Menu
Contact

Legal

Privacy policy

Obscura Catalog privacy policy: data processed by the website and the app.

ContentsSupport

In short

Obscura Catalog sells no data and contains no advertising, no analytics and no automatic crash reporting. Your files, your library and your catalogue stay on your Mac: Oorun has no access to them. Photo analysis (objects, text, faces, similarity) runs on the Mac, with Apple’s Vision framework, and its results stay in the library. The only data Oorun receives from the app is that of your account and your license, described below. The website, for its part, measures its traffic without cookies (see “Website audience measurement”).

Account and license

To activate a license, you sign in with the e-mail address and password of your Obscura account. Obscura Catalog then talks to Oorun’s license server (api.obscuraflow.app):

  • when you sign in: your e-mail address and password; “Forgot Password?” sends your e-mail address to receive a reset link;
  • when this Mac is registered for the license: an identifier specific to this installation (drawn at random), the name of this Mac, the platform (macos), the version of Obscura Catalog, a one-way fingerprint (SHA-256) of the Mac’s hardware identifier — the identifier itself never leaves the Mac — and the product concerned (obscura-catalog);
  • at launch, when the network comes back and when you choose “Check Now”: a request for the current license, your limits and your list of devices, again with this Mac’s information described above (including the name of this Mac and the version of Obscura Catalog);
  • when you remove a device: that device’s identifier.

For each device, Oorun sees the version of Obscura Catalog and the date of the last check, to support you and to know which devices need updating.

These exchanges send no file, no image, no file fingerprint and no content of your catalogue: the number of your works is counted on the Mac. The signed license returned by the server is kept in the library’s License folder, so that it can be verified offline.

Oorun processes this data to manage your account and your license. This processing is based on the performance of the license agreement (or of pre-contractual steps taken at your request) and on Oorun’s legal obligations.

  • Hosting: the license server is hosted by Oracle Cloud Infrastructure (Oracle Corporation, 2300 Oracle Way, Austin, Texas 78741, United States) and reached through the network of Cloudflare, Inc. (101 Townsend Street, San Francisco, California 94107, United States). Where data is transferred outside the European Union, the transfer is covered by appropriate safeguards (the European Commission’s standard contractual clauses or an applicable adequacy framework).
  • Retention: account and device data are kept for as long as your account exists. They are deleted when the account is closed; a device you remove is erased at once.
  • Your rights: under the GDPR and the French Data Protection Act, you can ask for access to, rectification, erasure, restriction or portability of your data, and object to its processing. Write to mtay@oorun.fr stating your request and your account’s email address; you will get an answer within the legal time limits. You can also lodge a complaint with the CNIL (www.cnil.fr) if you believe your rights are not respected.

Without an account, Obscura Catalog never contacts the license server.

Update check

At launch, then at regular intervals, Obscura Catalog downloads the list of published versions (an appcast.xml file) from GitHub (github.com, a service of GitHub, Inc.; repository ctay/obscura-catalog-releases), then, if you agree to install a new version, its disk image. Like any Internet request, it gives GitHub your Mac’s IP address and a technical header (name and version of the app and of the Sparkle component). It sends no content of your library, no identifier of your Mac or of your account, and no system profile. GitHub processes this data under its own privacy statement (https://docs.github.com/site-policy/privacy-policies/github-general-privacy-statement); Oorun has no access to it.

An update is only installed with your consent, once its signature has been verified. You can turn off automatic checks in Settings › Updates (“Automatically Check for Updates”): Obscura Catalog › Check for Updates… then only checks when you choose it. A copy that is not the published, signed and notarized release makes no check.

Services you configure

  • Certificate timestamping: if you enter a timestamp authority (RFC 3161, optional, empty by default), Obscura Catalog sends it, at each issuance, the SHA-256 fingerprint of the certificate’s signature, and nothing else. Without an authority, issuing makes no connection.
  • Publishing your key: the public key of the certificates is published by you, at the address you choose. Obscura Catalog prepares the file (Export the public key…) but sends it nowhere.

Verifying a certificate in the app happens offline.

The website

The catalog.obscuraflow.app website is hosted by Cloudflare (Cloudflare Pages).

Contact form

The fields you fill in on the contact form reach us by email through Resend, an email delivery service. They are not stored in any database of the website and are used only to reply to you.

To slow down automated submissions, the website counts messages per IP address: it stores only the SHA-256 hash of that address, deleted after two hours at most, at Cloudflare.

