Privacy Policy

Effective date: April 25, 2026 · Last updated: May 8, 2026

This Privacy Policy explains how Authos LLC ("Authos," "we," "us," or "our") collects, uses, stores, and protects information in connection with the Text the Past text-message service (the "Service"). The Service is operated under the brand "Text the Past" by Authos LLC, a Georgia limited liability company.

1. Information We Collect

When you use the Service, we receive the following categories of information from your mobile carrier and your message:

• Mobile phone number — the number you text from, used solely to deliver the response back to your device.
• Message content — the text and any photos you send, used to identify the artifact and generate a relevant response.
• Carrier metadata — standard information your carrier supplies with each message (timestamp, message identifier, carrier name).

We do not collect your name, email address, location data, or any information beyond what is contained in your inbound message.

2. How We Use Your Information

• To match the photo you sent to an artifact in the participating museum's curated archive.
• To generate and deliver an AI-authored response. The response is grounded in the museum's curated historical text (the artifact records the museum's curator has uploaded), the photo you sent (if any), and broader general historical, cultural, and technical context from the AI service provider's training data. When the museum's curated text does not fully address your specific question, the AI is instructed to supplement with general context that remains consistent with the museum's record (era, region, type) rather than refuse to answer. The AI is instructed not to fabricate specific facts (model numbers, dates, locations) that are not supported by either the museum's text or the photo's visible content. We do not represent that any response is exclusively drawn from the museum's curated text or that any response is free of error; you should treat AI-authored responses as conversational, not authoritative.
• To produce aggregate, de-identified usage metrics (total messages per museum, unique sender count) for participating museums and their sponsors. These metrics never include your phone number or message content.
• To produce short, paraphrased example questions for inclusion in monthly reports to participating museums and their sponsors. Each example is generated by an automated anonymization pipeline that removes all personal identifiers (names, locations, dates, ages, contact information, family or relationship references, and any health, religious, political, racial, or sexual-orientation content) before any sponsor sees it. We do not share verbatim message content with sponsors. See "Sponsor Reports" below for details.
• To respond to opt-out requests, help requests, and abuse reports.

3. How We Store Your Information

To minimize the personal data we hold, we hash your phone number using HMAC-SHA256 with a secret key before storing it. The unhashed phone number exists only in volatile memory during the brief processing of your message and is not written to any database or log. Message content (the text and a reference to your photo) is retained for up to 90 days for service-quality purposes and then automatically deleted.

4. Information Sharing — Mandatory SMS Disclosure

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All categories of information described in this Privacy Policy exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

We work with the following service providers strictly to operate the Service. Each is bound by contractual data-protection obligations:

• Twilio Inc. — carrier-grade messaging delivery (transports your message between your phone and our servers).
• Google LLC — AI processing (generates the response, grounded primarily in the museum's curated text and your photo, with broader general context from the AI provider's training data added when a question goes deeper).
• Supabase Inc. — secure database hosting (stores the museum's curated artifact archive and the hashed phone number).
• Google Cloud Platform — application hosting and infrastructure.

We do not sell, rent, lease, or trade your personal information. We will disclose information only when required by law, valid legal process, or to protect the rights, property, or safety of Authos, our users, or the public.

5. Sponsor Reports (Anonymized Examples)

Each month, Authos LLC sends every active museum sponsor a written report covering the previous calendar month at the participating museum. Each report contains the following categories of information, and only these:

• Aggregate usage metrics — the total number of replies the Service sent during the period (which we describe in the report as "impressions"), the cumulative count of those replies since the sponsor's activation date ("year-to-date impressions"), the period-over-period change in monthly replies (e.g. up or down by N versus the prior month), and the sponsor's anniversary milestone within the sponsorship (e.g. "Month 3"). None of these numbers identifies any individual visitor.
• Most-asked-about artifacts — the titles of the three artifacts that received the most inbound visitor questions during the period, and the count of inbound questions for each. We disclose only the title that the museum has assigned to each artifact; we do not disclose any visitor's text, phone number, or other identifying information in connection with this list.
• One reference image of the most-asked-about artifact — a small (no greater than 600 by 600 pixels) photograph of the period's most-asked-about artifact, drawn from the museum's own curated artifact archive and reproduced solely within the sponsor's report.
• Up to three paraphrased example questions — short examples illustrating the kinds of curiosity visitors are showing, generated entirely by an automated anonymization pipeline.

The example questions are produced as follows:

• Each example is paraphrased into a third-person form. No example is a verbatim quotation of any visitor's message.
• Each example is stripped of all names, locations (other than the participating museum and named artifacts in its collection), dates, ages, phone numbers, email addresses, mailing addresses, family or relationship references, and any health, religious, political, racial, or sexual-orientation content.
• Each example is capped at approximately 90 characters.
• A secondary pattern-based filter is applied as defense in depth; any example that still appears to contain a personal identifier is discarded before the report is sent.

If the anonymization pipeline cannot produce a fully anonymized example for a given month, the section is omitted from that month's report. We do not provide sponsors with raw or unredacted message content under any circumstances. Sponsors never receive your phone number, the verbatim text of your messages, your photos, or any information that would allow you to be identified.

6. Your Choices and Rights

• Opt out: Reply STOP to any message from our number. Your number will be added to our suppression list and you will receive no further messages.
• Resume: Reply START or UNSTOP to opt back in.
• Help: Reply HELP at any time to receive support information.
• Data deletion: Email [email protected] from the device that sent the messages and we will delete any retained message content associated with your number within 30 days.

7. Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect information from children under 13. If you believe a child under 13 has used the Service, please contact [email protected] and we will promptly delete any associated data. Children between 13 and 18 should use the Service only with the consent of a parent or legal guardian.

8. California Residents (CCPA / CPRA)

California residents have the right to (a) know what personal information we collect, (b) request deletion, (c) opt out of any "sale" or "sharing" of personal information (we do not sell or share personal information as those terms are defined under California law), and (d) be free from retaliation for exercising any of these rights. To exercise any right, contact [email protected].

9. Security

We use commercially reasonable safeguards to protect your information, including HMAC hashing of phone numbers at rest, TLS encryption in transit, signed-and-validated webhook callbacks, and least-privilege access controls. No method of transmission over the internet or method of electronic storage is 100% secure, however, and we cannot guarantee absolute security.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The "Effective date" at the top of this page reflects the latest version. Material changes will be communicated via this page; continued use of the Service after a change constitutes acceptance.

11. Contact Us