What The Wallpaper Hub collects, why, and what happens to it. Short version: as little as the site needs to work, and none of it is sold.
You can browse and download without telling us anything. We don't ask for your name or email.
Downloading a wallpaper increases a public counter on that wallpaper. Nothing about you is attached to it.
Your browser keeps a list of what you've downloaded so the Downloads page works. That list lives on your device, we can't see it, and clearing your browser data removes it.
Our hosting provider keeps standard server logs, covering the pages requested, rough timing and IP address, for security and to keep the site running.
Beyond those server logs, nothing is recorded about you while you browse signed out, because there is no account to record it against.
We store your email address and, if you signed up with a password, a scrambled version of it. Plain-text passwords are never stored, not by us and not by our database provider, so nobody at our end can see or recover yours.
If you sign in with Google, we receive your email address and nothing else. We don't get access to your Google account.
We store your handle, and your bio, profile picture and banner if you add them. All of that is public by design.
We store what you upload, who you follow, what you've downloaded, and anything you report. Your download history is private to you.
When you upload, we record that you confirmed the work is yours, and anything you typed in the optional source field. That's kept as a record of what you told us, and it's what we'd rely on if someone claimed the work was theirs.
We record the IP address your account signs in from. It has one purpose: when an account is closed for something serious and a new one appears from the same connection, that is the only way to tell. It is not used for advertising and it is not shared. It is not shown anywhere in the site, because a page listing your own addresses is a page that could leak, but you can ask us for it and we will send it to you.
We keep a count of what you publish and when, so the daily upload limit works. It survives you deleting an upload, or the limit could be reset by pressing delete.
If something you upload is refused, held for review, or removed by a moderator, that decision is recorded against your account with the reason. It's how repeated problems get noticed rather than each one looking like a first offence. Ask and we'll tell you what's on your record.
Every image is re-encoded before it's stored. This strips embedded camera metadata, including GPS coordinates. Photographs taken on a phone routinely carry the exact location they were taken, and publishing that would be a genuine privacy problem, so we remove it rather than passing it on.
Images are sent to Google's Cloud Vision service to be checked for adult and violent content. Google processes the image to score it and doesn't keep it.
Anything you publish is public. Anything held for review or rejected is visible only to you and to moderators.
Supabase stores our database, files and accounts. Vercel hosts and serves the site. Google provides sign-in and the content scanner. Resend sends our emails. Google AdSense serves the ads. Each of these sees only what it needs to do its job.
We don't sell your data, and we don't hand advertisers your email address, your account or anything you've uploaded. AdSense sets its own cookies, which is covered in the next section. Beyond that we don't run tracking pixels or third-party analytics that follow you around the web.
We do count visits. Vercel Analytics records that a page was viewed and roughly where in the world from, and Vercel Speed Insights records how quickly it loaded on real visits. Neither sets a cookie, neither builds a profile of you, and neither can follow you to another website. That's why the consent banner doesn't mention them: there is nothing there to consent to.
We use Sentry to be told when something breaks. If a page fails, it receives the error and the line of code that caused it. It's deliberately configured not to attach your IP address, and it doesn't record your screen or what you clicked, an option that exists and that we've left switched off.
We'll hand over information if the law requires it: a court order, or a legal obligation to report material involving children.
The site carries ads from Google AdSense. That's what pays for hosting, storage and the content scanning, and it's why downloads are free and don't need an account.
Google and its partners use cookies to serve those ads, and may use them to show you ads based on your previous visits to this site and to other sites. Google's own description of how it uses information from sites that use its services is at policies.google.com/technologies/partner-sites.
You can switch off personalised advertising in Google's ad settings at myadcenter.google.com. That doesn't remove the ads, it stops them being tailored to you. To opt out of ad cookies from a wider list of vendors, aboutads.info/choices covers most of them.
Advertisers don't get your email address, your account, your uploads or your download history. What they see is what an ad on any site sees: that a browser loaded a page.
If you're in the UK, the EU or Switzerland, we ask before any advertising cookie is set. Until you answer, and if you say no, the ads are non-personalised: they still appear, but they are not based on anything about you. The choice is remembered in your browser, so clearing your site data asks again.
Moderators don't see ads at all.
When you sign in, your browser keeps a session token so you stay signed in. That's necessary for the site to work; without it you'd be signed out on every page.
Your device also stores your local download list, so the Downloads page works when you're signed out.
The only other cookies are the advertising ones described above, and those are set by Google rather than by us.
Your answer to the cookie banner is kept in your browser's local storage rather than in a cookie, under the name twh-ad-consent. It holds one word, granted or denied, and it never leaves your device.
You can delete your account yourself, from Settings, without asking anyone.
For anything else, email thewallpaperhub.org@gmail.com and we'll tell you what we hold about you or correct anything wrong.
Deleting your account removes your profile, uploads, follows and download history. Files already downloaded by other people can't be recalled.
Depending on where you live you may have additional rights under laws like the GDPR or CCPA. Ask and we'll honour them.
Accounts are for people 16 and over. We don't knowingly collect anything from anyone younger. If you believe a child has made an account, email us and we'll remove it.
Questions about any of this? Email thewallpaperhub.org@gmail.com.