Privacy notice
Version of 12 October 2026
This notice explains what the school collects, why, where it goes and what you can do about it. It covers this website and the lessons inside it.
Who is responsible
The controller of your personal data is Analog Signature, a Mindfullens studio. For anything in this notice, write to hello@analogsignature.com.
What we collect and why
- Your first name and email address, when you start the school. We use them to give you access and, with your consent, to send you progress tips and school updates.
- The licence key from your Gumroad receipt, when the school is sold through Gumroad. We send it to Gumroad once to check that it is valid. We do not keep the key on our server; your browser keeps an access key that lasts one year.
- Your name, email address and the camera you use, if you write to us through a contact form, together with a record that you agreed to be contacted and when.
- The photos and texts you send for a critique, with the lesson they belong to and a few measurements your browser makes (brightness, contrast, edge density, focal length).
- Your IP address, which every website receives. We use it to limit how many requests one person can make.
Your photos and texts
Before a photo leaves your device, your browser resizes it to at most 1024 pixels and saves it again as a JPEG. This drops the camera metadata stored in the file, such as location. The focal length and the camera software are read on your device only.
Object detection runs in your browser. The detection model is downloaded from Google’s storage servers, but your photo stays on your device for this step.
To write the critique, our server sends your photo or text, with the lesson brief, to Claude, a model run by Anthropic. When you try a written lesson or a series again, your last result and two of the critic’s notes go with it, so the critique can measure your progress. Our server does not save your photos or your text. Its logs record only the size of each request in tokens, the path and lesson code and the number of files.
Under Anthropic’s commercial terms, data sent through its API is not used to train its models. Anthropic keeps it for a limited time under those terms to run and secure the service.
Who else receives it
- Anthropic, to write the critique.
- Gumroad, to check your licence key. Your purchase itself is covered by Gumroad’s own privacy policy.
- Our hosting provider, which runs the website and keeps short technical logs of requests.
- The service we use to keep our list of students and enquiries, which receives your name, email address and consent record.
We do not sell your data and we do not share it for advertising. Some of these providers are based outside the UK and the EU; where your data travels, the transfer is covered by the safeguards the law requires, such as standard contractual clauses.
What stays in your browser
Most of the school lives on your device, not on our server. Your browser keeps:
- your progress, chosen path, points, quiz results, review dates and checklists;
- a copy of each photo, text card or contact sheet you submitted, so your reports can show it (IndexedDB);
- a short history of your attempts per lesson: date, result, score and short notes from the critic, without images;
- the last text you sent for each written lesson, so the same text is not sent twice;
- your first name, email address and access key, your language, your favourite film recipes and a daily upload count.
The site sets no cookies and uses no analytics or advertising trackers.
How to delete what your browser keeps
On your dashboard, press Change path, then Confirm reset. This clears your progress, saved reports, the images stored in this browser and your attempt history.
Your name, email address, access key, language and favourite recipes stay until you clear this site’s data in your browser settings, which removes everything at once.
Our legal basis
- Running the school and writing your critiques: to provide the service you asked for (contract).
- Emails about the school and replies to your enquiry: your consent, which you can withdraw at any time by writing to us.
- Request limits and security logs: our legitimate interest in keeping the service available and safe.
How long we keep it
- Photos and texts: not stored by our server at all.
- IP addresses and request counts for limits: in the server’s memory for at most 24 hours.
- Your name, email address and consent record: while you use the school, or until you withdraw consent or ask us to delete them.
Your rights
Under the UK GDPR and the EU GDPR you can ask us for a copy of your data, ask us to correct or delete it, ask us to restrict or stop using it, object to how we use it, and take it with you. Write to hello@analogsignature.com; we answer within one month.
If you are not happy with our answer, you can complain to the Information Commissioner’s Office in the UK, or to the data protection authority where you live or work.
Changes
When this notice changes, the date at the top changes with it.