Developer ("CrunchyWall", "we", "us") operates the CrunchyWall website and service. For the purposes of India's Digital Personal Data Protection Act, 2023, we act as the Data Fiduciary for the personal data described in this policy. For the purposes of the EU/UK GDPR, we act as the Data Controller.
| Category | Examples | When collected |
|---|---|---|
| Account data | First name, last name, email address, password (stored as a salted bcrypt hash — we never store or can see your plain-text password) | Sign-up |
| Google Sign-In data | Name, email, and profile picture, if you choose to sign in with Google | Google Sign-In |
| User content | Wallpapers you upload as an approved creator ("Wally"), titles, descriptions, categories | Upload |
| Usage data | Favourited wallpapers, download counts, creator application details | While using the Service |
| Technical data | IP address, browser type, device information, session identifiers | Automatically, on every request, for security and rate-limiting purposes |
| Communications | Your email address is used to send one-time login/verification codes and account-related notices | Sign-up, sign-in, password-related flows |
We do not knowingly collect sensitive categories of personal data (such as health information, biometric data, or government ID numbers) through the Service.
We do not sell your personal data to third parties, and we do not use your data to serve you targeted third-party advertising.
We rely on the following categories of service providers ("processors" / "sub-processors") to operate CrunchyWall. Each processes personal data only on our instructions and only to the extent needed to provide their service to us:
| Provider | Purpose | Data involved |
|---|---|---|
| Application hosting (e.g. Render) | Runs our backend server | All data that passes through the Service, including IP addresses in server logs |
| Image storage / CDN (GitHub, Cloudflare R2, jsDelivr) | Stores and serves wallpaper image files | Uploaded wallpaper files and their metadata |
| Transactional email (Resend) | Delivers one-time passcodes and account emails | Your email address and the content of those emails |
| Google Sign-In (Google LLC) | Optional sign-in method | Name, email, and profile picture, only if you choose this method |
| Privacy-focused analytics (Plausible) | Aggregate traffic and usage trends | No cookies, no personal data — cannot identify you individually |
| Google AdSense | Displays advertisements | Cookies and identifiers for ad delivery and measurement, per Google's own policies |
These providers may process data outside your country of residence — see Section 8. We do not permit these providers to use your data for their own independent purposes; their use is governed by their agreements with us and, where applicable, their own privacy policies (for example, Google's Privacy Policy governs your use of Google Sign-In independently of this policy).
We use a strictly necessary session cookie to keep you signed in, secured with the HttpOnly and Secure flags so it cannot be read by client-side scripts and is only transmitted over encrypted connections. We also use your browser's localStorage to cache a copy of your session and some app data locally, purely to make the app load faster and work smoothly — this data stays on your device and is not a tracking cookie.
For site analytics (page views, general traffic trends), we use a privacy-focused analytics service that does not use cookies, does not collect or store any personal data, and does not track you across other websites. It cannot identify you as an individual.
We display advertisements through Google AdSense. Google may use cookies and similar technologies to serve ads based on your visits to this and other websites, and to measure ad performance. You can opt out of personalized advertising through Google's Ad Settings, or generally through the Digital Advertising Alliance's opt-out page. Google's own use of this data is governed by Google's Privacy & Terms, independently of this policy. If we adopt further analytics or advertising tools that use cookies or track individuals beyond what's disclosed here, we will update this policy and, where legally required, request your consent first.
Where the GDPR or similar laws apply, we process your personal data on the following legal bases: (a) performance of a contract — to provide the account and features you sign up for; (b) legitimate interests — to secure the Service, prevent fraud, and enforce our Terms, balanced against your rights; (c) consent — for optional features that explicitly ask for it; and (d) legal obligation — where we must retain or disclose data to comply with law. Under India's DPDP Act, 2023, our primary basis is your consent, given when you sign up and agree to this policy, which you may withdraw at any time as described in Section 9.
We retain your account data for as long as your account is active. If you delete your account, we will delete or anonymize your personal data within a reasonable period, except where we are required to retain certain records for longer to comply with legal obligations, resolve disputes, enforce our agreements, or as described in our takedown/grievance procedures (for example, records related to a copyright complaint may be retained for the period required by applicable law).
Because we use infrastructure and service providers described in Section 4, your data may be processed on servers located outside your country of residence, including in the United States. Where required by applicable law (such as the GDPR), we take steps intended to ensure such transfers are subject to appropriate safeguards, such as standard contractual clauses or equivalent mechanisms offered by our providers.
Subject to applicable law, you generally have the right to:
To exercise any of these rights, contact us at [email protected]. We will respond within the timeframe required by applicable law.
If you are a Data Principal under India's Digital Personal Data Protection Act, 2023, in addition to the rights in Section 9, you have the right to nominate another individual to exercise your rights on your behalf in the event of your death or incapacity. To exercise this or any other right under the DPDP Act, contact our Grievance Officer listed in Section 17. You also have the right to file a complaint with the Data Protection Board of India if you believe we have not adequately addressed your grievance.
If the GDPR or UK GDPR applies to you, you have the rights described in Section 9 as guaranteed by those laws, including the right to data portability and the right to lodge a complaint with your local supervisory authority (for example, your national Data Protection Authority in the EU, or the Information Commissioner's Office in the UK).
If the California Consumer Privacy Act (CCPA), as amended by the CPRA, applies to you, you have the right to know what personal information we collect, request deletion, and opt out of the "sale" or "sharing" of personal information. We do not sell or share your personal information as those terms are defined under the CCPA/CPRA.
The Service is not directed at children under 13 (or under 18 for purposes of India's DPDP Act, which defines a "child" as anyone under 18). We do not knowingly collect personal data from children below the applicable age without verifiable parental or guardian consent. If we become aware that we have inadvertently collected such data, we will delete it and, where applicable, terminate the associated account.
We use technical and organizational measures designed to protect your data, including password hashing with bcrypt, encrypted connections (HTTPS) for all traffic, secure session cookie flags, and rate limiting on sensitive endpoints to reduce brute-force and abuse risk. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify affected users and, where required by applicable law (including the DPDP Act, 2023 and the GDPR), the relevant regulatory authority, without undue delay and within the timeframes required by that law.
We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above and, where required by law, provide additional notice (such as an in-app notice or email) and, if required, seek your renewed consent before the change takes effect.
For privacy questions or to exercise your rights, contact: [email protected].
In accordance with India's Digital Personal Data Protection Act, 2023 and the Information Technology Rules, 2021, our Grievance Officer can be reached at:
Grievance Officer: Developer
Email: [email protected]
Address: [ADDRESS IN INDIA]