Online certificate verification

The website’s verification page (/en/c) reads the PDF in your browser, without sending it; the check makes at most two requests: the first fetches the issuer’s public key from the address signed in the certificate; the second queries the Obscura key directory (keys.obscuraflow.app, run by Oorun), which provides the key if that address does not and says whether it has been revoked, sending it only the key fingerprint, which is public. As on every page of the website, the audience measurement script described below may load there: it sends Cloudflare the page address, and so the certificate number it carries, but never the PDF or the result of the check. The signed address is chosen by the issuer: its host receives, like the directory and as with any Internet request, your browser’s IP address.

Website audience measurement

The website measures its traffic and performance with Cloudflare Web Analytics. It is not included by the website’s code: Cloudflare adds a script to the pages (beacon.min.js, loaded from static.cloudflareinsights.com), which sends its measurements to the website itself (address /cdn-cgi/rum). The application itself contains no analytics.

  • What is measured: the address of the page you view (without its parameters), the page you came from (referrer) and loading and rendering times (including Core Web Vitals). From these, Cloudflare derives the country, device type, browser and operating system, and counts page views and visits (a visit is a page reached from another website or through a direct link).
  • What is not: no cookie is set and nothing is stored in your browser (no local storage, session storage or IndexedDB). Cloudflare does not track you from one website to another and does not “fingerprint” you from your IP address, User-Agent header or any other data. Your IP address is discarded at the nearest Cloudflare data center and is stored neither in its databases nor in its logs.
  • Visitors from the European Union: the measurement is set to “lite” mode: for visitors connecting to a Cloudflare data center located in the European Union or the European Economic Area, the script is not added to the pages and no measurement is processed. The criterion is the data center that serves you, not your nationality or place of residence: when served by a data center located elsewhere, you are measured like other visitors.
  • Processor: Cloudflare, Inc. (101 Townsend Street, San Francisco, California 94107, United States) processes these measurements on Oorun’s behalf. Where a transfer outside the European Union takes place, it is covered by appropriate safeguards (European Commission standard contractual clauses or the applicable adequacy framework).
  • Retention: Cloudflare keeps the detailed measurements for 7 days, then keeps only a sample of about 10%; Oorun only sees statistics, available for the last six months.
  • Legal basis and objection: this processing is based on Oorun’s legitimate interest in knowing how its website is visited and improving its performance (Article 6(1)(f) GDPR). You can object to it by blocking the script from static.cloudflareinsights.com (content blocker or browser settings): the website works the same without it. You exercise your rights as described in the “Account and license” section.

Where your data lives

  • The library (Catalog.sqlite database, thumbnails and previews, signed license, catalogue raisonné and certificate settings, issued certificates) is saved on your Mac, in ~/Library/Application Support/Obscura Catalog/.
  • The certificate signing key and your account session are kept in your Mac’s keychain, services com.oorun.obscuracatalog.certificates and com.oorun.obscuracatalog.secrets.
  • The application settings are saved in the macOS preferences of your account.
  • Your images stay where they are: the library records their location without copying them.

Original files

When you import a folder, a Lightroom catalog or a CSV inventory, Obscura Catalog reads each file to compute its SHA-256 fingerprint, extract its metadata (EXIF, XMP) and make thumbnails and previews. It never moves your files, and it opens a Lightroom catalog read-only. When you save metadata, it writes an XMP sidecar next to the file by default; it only writes into the file itself (JPEG, TIFF, PNG, HEIC) if you choose and confirm it, never into a RAW. macOS may ask you to allow access to the Desktop, Documents or Downloads folders, or to external and network volumes.

Problem report

Help › Report a Problem… prepares a report (your description, the version of the app and of macOS, the Mac’s architecture) that you read, then save or copy. Obscura Catalog sends it to no one: you decide whether to attach it to the contact form at https://catalog.obscuraflow.app/en/contact.

Personal data in your catalogue

Your catalogue may contain personal data: agents (artists, rights holders, collectors, gallerists…), provenance, declarants and issuers of certificates, people you name in the People section, faces found by the analysis. You, or the organization on whose behalf you act, are their controller within the meaning of the GDPR: it is up to you to define their legal basis, retention period and conditions of access. Erase… (People section) deletes all analysis data, faces and named people included. The exports, reports and certificates you produce are files you manage and share: once given to third parties, they cannot be erased from the app.

Contact

For any question: see Oorun’s details in the legal notice.