MundiVue Privacy Policy
The text from here to the end of §B is the part intended for publication. Everything outside it is repository governance and would not appear on the published page.
B.1 Who is responsible
MundiVue is operated by the developer named in the Even Hub listing. Contact details for privacy questions: necula.go4it@gmail.com.
B.2 The short version
MundiVue answers two questions: what is near me? and what am I looking at?
To answer the first, the app sends your coordinates to our service, which asks OpenStreetMap what cultural places lie within 3.5 km.
To answer the second, the app sends one photograph to our service, which passes it — in parallel — to our model provider and to Google's landmark-recognition service, combines their answers, and returns text. A specific place name is shown only when the model is nearly certain on its own or when Google's landmark index independently confirms the same place. The photograph is never stored, never written to disk, never shown to a person, and never sent with your location. It exists only in memory for the duration of the request.
We keep no account, no history, and no profile of you. Everything the app remembers — your preferences and your saved places — stays on your phone, and uninstalling the app deletes it.
B.3 What the app processes, and why
| Data | When | Why | Where it goes |
|---|---|---|---|
| Photograph you take or choose | Only when you press the camera or album button | To identify the building, artwork or object in it | Resized and re-encoded on your phone, then to our service, then to our model provider. Not stored anywhere |
| Precise location (latitude and longitude) | Only when you ask for nearby places | To find cultural places within 3.5 km and show their distance | To our service, then to the OpenStreetMap Overpass API. Not stored |
| Voice recording of your question | Only while you hold a voice question | To transcribe your question into text | To our service, then to our model provider for transcription. Not stored |
| Question text | When you ask a question by voice or text | To answer it | To our service, then to our model provider. Not stored |
| Your guide preferences (depth, tone, language, interests, spoiler setting) | Sent with each request | To shape the answer's length and register | To our service, then to our model provider. Held on your phone |
| Saved places (up to 50) | When you save a place | So you can find it again | Stays on your phone. Never sent to us |
| Service credentials (service address, client ID, token) | Configured once | So the app can reach the private service | Stays on your phone; the client ID is sent with each request |
B.4 What happens to a photograph, precisely
This is the flow the app exists for, so it is described in full rather than summarised.
- On your phone, before anything is sent, the image is decoded, scaled so its longest edge is at most 1,600 pixels, and re-encoded as a JPEG. The re-encode is made from decoded pixels, so every piece of embedded metadata is discarded in the process — including EXIF GPS coordinates, capture time, device model and orientation. What leaves your phone is picture data and nothing else. If the re-encode fails for any reason, nothing is sent at all.
- Your location is not attached. The app does not request your location on this path, the network layer removes any location field before sending, and the service rejects a request that carries one. Three independent points, any one of which is sufficient.
- At our service, the image is held in memory, passed in parallel to our model provider and to Google's landmark-recognition service, and released. It is never written to a file, a database, a cache, a log or a backup, because the service has no storage of any kind attached to it for this purpose.
- At our model provider, the request is sent with storage explicitly disabled, so the provider is instructed not to retain it. At Google, the request uses the synchronous annotation path, of which Google's own published data-usage terms state that the image "is processed in memory and not persisted to disk" and that content sent to the service is not used to train its models.
- What comes back is text — a title, a description and source references. No image is returned, no image is echoed, and there is no gallery, history or thumbnail anywhere in the product.
- For up to five minutes, our service keeps the text answer in memory so that pressing identify twice on the same photograph does not pay for and repeat the same work. What is kept is the answer and a one-way hash of the request; the photograph itself is not kept, and cannot be reconstructed from the hash. It is held in ordinary process memory, is limited to a few dozen entries, and is gone when the process recycles.
B.5 Permissions, one by one
The app requests five permissions. Even Hub offers exactly five, so this is the platform's entire permission surface; each is used, and none is requested "just in case".
| Permission | What it is used for | What happens if you deny it |
|---|---|---|
network | Every request to the private MundiVue service | The app cannot reach the service; nearby and identification are unavailable |
location | Reading your coordinate when you ask for nearby places | You are told a location is needed. No substitute or approximate coordinate is ever used, and nearby is not answered without a real one — this applies to the built-in demonstration places as well |
camera | Taking a photograph for identification | The album and file routes still reach identification |
album | Choosing an existing photograph for identification | The camera route still reaches identification |
g2-microphone | Recording a spoken question | You can still ask questions as text |
The app additionally uses the glasses' motion sensor to detect a look-up gesture. Motion reporting stops when the app is suspended and re-arms on resume only if you enabled look-up wake; it does not stream while the app is in the background.
B.6 Who else receives data
| Recipient | What they receive | Why | When |
|---|---|---|---|
| Cloudflare | Operates the service; sees the request as any network operator does | Hosting | Every request |
| OpenAI (model provider) | The photograph, the voice recording, the question text and your preferences | Identification, transcription and answers | Only on the request that needs it |
| Google (Cloud Vision landmark recognition) | The photograph only — never your voice, questions, preferences or location | To independently verify the identification against a landmark index before a name is shown | Only when you identify a photo |
| OpenStreetMap (Overpass API) | Your coordinate | To find cultural places within 3.5 km | Only when you ask for nearby places |
| Wikipedia, the Metropolitan Museum of Art, the Art Institute of Chicago, the Cleveland Museum of Art | The name of a place — never your location, never your photograph | To gather sourced background about a place | Only when a guide is built for that place |
We do not sell data, do not share it for advertising, do not profile you and do not attempt to re-identify anyone. There is no analytics package, no advertising identifier and no third-party SDK collecting anything.
B.7 International transfers
Our service runs on Cloudflare's global network, which by default executes each request in the data centre nearest the person making it. This means the transient in-memory copy of your photograph occurs in or near your own country, varying by request, and is not pinned to any one place. The onward call to our model provider leaves that region regardless of where the request began.
B.8 How long anything is kept
| Data | Retention |
|---|---|
| Photographs | Not retained. In memory for the duration of the request only |
| Voice recordings | Not retained. In memory for the duration of the request only |
| Location | Not retained |
| Identification results | Up to 5 minutes in service memory, to avoid repeating an identical request. Not written to storage |
| Request logs | None. Service logging is switched off, and the service writes no log lines of its own |
| Rate-limit counters | Short-lived counters keyed to the installation credential, kept by the platform for abuse prevention |
| Preferences and saved places | On your phone, until you delete them or uninstall the app |
B.9 Your rights, and how to use them
Because we hold no account and no stored record of you, most rights resolve on your own device rather than through a request to us:
- Access and export — your preferences and saved places are held on your phone by the app.
- Rectification — preferences are editable in the app; a saved place can be removed and saved again.
- Erasure — delete individual saved places in the app, or uninstall the app to remove everything it holds. We have nothing further to erase, because we store nothing.
- Objection and restriction — deny or revoke any permission at any time; the table in §B.5 says what each denial costs.
- Complaint — you may complain to your data protection authority.
If you believe we hold something about you, write to the contact address in §B.1 and we will answer.
B.10 What we never do
- No fallback or approximate location is ever substituted for a real one.
- No image is stored, echoed, displayed back, or kept in any gallery.
- No payment card data, health data, government identifiers, passwords, multi-factor codes or API keys are collected or processed by the app.
- No advertising, no tracking, no cross-app or cross-site identifiers.
- No use of your data to train or evaluate any model by us.
B.11 Children
The app is not directed at children and requires no account. It does not knowingly process a child's personal data.
B.12 Changes
If this policy changes materially, the new version is published at the same address with a new effective date before the change takes effect.
Effective date: 2026-08-21.
End of the text intended for publication.
---