Privacy
policy.

What FrameBright is

FrameBright plays exhibit content — PowerPoint decks, images, video, web pages — on wall-mounted Android screens in museums and galleries, unattended. There are three pieces: a web portal at this domain, a phone app called FrameBright for the staff who look after those screens, and a player that runs on the screens themselves.

This policy covers all three. The people it is about are the museum and gallery staff who hold FrameBright accounts. It is written by the people who operate FrameBright, and “we” means them.

What we collect

Your account

Your screens and what you put on them

The phone app

The phone app asks you for no sensitive permission at any point. It never requests your camera, your location, your photos, your contacts or your microphone, because it does not use any of them — there is no code in it that could.

Android still lists, on the store page, every permission the app and the libraries inside it declare. FrameBright’s list is three, and all three are about reaching the network: INTERNET, ACCESS_NETWORK_STATE and ACCESS_WIFI_STATE. The last two are how the app can tell you it is offline instead of showing you a blank screen. None of them asks you for anything: Android grants them at install and never prompts.

What we don’t collect

These are statements about how the software is actually built, not promises about how we intend to behave:

• No analytics or usage tracking. Neither the portal nor the phone app contains an analytics, attribution or crash-reporting library. Nothing counts your screen views or reports what you clicked.
• No advertising. No ad networks, no advertising identifier, no ad-supported anything.
• No tracking across other apps or websites. We do not know and do not ask what else is on your phone.
• No selling or renting your data, and no sharing it with anyone for their own purposes. The companies listed under Who else processes it handle it only to do the job we ask them to do.
• No location. We do not collect the location of your phone or of your screens. You can name a screen after a room; that name is whatever you typed.
• No payment details. FrameBright does not take payments through the app or the portal, so no card or bank details exist here to leak.

Gallery visitors

If you are a visitor standing in front of a FrameBright screen: the screen collects nothing about you. FrameBright never asks the box for a camera or a microphone and contains no code that could use one; it does not count or measure people, it does not detect phones, and it has no face or presence detection of any kind. It is a display that plays what the curator scheduled.

That is a statement about our software, which is the only part we can speak for. The boxes themselves are ordinary Android hardware bought from third parties, and some models ship with a voice remote that has a microphone in it. FrameBright cannot reach it, and nothing we install turns it on.

If a screen is set up to respond to touch, the taps it receives move the exhibit forward. They are not recorded as a visitor record and are not attributed to a person.

Who else processes it

FrameBright uses a small number of companies to do specific jobs. Each receives only what that job needs, processes it on our instructions, and may not use it for anything of their own:

• Resend — sends the verification and password-reset emails, and therefore receives the email address and the message.
• Expo, and through it Apple’s and Google’s notification services — deliver push notifications to the phone app, and therefore receive the notification token and the text of the alert. This applies only if you turn notifications on.
• DigitalOcean — stores uploaded content and screenshots in an object storage bucket.
• The hosting provider that runs the portal and its database, which necessarily holds everything listed above.

We do not use any other third-party service that receives your data. If that changes, this list changes with it before the change ships.

How long we keep it

The “How long” column in each table above is the real answer for that row. Two of them are worth repeating because they are the ones people ask about:

• Screenshots expire on their own. Each screen keeps its 12 most recent screenshot images. When a thirteenth arrives, the oldest image is deleted from storage and only the record that a screenshot happened, and when, is kept.
• Notifications are not switched on yet. The phone app cannot register a handset for notifications in any build we have shipped, so there is no notification registration to keep or delete. When that changes, this page will say how revoking one works before the feature is available, not after.

Everything that is not on a timer above is kept for as long as your account exists, and goes when the account goes.

Deleting your account

Deleting it yourself, from inside the app

Open the FrameBright app, tap Account in the top bar, and follow Delete this account. It asks you to type a confirmation word and then your password — a signed-in phone alone is not enough for something this permanent — and the deletion happens immediately. There is nothing to wait for and nobody to email.

What happens to your screens. Deleting the account removes their enrolment, so they stop playing within about twenty seconds and have to be paired again with the FrameBright Setup app before they can be used. If a screen is kiosk-locked, unlock it from the control room first: afterwards the only way in is the maintenance PIN pad on the screen itself, and we cannot unlock it for you once the account is gone.

What is not here yet. The button is in the phone app. The web portal does not have one of its own yet, so from a browser the email route above is still the way. We are telling you that rather than describing a button you would go looking for and not find.

You can also delete parts of your data without deleting the account: signing out from the portal or the phone app ends that session and destroys that phone’s notification registration, deleting an album deletes its files from storage, and deleting a screen deletes its command history and diagnostics.

Security

• Everything travels over HTTPS. The phone app talks to exactly one address and will not start if it is pointed anywhere else.
• Passwords are stored as scrypt hashes with cost parameters chosen against OWASP’s password storage guidance, and compared in constant time.
• Session tokens, password-reset tokens, screen enrolment tokens and notification tokens are stored as SHA-256 digests, never in a form that could be replayed from a database copy.
• The one exception is the notification token, which has to be sendable to be useful. It is encrypted with AES-256-GCM under a key that exists only in the running deployment — not in our source code and not in a database backup — and it is kept in a separate table from everything a support session would ever need to read.
• The phone app signs you in on a native screen, not inside the embedded web view, so your password is never typed into a page.
• No system is perfectly secure, and we are not going to tell you this one is.

Children

FrameBright is a tool for museum and gallery staff. It is not directed at children, we do not knowingly create accounts for children, and the screens collect nothing from the visitors in front of them — of any age.

Changes

If this policy changes, the effective date at the top changes with it, and we will email account holders before a change that makes a material difference to what we collect or who receives it takes effect.

Who we are, and on what basis

The controller of the personal data described here is FrameBright Technology Inc., at 1331 Chan Place, Victoria, BC V9B 4J5, Canada. That is the entity to address a request or a complaint to.

Why we are allowed to hold it. Everything in the tables above is processed to give you the service you asked for — running your account and your screens. In UK and EU terms that is performance of a contract with you. Where we keep a record longer than the service strictly needs it, such as a sign-in audit trail, the basis is our legitimate interest in keeping accounts secure, and you can object to it using the contact below.

Where it goes. FrameBright runs on servers in the European Union. Two of the suppliers named in Who else processes it are United States companies, so the data they handle for us is transferred outside the UK and the EEA; those transfers rely on the European Commission’s standard contractual clauses. Nothing is transferred anywhere else.

Your rights. You can ask for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, object to processing based on legitimate interests, and ask for your data in a portable form. There is no charge and no account penalty for asking.

Contact

For anything in this policy — a question, a correction, a copy of your data, or a deletion request — email Tisha Becker at contact@framebright.com.

If you are in the UK or the EU and are not satisfied with how we have handled a request, you have the right to complain to your national data protection authority.