Privacy Policy

Last updated: 13 September 2026 · Android app: com.wewallpapa.app

This policy explains the processing of personal data in WeWallPapa, also presented as “WeWallPapa: Wallpaper Lab” and “WeWallPapa: Twoje tapety”, under the Terrible Monsters Studio brand.

This policy covers the current pre-release app. The Pro purchase verification service is still being prepared and is not active. Its planned data processing is identified below; we will update this policy before activating that service.

1. Controller and contact

“We” refers to this controller. You can contact us by email or at the address above.

2. Wallpapers and settings on your device

WeWallPapa generates wallpapers on your device. Images, styles, palettes, seeds and automatic wallpaper settings are processed locally and are not uploaded to us. No WeWallPapa account is required. The app contains no advertising or analytics SDK.

Exporting or sharing an image sends it to the destination you choose through Android. That destination handles the image under its own privacy rules. App preferences may be covered by your Android backup settings; purchase receipts are excluded from Android backup. Clearing app data removes local preferences and receipts. Images already exported and your current wallpaper can remain until you remove or replace them.

3. Fonts and other network requests

The app requests interface fonts from Google Fonts over HTTPS. Google receives your IP address, the requested font URL and technical request headers, which may identify the browser, operating system and referring page. Google states that its Fonts API does not set or log cookies and does not use these requests to build user profiles or target advertising. See Google Fonts privacy information.

These requests serve the app's interface fonts. The app uses system fallback fonts if the online fonts are unavailable. We do not receive Google's font request logs. Google describes its processing and retention in its Privacy Policy.

4. Pro purchases: service being prepared

Pro is planned as an optional one-time Google Play purchase. Google Play processes payment; we do not receive your card number. When verification becomes available, the app will send a purchase token, a random installation identifier and a one-time request identifier to our service over HTTPS. They will be used to verify and restore Pro, prevent misuse and issue a receipt for offline access.

The implemented service is designed to store purchase tokens and their hashes, purchase and acknowledgement status, and the last update time in Google Cloud Firestore. The installation and request identifiers are processed in memory by that service and included in the receipt stored on your device. These identifiers are not advertising IDs. Google Play purchase notifications will trigger purchase status checks.

This service has not yet been activated. Hosting location, operational log retention and applicable international transfer safeguards will be specified before activation. The implementation has no automatic expiry for purchase records; the final retention rules must support permanent entitlements, refunds and valid deletion requests. This section does not mean that purchase verification is currently available.

5. Contact, purposes and legal grounds

If you email us, we receive your email address, message and any details or attachments you choose to provide. We use Gmail to receive and respond to correspondence. Please do not send passwords, payment card details or full purchase tokens.

We process data necessary to provide a requested service or handle a related enquiry under Article 6(1)(b) GDPR. Our legitimate interests under Article 6(1)(f) GDPR include responding to other enquiries, maintaining the service's readable interface and security, and establishing or defending claims. Legal obligations, including responding to data protection requests, are handled under Article 6(1)(c) GDPR. Where consent is required, it must be obtained separately; reading this policy is not consent.

We keep correspondence for the time needed to resolve the matter and, where necessary, for applicable legal obligations or claims. The purpose, nature of the matter and applicable limitation periods determine this duration. Providing correspondence data is voluntary, but we may be unable to respond or resolve a request without the necessary details.

6. Recipients, hosting and security

Relevant recipients are Google for Fonts and Gmail, Google Play for its own payment services, and GitHub for this policy website. Planned purchase verification will additionally use Google Cloud as a hosting provider. We do not sell personal data. We may disclose information where a legal obligation requires it.

This website uses GitHub Pages. GitHub logs visitors' IP addresses for security, even without a GitHub login. We have added no analytics, cookies, remote fonts or tracking scripts to this page. See GitHub Pages data collection and the GitHub Privacy Statement.

Google and GitHub operate internationally and may process data outside the European Economic Area, including in the United States. Their linked privacy notices explain the safeguards applicable to their services, including adequacy decisions and standard contractual clauses where applicable. You can contact us for information about recipients and safeguards relevant to your data.

Network connections described here use HTTPS. Local application storage is protected by Android's application storage controls. Access to support correspondence is restricted to handling the relevant matters.

7. Your rights and deletion requests

Subject to the conditions of the GDPR, you may request access, correction, erasure, restriction or portability of your personal data, and object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. We do not make decisions with legal or similarly significant effects about you solely by automated processing.

Send your request to terrible.monsters.studio@gmail.com. Describe the request and provide only the information needed to identify the relevant correspondence or record. We may ask for proportionate verification. Requests are handled individually; there is no automated account deletion feature because there are no WeWallPapa accounts. We will explain any applicable reason for retaining data rather than promising deletion of records controlled separately by Google or GitHub.

You may lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes UODO), or another competent supervisory authority. See UODO complaint information.

8. Changes to this policy

Updates will be published at this address with a new revision date. Material changes to the app's data practices will be explained before the changed processing begins. This policy will be updated before the Pro verification service is activated.