Privacy Policy

We collect three categories of information:

Information you give us

• Account data when you sign up: username, email address, password (stored hashed with bcrypt — we never see the plaintext), and optional profile fields like display name, avatar, bio, and social links.
• Submitted content: wallpapers you upload, titles, tags, comments, and saved collections.
• Communications: when you contact us by email or use a contact form.

Information collected automatically

• Usage data: pages visited, wallpapers viewed, downloads, likes, and search queries. Used for analytics and to power the trending feed.
• Technical data: IP address, browser type, device type, operating system, referrer URL.
• Cookies and similar technologies: see Section 4.

Information from third parties

• Analytics and ad-serving partners provide aggregated reports about how visitors use Wallora.
• If you sign up using a referral link, we record the referring user's identifier so they can earn referral rewards.

• Operate, maintain, and improve the website
• Create and manage your account
• Show you wallpapers, suggestions, and trending content
• Process uploads and surface them in the gallery
• Send transactional emails (verification, password reset, notifications you opt into)
• Detect, prevent, and address fraud, security, and abuse
• Comply with legal obligations
• Run aggregated analytics to understand traffic and feature usage

Wallora relies on these processors to operate. Each has its own privacy policy governing how it handles data we transmit to it.

• Cloudinary — image hosting and transformation. Wallpaper files and their generated previews are stored on Cloudinary.
• MongoDB Atlas — primary database. Account data, content metadata, and engagement signals (likes, downloads, views).
• Anthropic — AI vision API used to suggest titles, tags, and alt text for uploaded wallpapers. The image file is sent to Anthropic for processing; Anthropic's data-use policy applies to that exchange.
• Vercel — hosting, edge caching, Speed Insights (Core Web Vitals tracking).
• Google Analytics — anonymized usage analytics. IP addresses are truncated before storage.
• Google AdSense — ad delivery. AdSense may use cookies to serve interest-based ads. You can opt out at Google's Ad Settings.
• Resend — transactional email delivery (verification, password reset, etc.).

We use cookies and local storage for:

• Essential: authentication session (so you stay logged in), CSRF protection, referral attribution. Required for the site to work.
• Preferences: liked-wallpapers list, dismissal state for the push-notification prompt, theme/sort selections.
• Analytics: Google Analytics cookies for aggregated traffic reporting.
• Advertising: Google AdSense cookies for ad personalisation and frequency capping.

Most browsers allow you to refuse cookies through settings. Refusing essential cookies will break login.

If you opt in to browser push notifications, we register a subscription with your browser's push service (Firebase Cloud Messaging for Chrome, Mozilla Push for Firefox, Apple Push for Safari). We store the subscription endpoint on our server so we can send you notifications about likes, follows, and comments. You can revoke this at any time from your browser's site settings or by un-subscribing in your profile.

Some wallpapers on Wallora are AI-generated. These are tagged with "ai-generated" and a small badge appears on their detail page. When AI is used to suggest titles, tags, or alt text during your upload, the image is transmitted to Anthropic for that purpose; the file is not retained beyond that request.

You have the following rights regarding your personal data:

• Access: request a copy of the data we hold about you.
• Correction: update incorrect data via your account settings or by contacting us.
• Deletion: delete your account and associated data. You can do this from your dashboard or by emailing privacy@wallorahd.com.
• Portability: download your uploaded wallpapers and profile data.
• Opt-out of marketing emails, push notifications, and personalised ads (links above).

If you're in the EEA, UK, or California, you have additional rights under GDPR, UK GDPR, or CCPA. Email privacy@wallorahd.com and we'll comply within 30 days.

We retain your account data while your account is active. If you delete your account, we delete personal data within 30 days, except where we're legally required to retain certain records (for example, transactional email logs for fraud-prevention purposes).

Wallpapers you've published remain accessible after account deletion if you opted to license them under CC0 at upload. You can request their removal at any time via the takedown channel in our Terms of Service.

We use industry-standard measures to protect your data: TLS for all data in transit, bcrypt for password hashing, scoped API keys, and least-privilege database access. No system is 100% secure; if a breach occurs, we will notify affected users within 72 hours where required by law.

Wallora is not intended for children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child has submitted personal information to us, please email privacy@wallorahd.com and we will delete it.

Our servers are hosted in the United States (Vercel) and Europe (MongoDB Atlas). If you access the site from outside these regions, your data is transferred to and processed in those regions. By using the site, you consent to this transfer.

We may update this Privacy Policy from time to time. When we do, we'll change the "Last updated" date at the top of this page and, for material changes, notify you via email if you have an account. Continued use of the site after the update means you accept the revised policy.

For any privacy questions, requests, or complaints, email us at privacy@wallorahd.com. We respond to all legitimate requests within 30 days.