Privacy

1. Scope

This policy explains how JCA Archives ("we", "our", or "us") handles information when you use jcaarchives.com, the JCA Archives iOS app, TestFlight builds, contact forms, loan and donation enquiries, and restricted administrative tools.

2. Information We Process

Archive browsing: IP address, device and browser type, approximate region derived from an IP address, access time, requested pages, and basic performance or security logs may be processed by our hosting and backend providers.

Optional website analytics: only if you choose to allow it, Google Analytics 4 and Plausible measure public archive page visits and research-document opens. Google Analytics uses first-party cookies to distinguish browsers and measure visits; Plausible provides aggregate, cookie-free measurement. Both services receive basic device, browser, network and visit information. Advertising personalization and Google signals are disabled in our website integration. We do not sell browsing data.

Information you submit: contact details, institutional affiliation, messages, and information included in loan, donation, acquisition, or research enquiries.

Restricted accounts: administrator email address, authentication records, session information, and multi-factor authentication status are processed to secure curatorial tools.

Notifications: if you choose to enable iOS notifications, an Apple Push Notification service device token is stored so we can deliver archive updates. Notification permission is optional.

Location: if you tap "Use my location", the app reads your current location to rank artifact origins by distance. Your coordinates remain on your device and are not stored by JCA Archives.

Diagnostics: Apple and our hosting providers may supply aggregate crash, performance, or security diagnostics according to your device settings and their service terms. The app does not send errors to a custom reporting endpoint.

3. Camera and Location

The iOS app can use the camera through Apple's augmented-reality viewer when you choose to place a supported 3D object in your surroundings. JCA Archives does not receive or store the camera image used for that experience.

Location is requested only after you select "Use my location" in the proximity feature. It is used on your device to calculate distances from documented artifact origins. The app does not request background location, store your coordinates, use them for advertising, or build a location profile.

4. How We Use Information

Provide the catalogue, Cabinet pathways, 3D and AR experiences, and requested scholarly services.

Respond to enquiries and administer loan, donation, and acquisition requests.

Authenticate administrators and protect restricted archive records.

Deliver notifications only after permission is granted.

Measure reliability and aggregate usage, prevent abuse, and improve accessibility and performance.

Meet legal, security, provenance, and institutional recordkeeping obligations.

5. Service Providers

We use providers only to operate and secure the archive, including:

Supabase for database, authentication, storage, and server functions.

Plausible Analytics for optional aggregate website analytics.

Google Analytics for optional website visit and research-open measurement after consent. See Google's privacy policy.

Apple for App Store, TestFlight, augmented reality, and push-notification delivery.

Our hosting and delivery providers for serving pages, images, and security logs.

We do not sell personal information, use it for third-party advertising, or permit providers to use submitted enquiry data for their own marketing.

6. Retention and Security

Unsubmitted contact, loan, donation, and acquisition drafts save only in the browser you are using. Drafts expire after seven days without changes and are removed when the form next checks them. Use “Discard & start over” on a form to erase its draft immediately, especially on a shared device. Successful submission also clears the draft. Consent choices are never saved in a draft.

We keep submitted enquiries only as long as needed to respond, maintain appropriate provenance or institutional records, satisfy legal obligations, and resolve disputes. Authentication and security logs are retained according to operational and security needs. Push tokens are removed or made unusable when they expire, are replaced, or deletion is requested.

The website remembers your optional-analytics choice in this browser for up to 180 days. Analytics cookies are configured to expire after 180 days. Provider-side report and event retention follows the settings of the respective analytics service; cookie expiry does not erase information already received by a provider.

We use access controls, multi-factor authentication for administrative tools, encrypted transport, restricted backend policies, and service-provider safeguards. No internet service can guarantee absolute security.

7. Your Choices and Rights

Decline notifications or disable them at any time in iOS Settings.

Decline location access or disable it at any time in iOS Settings; the rest of the archive remains available.

Use browser controls to limit cookies or local storage, noting that authentication may require them.

Decline optional website analytics or change your choice below. Neither analytics service loads before you opt in. Withdrawal stops future optional collection in this browser and removes accessible Google Analytics cookies; it does not delete earlier provider records.

Request access, correction, deletion, restriction, or a copy of personal information where applicable.

Object to or withdraw consent for processing that relies on consent.

Optional website analytics excludes administrative and login pages, contact and enquiry flows, Cabinet routes, and records identified as sensitive or unpublished. We send approved page paths and accession/document identifiers, not URL query strings, fragments, message text, email addresses, signed document links or account identifiers. Browser Global Privacy Control and Do Not Track signals keep optional analytics off. These website choices do not change iOS permissions or essential hosting/security logs.

We may retain limited information when required for legal, security, provenance, or institutional-record purposes. We will explain any applicable exception when responding to a request.

8. Contact

For privacy questions or to exercise a privacy right, contact:

JCA Archives

Email: info@jcaarchives.com