone dictation uses your browser’s speech service. In Chrome the audio is sent to Google, in Safari to Apple. Galler does not receive or store the audio. Dictated words stay in your editable draft until you send them. Dictation stops when you close Dawson or leave the page.

Read aloud and the audio guide start only when you choose them and use a voice provided by your browser or device. Depending on the voice, the browser may send the text to its speech provider. Listening does not use an AI reply.

Dawson’s heart saves or removes a favorite at once. When you ask Dawson in a message to save an artwork or add it to a gallery, Galler retrieves its favorite status and your gallery choices to show a preview in your browser, and the change requires your explicit confirmation. These private choices and action results are not sent to Fireworks or added to the conversation. We retain required action receipts containing account, artwork and gallery identifiers, public artwork labels, the requested operation, state, revisions and timestamps for 30 days plus the next daily cleanup to prevent duplicate changes and recover their results. They contain no chat text, gallery-name snapshots, photos or audio. Favorite revision records remain with your account so undo can detect later edits. This operational storage is separate from optional text sharing and is removed when you delete your account.

Your conversation stays in the page while it is open, including when the chat panel is closed. Your browser also keeps your last three exchanges with Dawson for this tab only, so Back and the next page can show them. Closing the tab or signing out clears them. Galler does not keep an ongoing conversation history on its servers. Completed replies are temporarily stored with your account for retry access for 24 hours and removed by the next daily cleanup. A reply can repeat personal details from your question or image. Request fingerprints and usage totals are retained for up to 62 days plus the next daily cleanup to prevent duplicate charges and enforce allowances. These fingerprints use a server secret; they are not stored questions. This temporary service storage is separate from optional improvement sharing.

We keep your allowance anniversary and membership start timestamps in your Dawson profile to calculate monthly renewals consistently, including after a plan change or rejoining. Account deletion removes this profile. The original anniversary also forms part of your subscription record and follows the billing-record retention described above.

If you report an AI reply as wrong or harmful, we keep the question, the reply, its sources and the version of Dawson’s instructions that wrote it for 30 days plus the next daily cleanup, so we can review it. Deleting your account removes your reports.

Sharing text exchanges to improve Dawson is off by default. You can enable it separately in Account. If enabled, Galler can review eligible future questions and replies to assess answer quality and improve Dawson’s guidance. Only successful standalone text exchanges with no image or supplied conversation history are eligible; earlier messages, follow-up exchanges, images, audio, and private gallery data are excluded. We do not collect past conversations when you turn sharing on. Sharing is optional and does not change your membership access or reply allowance.

We filter common contact details from shared text and replace the account reference with a random identifier. This reduces identifying information but does not guarantee anonymity: names, personal stories, and other identifying details may remain. We keep a separate account link so shared copies can be deleted. Do not share sensitive information. Shared exchanges are for Galler’s internal quality review, not model training, advertising, sale, or public publication.

Shared exchanges expire after 30 days and are removed from the active database by the next daily cleanup. Turning sharing off in Account deletes the shared copies and their account link from the active database and stops future collection, including pending requests. You can turn it off even after membership ends. This does not remove the separate temporary reply cache or required usage records described above.

Visit memory is also off by default and is separate from sharing. If you enable it, we store only your most recently remembered public artwork or room and the visit time to personalize a later greeting. Turning it off or choosing Forget my visit in Account clears this information. Deleting your account removes Dawson’s memory, adult declaration, cached replies, usage records, and shared exchanges; the membership checkout declaration remains with the billing records described above.

To learn which help works, Galler counts how Dawson’s free help and audio guide are used: the page type, the language, the help topic, whether an audio story finished, and whether the visitor is a guest, a free account or a member. These counts contain no account or device identifier and no message text.

Children

Galler accounts are for people aged 16 and over. The museum is free to explore without an account. We do not knowingly keep an account for a child under 16. If you think a child under 16 has an account, email support@studioam.art and we will delete it. Dawson’s AI art guide and membership are only for adults aged 18 and over.

Your choices

Change newsletter preferences in Account, or use the unsubscribe link in a newsletter. You can remove photos inside your space. You can delete your account and its data yourself from Account, on the web or in the Galler app. Cancel an ongoing membership through Manage billing before closing your account.

On galler.app in a web browser, Galler uses Cloudflare Web Analytics to count visits and measure page speed. It uses no cookies or browser storage and does not track you across sites. It records the page address, the referring page, your browser, operating system and device type, your country and how long the page took to load. The Android app does not use it.

You also have these rights over your personal data:

• Access: get a copy of your data.
• Correction: have wrong data corrected.
• Deletion: have your data deleted.
• Restriction: have us limit how we use your data.
• Objection: object to uses based on our legitimate interests.
• Portability: receive your data in a common, machine-readable format.
• Withdrawing consent: turn off the newsletter, visit memory or sharing in Account at any time. This does not affect what we did before you withdrew.

To use these rights, email support@studioam.art from your account address. We may ask you to confirm that the account is yours before making changes. We reply within one month.

You can also complain to a data protection authority, such as the one where you live. In the UK, this is the Information Commissioner’s Office (ICO).

Changes to this policy

When we change this policy, we post the new version here with a new date. We email members about important changes.