Privacy Policy

This policy explains what Wallzy (wallzy.art, "we") collects when you use the site, why, and what you can do about it. If anything here is unclear, write to admin@wallzy.art.

The short version

You can design cards without an account. Until you sign in, your card stays in your own browser.
With an account we keep your email, your name, your cards and the pictures on them, so your library follows you between devices.
Payments go through Stripe. We never see or store your card number.
We count visits and files made without cookies. Google Ads measures which ads bring people here; in Europe, the UK and Switzerland only if you allow it.
We never sell your data. You can download everything we hold about you, or delete your account, from your account page.

What we collect, and why

Your account

Your email address, the name you give, an optional profile picture, and your password, stored only as a one-way hash we cannot read back. If you sign in with Google, we receive your email address, your name and a Google account id. We use these to sign you in, to keep your cards for you and to email you about your account (confirming your address, resetting a password, receipts for changes you make). We do not send marketing email.

Your cards

The cards, templates, decks and folders you save, and the pictures and fonts you put on them. We keep them to show them back to you on any device. A card you publish to the gallery, your public profile name, handle and bio, and designs you list in the marketplace are public, and anyone can see them.

Payments

When you subscribe or buy a design, Stripe takes your payment details on its own page. We receive from Stripe your plan, its status and renewal date, and the amounts paid, so we can unlock what you paid for. If you sell designs, Stripe verifies your identity and pays you out; we keep your shop name and the state of your payouts.

Counting visits

Our own counting stores, per day, how many times something happened (a page opened, a file made, a template used). It sets no cookie and keeps nothing about who you are.

Google Ads

Our homepage, the content pages and the account page load Google's ad tag, so we can tell which ads lead to visits and subscriptions. When allowed, Google may set cookies to do this. In the EU, the EEA, the UK and Switzerland the tag starts with ad cookies off, and turns them on only if you choose Allow; anyone whose browser sends Global Privacy Control or Do Not Track is treated the same way. You can change your choice at any time with Cookie choices in the footer. Google's use of this data is described at policies.google.com.

Errors and feedback

When something breaks in your browser, the page sends us the error message and where in our code it happened, with the page, the template and the type of browser. We remove web address details and email addresses from it, and it is not linked to you or your account. Feedback you send from the editor reaches us with what you wrote, an optional picture of your card, a few facts about your browser, and your email if you give it, so we can answer.

Security

To stop people guessing passwords or flooding forms, we briefly keep the internet address of failed sign-ins and some requests. These records are deleted after minutes to hours.

Cookies and storage in your browser

A sign-in cookie (cfsid) keeps you signed in. It is needed for the site to work and is removed when you sign out or after 30 days without a visit.
Browser storage keeps the card you are working on, your library when signed out, and your settings (theme, layout, your cookie choice). It stays on your device; clearing your browser's site data removes it.
Google Ads cookies, as described above, only where allowed.

Other services that handle data for us

Our hosting provider runs the server and database where accounts and cards are kept.
Stripe takes payments and pays sellers (stripe.com/privacy).
Google, if you use Google sign-in, and for ad measurement.
Our email provider sends the emails about your account.
pollinations.ai, only when you use Write it for me or Generate and your browser has no built-in AI model: the description you type is sent to it to write the card or draw the picture. Do not put personal details in those prompts.
Openverse, only when you search for free pictures: your search words are sent to it.

Some of these companies are outside Australia, mostly in the United States, so your data may be processed there. We use providers that protect it under their own published terms.

How long we keep it

Your account and cards: until you delete them or your account. Deleting your account deletes your cards, pictures, decks, shared links and profile.
Billing records: Stripe and we keep what tax and accounting law requires, usually several years, even after an account is deleted.
Error reports: 30 days. Security records: minutes to hours. Visit counts: kept as totals, with nothing about you in them.
Feedback: until we have dealt with it and deleted it.
Backups made by our host may keep a copy for a short time after deletion.

Your choices and rights

See and download your data: Account, then Your data, gives you a file of your account and every card.
Correct it: change your name, email and picture on your account page.
Delete it: Account, then Your data, deletes your account. A subscription is cancelled first.
Ad cookies: Cookie choices in the footer.
Ask us anything else, or object to how we use your data, at admin@wallzy.art. We answer within 30 days.

Depending on where you live (the EU, the UK, California, Australia and elsewhere) the law gives you rights to access, correct, delete and move your data and to object to some uses. We give everyone the same choices above. You can also complain to your data protection authority; in Australia that is the Office of the Australian Information Commissioner.

Where the GDPR or UK GDPR applies, we rely on: the contract with you to run your account and plan; our legitimate interest in keeping the site secure, fixing errors and counting visits; your consent for ad cookies; and legal obligations for billing records.

Children

Wallzy is used in classrooms, and anyone can design cards without an account. Accounts are for people aged 13 or over (16 or over in the EU and the UK, unless a parent agrees). If you think a child has given us personal data without permission, write to admin@wallzy.art and we will delete it.

Changes

When this policy changes we update the date below, and for a change that matters we tell account holders by email or on the site before it applies.

Wallzy, Australia. Contact: admin@wallzy.art.