Privacy Notice

Last updated September 29, 2026

This notice explains what WallpaperMachine (“we”, “us”) collects on wallpapermachine.app, why, and what you can do about it. We collect as little as the site needs to work.

What we collect

• Account details. Your email address and, if you give one, your name. If you sign up with a password, we store only a salted hash of it, never the password itself. We email that address only to send you a link: one that verifies it after you sign up with a password (you need a verified address to buy), and one that resets your password when you ask. We store only a hash of each link, which stops working once used, after 24 hours (verification) or after an hour (password reset).
• GitHub details. If you sign in with GitHub, we receive your GitHub user ID, username, name and verified primary email address. We don't keep an access token to your GitHub account.
• Purchase details. When you buy, Paddle collects your payment details, email, name and country. We can see your order in Paddle, and we pass Paddle your account ID so the purchase is linked to you. Paddle then tells us when a purchase completes or is refunded, and we keep that record (order ID, Paddle customer ID, status and dates) with your account. We never see or store your card or bank details.
• Technical data. Your IP address is used briefly to limit repeated sign-in attempts and uploads, and to find your country so we can show local prices. Our host keeps short-lived request logs for security and troubleshooting.
• Support issues. If you are a Supporter, the issues and replies you write on the supporter forum are stored and shown to other Supporters under your sponsor-wall name, or your account name if you haven't chosen one. Your email address is never shown there. If your account is deleted, the text stays under that name. A maintainer can see your email on an accounts page in order to mute you, ban you, or delete the account. A ban signs you out and blocks sign-in. A mute stops new issues and replies. Deleting the account also removes a public sponsor listing.
• Sponsor wall. Off unless you turn it on in your account. If you are a Supporter and turn it on, the sponsor wall on the home page shows the name you choose, your picture and the month you became a Supporter. The picture is your initial on the app's colours, a picture you upload, or your GitHub or Gravatar picture. We fetch GitHub and Gravatar pictures ourselves and serve them from this site, so visitors never contact GitHub or Gravatar and your email address is never shown. To find your Gravatar we send Gravatar a hash of your email address, only when you choose it. The page also counts Supporters who aren't shown, without naming them. The sponsor list in the project README follows the same choice: it shows the same names, pictures and months as one picture of the wall served from this site, which GitHub displays through its own image service. A change reaches it within about an hour.

Cookies

We set two cookies, both strictly necessary: a sign-in cookie that keeps you signed in for up to 30 days, and a cookie that lasts ten minutes while you sign in with GitHub. We don't use advertising or tracking cookies. Paddle's checkout may set its own cookies to process payments and prevent fraud.

Who processes it

• Cloudflare hosts the site, stores account data and uploaded pictures, and provides privacy-focused, cookie-free visitor statistics.
• Paddle is our reseller and Merchant of Record. It processes payments and handles tax, receipts and refunds as an independent controller under the Paddle privacy notice.
• GitHub handles sign-in if you choose to sign in with GitHub, and supplies your GitHub picture if you choose it for the sponsor wall.
• Gravatar (Automattic) supplies your Gravatar picture if you choose it for the sponsor wall.
• Resend delivers the emails we send you, from noreply@wallpapermachine.app.

These providers may process data outside your country. We don't sell your data or share it with advertisers.

Why we use it

We use your data to run your account, to deliver what you bought (including support and, if you turn it on, the sponsor wall), to keep the site secure, and to meet legal obligations. The legal bases are performing our agreement with you, our legitimate interest in running a secure service, and legal obligations. The sponsor wall relies on your consent, which you withdraw by turning it off.

How long we keep it

Account data is kept until you delete your account. Sign-in sessions end after 30 days or when you sign out. An uploaded picture is deleted when you remove or replace it. We keep the purchase record Paddle sends us for as long as your account exists; Paddle keeps transaction records for as long as tax and accounting law require.

Your rights

You can turn the sponsor wall off, change your name on it or remove your picture at any time in your account. You can also ask for a copy of your data, ask us to correct it, or ask us to delete your account. Depending on where you live, you may also object to or restrict some uses and complain to a data protection authority. Email support@wallpapermachine.app and we'll reply within 30 days.

Children

The site isn't directed at children under 16, and we don't knowingly collect their data.

Changes

We'll update the date at the top when this notice changes.

Contact

Privacy questions and requests: support@wallpapermachine.app.