Patine identifies antiques and collectibles from photographs and shows what comparable items have sold for. This policy says exactly what leaves your phone, what we keep, and for how long. It describes the app as it actually behaves; where something is not collected, it says so plainly rather than leaving it out.
The short version
- No account. There is no sign-up, no email address and no password anywhere in Patine.
- Your collection stays on your device. Items, photographs, notes and prices are stored locally and are not uploaded to us.
- Photographs you scan are sent for identification, and are not kept. They are passed to our identification service and to Anthropic's Claude model, and are not stored afterwards.
- We do not sell data, and there is no advertising or tracking in the app.
What is sent when you scan
When you scan an object, the app sends to our server (a Cloudflare Worker):
| What | Why | Kept? |
|---|---|---|
| The photographs of the object (JPEG) | To identify it | No — processed and discarded |
| The category, asking price and locale you supplied, if any | To shape the answer | No |
| An Apple App Attest assertion | To prove the request came from a genuine copy of Patine | Key identifier and a counter, see below |
The photographs are forwarded to Anthropic (the maker of the Claude model) for identification. Anthropic processes them to produce the response and, under our API terms, does not use them to train models. We do not write them to disk on our side and we do not keep them after the response is returned.
To show what similar items have sold for, the app also queries our comparable-sales index and eBay's Browse API using a short text description of the object — never your photograph. eBay receives that search text and nothing about you.
App Attest, and the install label
Identifying an object costs us real money, so the app proves it is a genuine copy of Patine before we spend it. iOS does this with App Attest: your device creates a key in its Secure Enclave and signs each request. We store that key's public identifier and a counter, so a copied request cannot be replayed.
From that key identifier we derive a short install label — the first eight bytes of its hash. It is not your Apple ID, your device identifier or your advertising identifier, it cannot be reversed into anything about you, and deleting and reinstalling the app produces a new one. It exists to apply the rate limits that stop one installation making thousands of paid requests, and to measure how many scans a typical installation performs so the price can be set from arithmetic rather than a guess.
It appears in our request logs, which our hosting provider (Cloudflare) retains for a short window measured in days and then deletes.
Your free scans
The count of free scans you have used is stored in your device's Keychain. It stays there if you delete and reinstall the app, which is why three free scans are three free scans. It never leaves your device.
Corrections
If you tell us a result is wrong ("This isn't right"), the app queues the field you corrected, the original value and your correction, and sends them to us. They are used to measure and improve accuracy. Corrections carry no photograph and nothing that identifies you. If you never use that button, nothing is ever sent.
Purchases
Subscriptions are handled entirely by Apple. Patine never sees or receives your payment details, your card, or your Apple ID. We ask StoreKit whether a subscription is active; that answer stays on your device.
Analytics
Patine ships with no third-party analytics SDK — no Firebase, no Amplitude, no Facebook SDK, nothing of that kind. Events such as "a scan completed" are written to the device console during development and are not transmitted from released builds.
Our server records ordinary request logs — timestamp, endpoint, response status, model cost, the install label above — to run the service and watch what it costs. Cloudflare retains them for a short window measured in days and then deletes them.
Photographs on your device
Photographs you capture or import are stored in the app's private Application Support directory. Other apps cannot read them. Deleting an item deletes its photographs; deleting Patine deletes all of them.
Patine asks for camera access when you first open the camera, and for photo library access only when you choose to import. Both are optional and both can be revoked in iOS Settings — the app keeps working with whichever one you allow.
This website
getpatine.com is the same policy's other surface, so it is described here rather than in a
second document. The site runs no JavaScript at all. It sets no cookies, has no
analytics, no tracking pixels, no third-party fonts and no embedded scripts — your browser
talks to Cloudflare and to nobody else. Cloudflare's ordinary request logs apply, as they do
for any site on the internet.
Children
Patine is not directed at children and collects nothing from them. There is no account, no profile and no social feature of any kind.
Your rights
Because there is no account, we hold almost nothing that could be about you. If you would like to ask what is held, or have the App Attest key identifier for your installation deleted, write to info@getpatine.com and we will do it. Deleting and reinstalling the app has the same effect: the old key is abandoned and a new one is created. To delete everything held on your device, delete the app.
Where data is processed
Requests are handled by Cloudflare's global network and may be processed in any of its locations, including outside your own country. Identification is performed by Anthropic in the United States. Comparable-sales data and thumbnails are stored on Cloudflare in Europe and the United States.
Changes
If this policy changes we will update the date at the top and, where the change is significant, say so in the app before it takes effect.
Contact
Patine is made by [legal entity and registered address to be inserted before launch].