Salon is an iPhone app that hangs one public-domain painting at a time on a museum wall. It is made by Joseph Bankole ("we"). This page explains what the app does with information about you. It describes the current version, in which the print shop is not yet open.

In short

  • There are no accounts, no ads, no analytics code and no tracking.
  • What you like, what you swipe away and how long you look at each work stay on your iPhone.
  • Apart from the ordinary web requests that load the paintings and check whether the shop is open, information leaves your iPhone only when you choose: your sign-up, if you join the waitlist for the print shop, and requests to Apple Music, if you turn the soundtrack on.

What stays on your iPhone

The app learns your taste from what you do on the wall: the works you like, the ones you swipe away and how long you look at each one. It keeps that record on your iPhone and uses it to order your daily wall. The app does not send it to us or to anyone else, and it contains no analytics or advertising code that could send it. Your settings (haptics, moving light, the soundtrack and the daily reminder) are kept on your iPhone too.

Like other app data, this can be included in the backups your iPhone makes to iCloud or to a computer. Those backups are managed by you and, for iCloud, by Apple. Deleting the app removes its data from your iPhone, except the random install number described below, which normally stays in your iPhone's keychain.

Loading the art

The paintings are downloaded straight from the museums that hold them: the National Gallery of Art, Washington; the Cleveland Museum of Art; and the Metropolitan Museum of Art. As with any download, the museum's server sees your IP address, the image asked for and the general details every iPhone app sends with a web request, such as your language and the version of iOS. The app accepts no cookies and adds nothing else about you. The museums' own privacy policies cover their servers. Links to a museum's page or to a licence open in Safari, where that website's own policy applies.

When you open My Shop, the app also asks our server, which Supabase runs for us, whether the print shop is open. That request reaches the server with your IP address, as every web request does. The app adds nothing that identifies you or your iPhone, only a key that every copy of the app shares, so the server knows the request comes from the app. Supabase logs every request to our server, a waitlist sign-up included, with its IP address, the approximate location and network provider worked out from that address and the device details the request carries. It keeps those logs for seven days, as our service provider and with the same protection this policy describes, and then deletes them. We use them only to keep the server running and to fix faults.

The daily reminder

If you turn on the daily reminder, your iPhone shows one notification a day, at the time you choose, saying a new wall is up. It is scheduled on your iPhone by iOS and sends nothing anywhere: there is no server behind it and no device token is collected. You can turn it off in the app's Settings, or in the Settings app.

Joining the waitlist for the print shop

The print shop is not open yet. If you join the waitlist, the app sends us:

  • your email address, which is required to join.
  • a random install number, made by the app on your iPhone the first time you open it. It is not your iPhone's serial number or any Apple identifier, and it is not linked to your Apple Account. It is stored in your iPhone's keychain, which iOS normally leaves in place when an app is deleted, so a reinstall on the same iPhone usually gets the same number. We keep it with your email address.
  • your iPhone's language and region setting, and the app's version number.

We use your email address for two things only: to write to you once, when the shop opens, with your discount, and to apply that discount when you order. Waitlist members get 25% off the price of their prints (not shipping or tax) for the first 24 hours after the shop opens. To give you that discount, our order server checks whether the email address you pay with in Apple Pay, or the install number of the iPhone the order comes from, is on the waitlist. On our side, that check is the only use of the install number. The app also uses it to set the order of your daily wall, which happens entirely on your iPhone. We use your language to write to you in English or French. The date you joined, your region and the app's version are kept with your sign-up for our records and are not used for anything else.

The opening email is the only marketing we will send you. We never sell or rent your email address or anything else on the waitlist, and we share it only with the services named on this page, which store it and send the opening email for us. Joining again with the same email address updates your sign-up rather than adding a second one.

Sign-ups are stored by Supabase, on its servers in the United States (Oregon). Supabase holds them for us as our service provider and gives them the same protection this policy describes. The opening email is sent from our own mailbox, which Zoho hosts in Canada. Zoho runs that mailbox for us as our service provider and gives it the same protection. We keep sign-ups until the shop has opened, its first 24 hours have passed and the opening email has gone out; then we delete the waitlist and, from our mailbox, the opening email and any messages about the waitlist. Copies in Supabase's daily backups of our database expire within seven days after that. To see what your sign-up holds, correct it, or leave the waitlist sooner, write to us at partnerships@josephbankole.ca from the address you signed up with, and we will do it.

The soundtrack (Apple Music)

The soundtrack is off unless you turn it on in the app's Settings. The first time you tap the music button, iOS asks whether the app may use Apple Music. If you allow it, the app checks whether your Apple Music subscription can play full tracks, searches the Apple Music catalogue for a playlist that suits the period of the painting on the wall (for example, "Baroque music"), and plays it with Apple's own music player. The search words describe only the music of a period, such as its style or its composers, and nothing about you. If you do not subscribe, the app shows Apple's subscription offer and plays nothing.

Apple runs your Apple Music account and subscription under its own privacy policy. The app does not read your music library or your listening history, and nothing from Apple Music is used to choose which works you see. On iOS 26.4 and later, the app also asks Apple Music not to count the soundtrack towards your listening history, which Apple Music uses for your recommendations. You can withdraw the app's access to Apple Music at any time in the Settings app.

The print shop, once it opens

The shop is closed in this version, and the app takes no payments. When it opens, you will pay with Apple Pay. Apple Pay will pass us your name, delivery address and email address, along with a payment token, so that we can make your print, send it, keep you informed about your order and, during the shop's first 24 hours, check the waitlist for your discount. Your card number is not shared with us. Our payment processor will handle the payment, and our print partner will make and deliver the print. Each will receive only what it needs to do that. Before the shop opens, we will update this page to name both, and update the app's privacy details on the App Store.

Crash reports

If you have chosen, in the Settings app, to share analytics with app developers, Apple may pass us crash reports and usage statistics for this app. Apple shares these in a form that does not identify you.

Changes

If the app starts doing something new with information about you, this page changes first, with a new date at the top.

Contact

Joseph Bankole, who is responsible for protecting your personal information: partnerships@josephbankole.ca