Skip to content
beacbeac — home

Privacy Policy for beacbeac

Last Updated: September 22, 2026

Introduction

beacbeac ("we", "our", or "the app") is a professional beacon management system designed for museums and galleries. This Privacy Policy explains how we collect, use, and protect your information when you use our mobile application, our web dashboard, and this website.

Information We Collect

Account Information

  • Email address: Used for authentication and account management
  • Display name: Used to identify you within the application
  • Password: Stored securely using Firebase Authentication (never stored in plain text)

Device Information

  • Bluetooth beacon identifiers: UUIDs, major/minor values of detected beacons
  • Signal strength (RSSI): Used to determine proximity to beacons
  • Device location: Required for Bluetooth Low Energy scanning (iOS and Android requirement)

Stored On Your Device Only

  • Stories you have found: A local list of stories beacbeac has shown you, the beacons that surfaced them, and when. Never uploaded — see "Stories You Have Found" below.

Usage Data

  • Story views: When a story is delivered to a visitor we record the beacon, the story, a randomly generated session identifier that is discarded when the app closes, the platform, and the time. There is no identifier tying a session to a person or a device.
  • Error logs: Technical information when errors occur, including diagnostic traces sent to our error-monitoring provider (see Third-Party Services)

Website Analytics

On beacbeac.com only — not in the app — we use Google Analytics to count page views and a small number of actions (following an app-store link, opening the web dashboard, sending the contact form) so we can tell which parts of the site are useful.

It is configured without cookies. It stores nothing on your device, sets no identifier that persists after you close the tab, and cannot recognise you when you return or follow you to other sites. That is also why this site shows no cookie banner: there is nothing to ask you to consent to. Your IP address is anonymised before processing.

Contact Form

When you send a message through the contact form on beacbeac.com, we collect your name and email address and, if you give them, your organization, the type of space, what you would like to talk about, and your message. We use them only to reply to you and follow up on your enquiry. Your IP address is used to limit repeated submissions and is not saved with your message.

How We Use Your Information

We use the collected information for the following purposes:

  • Beacon Management: To scan, identify, and manage Bluetooth beacons near artworks
  • Artwork Association: To link beacons with artwork metadata and information
  • Multi-tenant Support: To ensure data is properly isolated between different institutions
  • Service Improvement: To improve app functionality and user experience
  • Error Resolution: To diagnose and fix technical issues

Data Storage and Security

  • Story content, beacon records, staff profiles, story views and contact-form messages are stored in Cloud Firestore, and the images, audio and video you upload are stored in Cloud Storage. Both are Google Cloud services, hosted in Canada (see International Data Transfers)
  • Staff accounts are handled by Firebase Authentication, which stores passwords only in hashed form
  • The database is backed up nightly to a separate Google Cloud project in Canada, and each backup is permanently deleted within 30 days of being made
  • Our servers keep operational logs of the requests made to them, including the requesting IP address, for 30 days, in Canada. The requests the app makes to record a story view are left out of these logs, so a story view is never logged alongside an IP address
  • Data is encrypted in transit using TLS/HTTPS, and at rest by Google Cloud
  • Access to data is restricted by user authentication and authorization rules
  • We implement role-based access control to protect sensitive information

Data Sharing

We do not sell or rent your personal information, and we do not share it with third parties for their own purposes.Your data is used solely to provide and improve beacbeac. The only external parties who process any of it are the service providers listed below, acting on our instructions.

Third-Party Services

We use the following third-party services to provide app functionality:

These services have their own privacy policies and data handling practices.

Your Rights

You have the right to:

  • Access your data: Request a copy of your personal information
  • Update your data: Modify your account information at any time
  • Delete your account: Request deletion of your account and associated data
  • Opt-out: Disable optional features like location-based services

To exercise these rights, please contact us at the support email below.

Location Permissions

beacbeac requires location permissions to scan for Bluetooth beacons. This is a system requirement on both iOS and Android platforms for Bluetooth Low Energy (BLE) functionality. We do not track your location or store location coordinates.

Background Detection

If you choose to turn on background detection, beacbeac can find stories while your phone is locked or in your pocket, and will send you a notification when it does. This is optional, and the app explains what it does and what declining costs you before any system permission prompt appears. You can turn it off at any time in your device settings; the app will keep working, but will only find stories while it is open on screen.

