Privacy policyプライバシーポリシー

ExhibitAR at exhibitar.vercel.app is run by Jin Sa (“we”, “us”). We decide how the data described here is used, and we answer for it.

ExhibitAR is open source, so anyone can run their own copy. This policy covers only the copy at exhibitar.vercel.app. Copies run by others have their own operators and policies.

Questions and requests about your data: jinsa.dxb@gmail.com.

• Your STL file. It is read, simplified and turned into a mat inside your browser. The file itself is never uploaded.
• Camera images. In AR, your phone uses the camera to find the printed mat. Our page receives only where the mat is, never the picture, and sends no camera images to us.
• Your fingerprint or face. A passkey is checked on your own device. We store its public key, never anything about your fingerprint or face.
• Your location or contacts. We don’t ask for them.

Visitors don’t need an account. When you open an exhibit:

• Your browser downloads the exhibit: its model, mat images, labels and pictures. These normally come from our storage, but an exhibitor can point the model or the marker images at another web address; your browser then downloads them from that server, which receives the usual technical details below.
• The exhibit’s view counter goes up by one, once per browser tab. The counter is a single number, and nothing about you is stored with it. Its exhibitor can see the count. If you are signed in to the Studio in the same browser, the request that counts the view carries your sign-in, but it is not stored with the count.
• Our hosting providers receive the technical details every website receives: your IP address, browser and device type, the page requested and the time (section 7).
• Vercel Web Analytics and Speed Insights record page views and loading times, without cookies (section 6).

You can use the Studio without an account. Until you save, your work lives only in your browser tab and is gone when you close it. When you create an account we store the account details below, and when you save or publish we also store your exhibits.

Your account

• Your email address, and your password in hashed form if you set one.
• If you continue with Google: the name, email address, profile picture link and account ID that Google shares with us.
• If you add a passkey: its public key and the name of the device it is on.
• Sign-in records our sign-in provider keeps for security, such as when you signed in and from which IP address.

Your exhibits

• Their titles and descriptions.
• The simplified 3D model (a GLB file) and how it stands on the mat.
• The mat files (PDF, SVG and images) and the marker images.
• Your annotations: titles, text, links, pictures you add, and the tour order.
• The calibration you set on your phone, the view count, and when each exhibit was created, changed and published.

Email

We email you only about your account, for example to confirm your address. No newsletters.

We use the data above only to:

• run your account and let you sign in;
• store your exhibits, publish them and show them to visitors;
• keep the service secure, find faults and see how fast pages load;
• answer your requests and messages.

We don’t use it for advertising or profiling, and we don’t sell it. We use it for other purposes only with your consent or where the law requires it.

ExhibitAR uses no advertising or cross-site tracking cookies. It keeps only these in your browser:

Vercel Web Analytics counts page views without cookies: it records the full address of each page viewed, the page that linked to it, and the browser, operating system, device type and country. To tell visits apart it uses a short-lived value derived from the request, which Vercel discards within a day. Speed Insights measures how fast pages load and respond to taps and clicks, with the page address, the connection type and which part of the page a slow response came from. You can clear this site’s storage at any time in your browser’s settings.

These companies run parts of ExhibitAR for us, each under its own privacy terms:

Supabase

Database, file storage and sign-in. Accounts and exhibits are stored on its servers in Tokyo, Japan.

Vercel

Hosting, server functions (run in Tokyo) and the analytics in section 6. Its network delivers pages from locations around the world.

Google

Only if you choose Continue with Google: Google confirms who you are and shares your basic profile. On Android, AR in Chrome runs on Google Play Services for AR (ARCore), under Google’s privacy policy.

Needle and Apple

On iPhone, AR opens in the Needle Go App Clip, made by Needle Tools and delivered by Apple. Tapping Start AR sends the exhibit page’s full address to Needle so the App Clip can open it. Needle’s and Apple’s privacy policies cover the App Clip itself.

Some of these companies are based in the United States and may process data there or in other countries. We share data with them only to run the service.

• Your account: until you ask us to delete it.
• Your exhibits and their files: until you have them deleted, or your account. Unpublishing stops the exhibit page from opening, but the uploaded files stay reachable at their direct addresses until they are deleted. If a save fails partway, files already uploaded stay stored until they are deleted.
• Copies in caches: uploaded files may be cached by browsers and content delivery networks for up to a year, so copies can outlive their deletion for that long.
• Studio work you never save: never sent to us.
• Server logs and analytics: kept by Vercel and Supabase for the short periods their services set, then deleted.

You can ask us to:

• tell you what personal data we hold about you, or send you a copy;
• correct it;
• delete some exhibits, or your whole account and everything in it;
• stop using it, where the law gives you that right.

Email jinsa.dxb@gmail.com from the address on your account. The Studio has no delete buttons yet, so deletion is done on request, and we confirm when it is done.

At any time you can also sign out, unpublish an exhibit in the Studio, and clear this site’s storage in your browser. If you think we have handled your data wrongly, you can also contact the data protection authority where you live.

Connections use HTTPS. Each exhibitor can read and change only their own exhibits, and the database itself enforces this. Passwords are stored hashed, never as plain text.

Uploaded files are public by link. An exhibit’s files, including those of drafts, are stored at addresses that contain a random exhibit ID. Anyone who has an address can open the file, so don’t upload anything you need to keep secret.

Found a security problem? Please report it privately through the repository’s Security tab on GitHub.

Studio accounts are not meant for children under 13, and we don’t knowingly create them for children. Visitors of any age can view exhibits: viewing needs no account and collects nothing beyond what section 3 describes. If you think a child has given us personal data, contact us and we will delete it.

When this policy changes, we update this page and the date at the top. If a change affects how we use data you have already given us, we will point it out on the site.

jinsa.dxb@gmail.com

Jin Sa, operator of ExhibitAR. Please write in English or Japanese. For security reports, use GitHub’s private reporting (section 10).