Studio Archive Pro Privacy Policy
Last updated: 12 October 2026
Who we are
Studio Archive Pro is made by Drew Rane, a sole proprietor based in New York, USA. For privacy questions, write to privacy@carlsonartphotography.com. We are the data controller for the information described below.
A postal address is available on request to anyone who needs one to exercise their rights.
The short version
Your archive lives on your own devices. We only receive a copy if you turn on sync, and even then we never receive your full-resolution photographs. We do not track you, we run no analytics, we show no advertising, and we never see your payment details.
What we collect
Only if you create an account for sync. Using the app without an account sends us nothing at all.
Your account
- Email address
- A password, stored only as a cryptographic hash. We cannot read it.
Your archive, if sync is on
Sync uploads a copy of your catalogue. Because a working artist’s catalogue is also a business record, this can include:
- artwork records: titles, dates, media, dimensions, condition, location
- prices, including retail, wholesale and sold prices
- your sales history: what sold, when, for how much (only if you turn on “Also sync contacts and sales”; it is off unless you do)
- contacts you have entered: names, email addresses, phone numbers, cities and countries for collectors, galleries, curators and other people you work with (also only if you turn on that setting)
- consignment and loan records, including gallery names and commission terms
- provenance: the ownership history of a work, which may name collectors
- your artist profile: legal name, display name, biography, contact details
- display-resolution copies of your photographs (about 2048 pixels)
Technical information
Our hosting provider processes the IP address and timestamp of requests to operate the service and to rate-limit abuse.
What we never collect
- Your full-resolution original photographs. These never leave your device.
- Payment details. Apple processes all payments. We never see a card number.
- Analytics, tracking, advertising identifiers, or device fingerprints. There are none in the app, and no third-party SDKs of any kind.
- Your location, contacts, calendar, or anything else on your device beyond the archive folder you choose and the photographs you pick to add.
About other people’s details in your archive
Your contacts, sales and provenance records may contain information about other people, such as a collector’s address or a curator’s phone number.
For that information you are the controller: you decide what to record and why. We process it only to provide sync to you, on your instructions, and for no other purpose. We do not contact those people, market to them, or use their details for anything else.
If someone whose details appear in your archive asks us to remove them, we will refer them to you, because we cannot tell whose archive they appear in without searching your records, and we would rather not do that.
Why we process it, and on what basis
| What | Why | Lawful basis (UK/EU GDPR) |
|---|---|---|
| Email and password | To create your account and sign you in | Performance of a contract |
| Your archive copy | To sync your work between your devices | Performance of a contract |
| IP address, timestamps | To operate the service and prevent abuse | Legitimate interests |
We do not use your data for marketing, profiling or automated decision-making of any kind.
Who else touches it
- Supabase Inc., our hosting and database provider, acting as our processor under a data processing agreement. Servers are in the United States (
us-east-1). - Apple, for the sale itself. Apple’s own privacy policy applies to that.
We do not sell your data, share it for advertising, or disclose it to anyone else except where required by law.
International transfers
We are based in the United States, and our hosting provider’s servers are there too. If you are in the UK or EEA, that means your data is handled outside your own country.
Where we pass your data to our hosting provider, that transfer is governed by the Standard Contractual Clauses approved by the European Commission, together with the UK Addendum approved by the Information Commissioner’s Office. These form part of our agreement with them.
We do not rely on the EU-US Data Privacy Framework.
How long we keep it
While your account exists.
You can close your account from inside the app at any time, with Close Account on the Account page: under More on the Mac, under Records on the iPhone, and in the sidebar on the iPad. That deletes the stored images, every revision of your archive, and your account record itself. It is immediate, and it is not reversible.
Nothing on your own devices is touched. Your archive folder, your original photographs and every record stay exactly where they are, and the app continues to work without an account.
Your rights
You may ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or receive it in a portable format. Write to privacy@carlsonartphotography.com.
In practice most of these are already in your hands: the app exports everything at any time, and your archive folder is readable without us.
You may complain to your data protection authority. In the UK, that is the Information Commissioner’s Office.
Security
Passwords are hashed. Traffic is encrypted in transit. Access to your archive is enforced at the database level, so one account cannot read another’s, and the storage bucket is private.
No system is perfectly secure. Because your archive also lives on your own devices, a failure on our side would not deprive you of your work.
Children
The app is not directed at children under 16, and we do not knowingly collect their data.
Changes
We will post changes here and update the date above.