On iOS this requires "Always" location access, because Apple classifies beacon detection as a location service. It does not mean beacbeac learns where you are: we receive the identifier of a nearby beacon, not a position, and we do not record, store, or transmit your location either way. On Android beacbeac asks for location access only while the app is in use and never asks for background location access; to keep listening while your phone is locked, it shows an ongoing notification, which you can stop at any time.

An exploring session ends when you leave the Explore screen, stop it from the notification, or go two hours without finding anything, so it will not run overnight.

Stories You Have Found

beacbeac keeps a list of the stories it has shown you, so you can look back at one from a room you have already left. Each entry records the story, the beacon that surfaced it, the space, and the time.

This list never leaves your device. It is not uploaded, not attached to any account, and not shared with the spaces you visit or with anyone else. It holds the last 14 days, up to 500 entries, dropping the oldest first, and you can clear it from within the app at any time. Uninstalling beacbeac deletes it.

Bluetooth Permissions

The app requires Bluetooth permissions to:

  • Scan for nearby beacons
  • Read beacon identifiers and signal strength
  • Enable beacon-based features

Camera and Photo Library Permissions

Camera and photo library access is used solely to:

  • Take photos of artworks
  • Select photos from your library
  • Upload images for artwork documentation

Photos are only uploaded when you explicitly choose to do so.

Children's Privacy

beacbeac is designed for professional use by museum and gallery staff. The app is not directed at children under 13 years of age. We do not knowingly collect information from children.

Data Retention

  • Account data: Retained while your account is active
  • Beacon data: Retained for operational purposes
  • Contact-form messages: Kept as long as we need them to reply to you and follow up on your enquiry; you can ask us to delete yours at any time
  • Usage logs: Retained for up to 90 days for troubleshooting
  • Deleted accounts: Data is permanently deleted within 30 days of account deletion request, including from backups. The audit records of staff account changes described under International Data Transfers are kept by Google Cloud for 400 days

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify users of any material changes by:

  • Updating the "Last Updated" date
  • Providing in-app notification
  • Sending email notification to registered users

International Data Transfers

beacbeac's database, the media you upload (images, audio and video), our server functions and our backups are hosted by Google Cloud in Canada, in its Toronto region, with two scheduled maintenance jobs in its Montréal region. That includes the story views described under Usage Data and messages sent through our website's contact form.

Some of the services we use process data outside Canada:

  • Account sign-in: Firebase Authentication, which Google runs only in the United States, holds the email address, display name, securely hashed password and sign-in times of staff accounts. Google Cloud also keeps an audit record of changes to staff accounts, including the email address and display name, for 400 days, in storage that is not restricted to Canada. Visitors do not have accounts.
  • Error monitoring: Sentry receives the error and performance reports described under Usage Data, in the United States. It is configured not to attach names, email addresses or accounts to them, and not to store IP addresses.
  • AI descriptions: when a staff member asks for an AI-generated description, the selected image is sent to Google Gemini, which may process it in any country where Google has facilities. Google does not use it to improve its products, and keeps it only for a limited time to detect misuse.
  • Email: contact-form messages are also delivered to our Google Workspace inbox, which is not restricted to Canada.
  • Website analytics: Google Analytics, on beacbeac.com only, as described under Website Analytics.

Information processed outside Canada is subject to the laws of the country where it is processed, and may be accessible to that country's courts, law enforcement and national security authorities.

Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), our legal basis for processing your personal information includes:

  • Consent: You have given explicit consent for specific purposes
  • Contract: Processing is necessary for the service you requested
  • Legitimate Interest: Processing is necessary for our legitimate business interests

Your GDPR Rights

If you are in the EEA, you have additional rights under GDPR:

  • Right to be informed
  • Right of access
  • Right to rectification
  • Right to erasure
  • Right to restrict processing
  • Right to data portability
  • Right to object
  • Rights related to automated decision-making

California Privacy Rights (CCPA)

California residents have additional rights under the California Consumer Privacy Act (CCPA):

  • Right to know what personal information is collected
  • Right to know if personal information is sold or disclosed
  • Right to say no to the sale of personal information
  • Right to access personal information
  • Right to equal service and price

Note: beacbeac does not sell personal information.

Compliance

beacbeac complies with:

  • General Data Protection Regulation (GDPR)
  • California Consumer Privacy Act (CCPA)
  • Apple App Store Guidelines
  • Google Play Store Policies

beacbeac by BluHeron Interactive

This privacy policy is effective as of September 22, 2026.