Privacy policy for Minot family museum

Last updated: 12 September 2026.

The essentials

The first museum and its first fifty artworks can stay entirely on the iPhone, with no Minot account.
Sign in with Apple is required for Premium, cloud backup, the family gallery, AI restoration and print ordering.
A family gallery only exists when the parent creates one. A private link and a six-digit code protect it, and the parent can revoke it at any time.
Artwork is only sent to the AI provider or printer when the parent expressly asks for that operation.
Minot contains no advertising or advertising trackers and sells no personal data or family artwork.

Who is responsible

Minot is published by Teddy Verneuil, sole trader, 14 bis rue Magellan, 56860 Séné, France. Company number 792 687 576 00043. Contact: contact@lezbroz.com.

Teddy Verneuil is the controller for the processing described here under the General Data Protection Regulation (GDPR). Peecho is responsible for its own processing when you use its checkout to order a print.

What stays on the iPhone

Minot first stores museums locally: the child’s first name, optional birth date and portrait, artworks, titles and dates, prepared or restored versions, favourites, voice memories and settings. Print files are also composed on the iPhone.

Without a parent account and Premium backup, this data is not sent to Minot. It may be included in the iPhone backup depending on the person’s Apple settings. Deleting the app deletes local data; recovery then requires an earlier device backup or Minot archive.

The parent account and Apple

Minot uses Sign in with Apple. The server verifies Apple’s token and retains the app-specific technical identifier required to find the same family on another iPhone. Minot stores neither the Apple password nor the name or email found in the token.

Minot also retains internal account, family and session identifiers and the technical token used to attach an App Store purchase to the right account. Session tokens are stored in the iOS Keychain on the device.

Premium backup

When Premium backup is enabled, Minot synchronises the data needed to rebuild the museum: museum profile, child display name and optional birth date, optional portrait, artwork metadata, original, prepared or restored images, voice memories and a technical change log. The log contains identifiers, dates, versions and operations so interrupted transfers can resume without creating duplicates.

Content is encrypted in transit. Media is held in private Cloudflare storage and has no permanent public address. Premium storage is limited to 5 GiB per family.

The private family gallery

The parent may create a web gallery for one child’s museum. It shows the museum name, artworks, their titles, artist and dates. It does not show the portrait or full birth date. Voice memories are excluded unless the parent enables them.

Access requires both a random link and a six-digit code. Anyone holding both can visit the gallery, so they should only be sent to the intended relatives. After the code is entered, a strictly necessary security cookie valid for up to seven days avoids asking for it on every page. Replacing or revoking the invitation invalidates existing access.

AI museum restoration

When the parent starts a restoration, a copy of the prepared artwork has private metadata removed and is sent to Kie.ai (NEXUSAI SERVICES LLC, United States), which runs the image model. No portrait, voice memory, account name or birth date is sent with it.

Minot removes its temporary source copy from the relay after provider submission. Kie.ai states that temporary uploaded files are automatically deleted within no more than three days. Minot retrieves the result into private relay storage for up to seven days so the iPhone can download it, then removes it. The version kept in the museum follows the parent’s backup choice. The original remains separate for comparison.

Printing through Peecho

Minot creates the PDF on the iPhone, then sends it to private storage together with an order identifier, product, format, selected artwork identifiers and integrity hash. Peecho receives a signed, time-limited URL so it can print the file.

Payment and delivery take place on Peecho B.V.’s website, Herengracht 340, 1016 CG Amsterdam, the Netherlands. You enter your name, billing and delivery details and payment method directly there. Minot receives no card number. It receives the order identifier, status and, when available, the tracking number and URL displayed in the app. Peecho, its printers, payment provider and carriers process data required for the sale, production, delivery and support under Peecho’s privacy policy.

Purposes and legal bases

Contract: authenticate the parent, synchronise and recover the museum, apply Premium rights, publish the requested gallery, perform a restoration and prepare an order.
The parent’s voluntary action: grant photo, camera or microphone access, create a family share, send artwork to the AI or send a PDF to Peecho.
Legitimate interests: secure the service, prevent abuse, diagnose failures and protect the integrity of transfers and orders.
Legal obligation: retain records when the law requires them for a commercial operation.

Recipients and processing locations

Cloudflare, Inc. hosts Minot’s API, technical database and private files. Primary storage is configured in the European Union; the global network and some technical logs may involve processing in the United States or other countries under Cloudflare’s transfer safeguards.
Apple Inc. provides authentication and in-app purchases.
Kie.ai / NEXUSAI SERVICES LLC, in the United States, receives only artwork chosen for restoration and the technical generation parameters.
Peecho B.V., in the Netherlands, receives the print file and the details entered at checkout. Printers, payment providers and carriers may be used depending on the destination.
Invited relatives can access the data made visible by the parent in the family gallery.

Retention

Local data remains on the iPhone until it is deleted in Minot or the app is removed.
Premium data remains available during the subscription. After expiry, a thirty-day read and export period is planned; remote data becomes eligible for deletion after ninety days.
A family gallery remains active until its chosen expiry date or, for a durable link, until it is replaced or revoked.
Parent sessions expire after thirty days and gallery sessions after no more than seven days. Expired or revoked sessions and sign-in challenges are then purged.
Restoration files on Minot’s relay expire within seven days.
An unpaid print draft expires after twenty-four hours and a prepared checkout after thirty days; Minot then removes its PDF. After purchase, Peecho keeps the file as long as needed for production, delivery and possible reprinting under its own policy.
Support correspondence is kept as long as needed to answer and defend the parties’ rights.

Your rights and the child’s rights

You have rights of access, rectification, erasure, restriction, objection and portability under the GDPR. A parent may also exercise these rights for the child in their care.

The museum can be corrected, exported or deleted in the app.
The family gallery can be revoked in Settings.
“Delete account and remote data” immediately revokes access and starts deletion of the account, museums, media, voice, restorations, shares and print drafts kept by Minot. For accounts signed in with version 1.0 or later, the Sign in with Apple authorisation is also revoked. Automatic retries complete the operation if a service is temporarily unavailable. This does not cancel the Apple subscription or separately erase the local museum.
For any other request, email contact@lezbroz.com. A response is provided within the legal time limit, normally one month.

You may lodge a complaint with the French data protection authority at cnil.fr, or with your own national authority.

iPhone permissions and security

Photo access is used to select imported images, the camera to photograph artwork and the microphone to record a voice memory. iOS asks when each permission is needed. You can withdraw it in iPhone Settings, which disables the corresponding feature.

Traffic uses HTTPS. Sessions can be revoked, provider secrets stay on servers, private files cannot be listed and order URLs are signed and time-limited. Size, format and hash checks reject incomplete or altered transfers. No security can be absolute; a breach creating a risk to people’s rights will be handled under GDPR requirements.

Children

Minot is made for parents and legal guardians and is not a service offered directly to children. The adult creating a museum confirms that they are authorised to store, share, restore and, where relevant, print the content they add. They should minimise the information entered and carefully choose who receives family access.

Changes

This policy may change with the app or its providers. The date at the top prevails and any material change will be announced in Minot or on this page.