Privacy Policy

Effective date: 1 September 2026

This policy explains what personal data Shubham Dubey, an individual developer ("Wallscape," "we," "us"), collects when you use the Wallscape mobile app and its backend services, how we use it, and the choices you have. Wallscape is a wallpaper discovery app; it is designed to collect only what the features below need.

1. Data We Collect

Account and profile data (you provide it):

• Email address — used to create and sign in to your account, and to send you sign-in verification codes.
• Name — shown in your profile; editable in Settings.
• Age, gender, and favorite topics — collected once during onboarding to personalize your experience. Gender offers a "prefer not to say" option. The app requires an age of at least 13.

Activity data (created as you use the app):

• Wallpapers you save and boards you create (including board names), with timestamps. Boards and saves are private to your account and are never shown to other users.

Technical data (collected automatically):

• Our server keeps standard web request logs that include your IP address, the endpoint requested, and your device's user-agent string. We use these logs for operations, debugging, and abuse prevention (rate limiting is keyed on IP address).
• When you sign in with an email code, we store a one-way hash of the code (never the code itself) for up to 10 minutes, plus a count of failed attempts.
• If you sign up with a password, we store only a bcrypt hash of it, never the password itself.

Data we do NOT collect: The app contains no analytics or advertising SDKs, no crash-reporting service, no location tracking, and no access to your contacts, camera, or existing photos. There are no payments, so we never handle payment data. We do not sell or rent personal data to anyone.

2. Data Stored Only on Your Device

Some data never leaves your device:

• Your sign-in token, kept in the operating system's secure storage (Keychain/Keystore via Expo SecureStore). Signing out deletes it.
• Your theme preference (system/dark/light), kept in local app storage.
• Wallpapers you download, saved to your photo library. The app requests write-only photo permission: it can add images you download but cannot read, view, or modify your existing photos.

3. How We Use Your Data

• To operate your account: authentication, session management, and sending sign-in verification codes to your email.
• To provide features: your saved wallpapers, boards, and profile.
• To personalize: your favorite topics inform which wallpaper topics the app surfaces.
• To protect the Service: request logs and IP-based rate limits defend against abuse, credential-stuffing, and brute-force attacks on verification codes.

We do not use your data for advertising or profiling beyond the in-app topic personalization described above, and we do not make automated decisions with legal or similarly significant effects about you.

4. Who Receives Your Data

We share personal data only with the service providers that run Wallscape:

• Resend (resend.com) — receives your email address to deliver sign-in verification codes on our behalf.
• Supabase — hosts our PostgreSQL database, where account, profile, and activity data are stored, in the Singapore (AWS ap-southeast-1) region.
• Render — hosts our API server, which processes all requests and holds the request logs described above, in the Oregon, United States (Render US West) region.
• Wallhaven (wallhaven.cc) — wallpaper images are loaded by the app directly from Wallhaven's servers. When images load, Wallhaven receives your device's IP address and standard request metadata, as with any website you visit. We do not send Wallhaven your account information. Wallhaven's own privacy policy governs its processing.

We may also disclose data if required by law, or to protect the rights, safety, or security of Wallscape or others.

5. How We Protect Your Data

• All app-to-server traffic uses HTTPS in production.
• Passwords are stored as bcrypt hashes; sign-in codes are stored as SHA-256 hashes, expire after 10 minutes, and lock after 5 failed attempts.
• Sessions use signed tokens that expire after 30 days; on your device the token lives in OS secure storage.
• The API applies rate limiting, security headers, and input validation on every request.

No system is perfectly secure, and we cannot guarantee absolute security.

6. How Long We Keep Data

• Account, profile, boards, and saved-wallpaper data are kept until your account is deleted. Deleting your account removes your boards and saves with it.
• Sign-in code records expire after 10 minutes and are invalidated once used.
• Server request logs are retained per our hosting provider's log retention: 7 days.

7. Your Choices and Rights

• Edit: you can change your name in Settings at any time.
• Sign out: removes your session token from your device.
• Photo permission: you can revoke the photo-library permission in your device settings at any time; downloads will stop working until re-granted.
• Delete your account and data: use "Delete account" in Settings, or email us at [email protected] from your account email address. The app does not currently perform deletion automatically, so deletion is handled as a support request. We will delete your account and associated data within 30 days of a verified request.
• Access/export: we do not currently offer a self-service export; you may request a copy of your data via [email protected].

Wallscape is available worldwide. Depending on where you live, you may have additional legal rights over your personal data — for example under the GDPR (EEA/UK: access, correction, deletion, portability, objection, and the right to complain to a supervisory authority), the CCPA/CPRA (California: to know, delete, correct, and not be discriminated against for exercising your rights; we do not sell or share personal information as those laws define it), or India's Digital Personal Data Protection Act. Contact us at [email protected] to exercise any of these rights and we will respond as the applicable law requires.

8. Children

The Service is not directed to children under 13, and onboarding does not accept ages under 13. If you believe a child under 13 has created an account, contact us at [email protected] and we will delete it.

9. International Transfers

Wallscape is operated from India. Our database is hosted in Singapore (AWS ap-southeast-1) and our API server in Oregon, United States (Render US West). Wherever you use Wallscape from, your data will be transferred to and processed in those locations. Our hosting and email providers are established in the United States.

10. Changes to This Policy

We may update this policy as the app evolves. For material changes we will notify you (for example, by email or an in-app notice) before they take effect. The effective date above always reflects the current version.

11. Contact

Privacy questions or requests: [email protected]

Data controller: Shubham Dubey