Privacy

The desktop app keeps its settings, history, likes and downloaded wallpapers on your own PC. It fetches wallpapers directly from Wallhaven using your own Wallhaven API key, if you give it one; that key stays on your PC and is never sent here. Wallhaven's own privacy policy covers what it sees.

The app checks this site for updates, which tells the site your IP address, as any web request does. The site keeps no log of it.

Signing up is optional. If you do, this is what is kept:

• Your email address and a password. To sign you in. The password is stored only as a salted hash; nobody can read it. If you sign in with Google instead, Google tells us your email address and name.
• A username, if you choose one. Shown publicly on presets you share. It can be changed once every 30 days.
• Synced settings, if you sign the app in. Your search settings, timetable, presets, playlists, likes and dislikes, so they follow you between PCs. Not your Wallhaven API key, and not the wallpaper files themselves.
• Presets you share, and presets you like. Shared presets are public, with your username on them.
• The name of a PC you pair. Held for the few minutes a pairing takes.

The app records crashes on your PC and shows them to you. Nothing is sent unless you choose to send it. Before sending, it removes your Windows username, your home folder and your Wallhaven API key from the report. Feedback and crash reports are not linked to your account. Your email address is only attached if you type it in so that you can get a reply.

The website is different: if a page breaks, it reports that itself, because a broken page has nowhere to ask you. The report holds only the error, the technical trace that goes with it and which page it happened on. Nothing about you or your account goes with it.

No analytics, no tracking, no advertising, no fingerprinting, and nothing sold or shared for marketing. The site stores only your sign-in session in your browser, which is what keeps you signed in; there are no tracking cookies, so there is no cookie banner.

I can see totals worked out from what the service already holds, such as how many accounts there are, how many were active this week and how often each release was downloaded. Nothing extra is recorded to produce them, and they never show who anyone is.

• To provide the account you asked for. Your email, password, username, synced settings and presets. Without them there is no account.
• Legitimate interests. Briefly holding IP addresses in memory to stop scripted abuse of the public pages, and sending you the emails your account needs (confirming your address and resetting your password), and the website reporting its own errors so they can be fixed.
• Your consent. The app's crash reports and feedback, which are only sent when you choose to send them.

• Supabase. Runs the database and sign-in. The data is stored in London (AWS eu-west-2).
• Cloudflare. Serves this site from its network.
• Resend. Sends the account emails, so it sees your email address.
• Google. Only if you choose to sign in with Google.

Some of these companies are based in the United States and may process data there. Each is bound by data processing terms that include the UK's approved safeguards for international transfers.

Account data is kept until you delete the account. Pairing records expire after five minutes. Feedback is kept while it is useful for fixing what it reports, and deleted on request.

You can ask for a copy of what is held about you, have it corrected, or have your account deleted. Deleting an account removes your email address, username, synced settings, shared presets and likes together. To do any of this, email privacy@wallraven.app from the address on the account. You will get an answer within a month, usually much sooner.

If you are unhappy with how your data is handled, you can complain to the Information Commissioner's Office at ico.org.uk, though please get in touch first.

WallRaven is not meant for children under 13, and accounts should not be made for them.