Privacy

Last updated: 14 November 2026

This notice explains what WallpaperDuck (wallpaperduck.com) collects about you, why, on what legal basis, how long it is kept and what rights you have. It follows the EU and UK General Data Protection Regulation (GDPR) and Turkey's Personal Data Protection Law No. 6698 (KVKK). Türkçe aydınlatma metni: wallpaperduck.com/kvkk

Who is responsible

The data controller is the operator of WallpaperDuck. For anything about your data write to support@wallpaperduck.com.

What we collect and why

• Your account, if you make one: e-mail address, a salted hash of your password if you set one, and the name and profile picture Google passes on if you sign in with Google. Purpose: running your account. Legal basis: performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
• What you do with the account: likes and dislikes, your lists, your download history (which wallpaper, which size, when) and daily counters of activity (pages, downloads, votes, searches, sign-ins). Purpose: the daily download allowance, your lists and spotting abuse. Legal basis: contract and our legitimate interest in keeping the site fair and secure (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
• Sign-in sessions: when each sign-in started and the network address it came from, so a session can be checked and abuse traced. Legal basis: legitimate interest (security).
• Visitors without an account: visits are counted with a hash of the network address and browser that changes every day, so nobody can be recognised from one day to the next. Search terms are counted without any link to a person. Legal basis: legitimate interest (knowing, in aggregate, how the site is used).
• Security records: the web server's access log (page, browser, time and a shortened network address with the last part removed) and short-lived rate-limit counters keyed by a hash of the address (for downloads without an account, a hash of the address together with the browser's identification string: that is how the daily allowance is counted). Legal basis: legitimate interest (protecting the site against attacks and scraping).
• Automated traffic: when our protection decides that a request comes from a bot or an automated tool (for example a scraper, a forged browser or a fake search-engine crawler), we keep that request's full network address, browser identification string, the page asked for and the time, so the address can be blocked on this site and our other websites. Requests from people are not recorded this way. Legal basis: legitimate interest (protecting the site against attacks and scraping).
• Advertising: the site is free and shows ads from Google AdSense to everyone. Without your consent they are non-personalised. Legal basis: our legitimate interest in paying for a free site (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)). Visitors in the European Economic Area, the UK and Switzerland are asked about ads in Google's consent window instead (see "Cookies and similar storage").
• Only with your consent: Google Analytics and personalised ads, described below. Legal basis: consent (GDPR Art. 6(1)(a) and the ePrivacy rules on cookies; explicit consent under KVKK Art. 5(1)).

We do not sell personal data, we do not build profiles of you, and no decision with legal or similarly significant effect is made about you automatically. Abuse (scripted downloading, multiple accounts) can lead to an account being suspended; that decision is made by a person.

Cookies and similar storage

Necessary cookies are always on, because sign-in and downloads cannot work without them. Analytics and personalised advertising stay off until you allow them in the cookie window, and declining is as easy as accepting. Ads that are not personalised are shown either way; with them Google may still use cookies to limit how often an ad repeats, to count ads in total and to stop ad fraud. You can change or withdraw your choice at any time with "Cookies" in the menu or at the bottom of the pages. The full list is below.

Visitors in the European Economic Area, the UK and Switzerland see Google's consent window instead of ours: a consent platform certified by Google under the IAB Transparency & Consent Framework, which Google requires for ads there. It asks whether Google and its advertising partners may use cookies and similar technologies, and for which purposes (for example personalised ads or measurement); declining is as easy as accepting. If you decline, you still see ads that are not personalised. Google Analytics runs there only if you allow Google "Store and/or access information on a device" and "Measure content performance" in that window. "Cookies" in the menu opens Google's window again so you can change your choice.

Analytics and advertising

Google Analytics 4: if you allow it, Google Analytics measures which pages and themes are visited and from which countries and kinds of device, in aggregate. Google receives your network address to derive an approximate location but does not store it for Analytics. Google keeps the event data for 2 months. Advertising features and Google Signals are not used.

Google AdSense shows the ads. If you allow personalised ads (in our window, or in Google's window in the EEA, the UK and Switzerland), Google and its partners may use cookies and device identifiers to show ads based on your interests and to measure them. If you do not, Google shows non-personalised ads: chosen from the page you are on and your rough location (from your network address), not from a profile of you. How Google uses data from sites like this one: policies.google.com/technologies/partner-sites. Ad settings: adssettings.google.com.

Who else receives data

• Cloudflare, Inc. (USA): delivers the site and protects it against attacks, so it sees every request. We also use Cloudflare Turnstile, an invisible check that runs in your browser when a page opens and tells people from bots without a puzzle. Cloudflare processes the data needed for it as described in the Turnstile Privacy Addendum: https://www.cloudflare.com/turnstile-privacy-policy/
• Sendinblue SAS / Brevo (France): sends the confirmation e-mail when you sign up with an e-mail address; it sees the address and the delivery result.
• Google LLC (USA) / Google Ireland Ltd: Google sign-in if you choose it; Analytics and AdSense only with your consent.

They process the data under their own data processing terms. Nobody else receives your data unless the law obliges us to hand it to an authority.

Transfers abroad

Cloudflare and Google may process data outside Turkey and the European Economic Area, in particular in the USA. The providers rely on the European Commission's Standard Contractual Clauses and the EU-US Data Privacy Framework. Data for Analytics and personalised ads is sent to Google only after you have consented to it; for other ads Google receives what it needs to deliver one (network address, browser, the page).

How long we keep it

• Account, lists, votes and download history: until you delete the account.
• Daily activity counters and visit statistics: 60 days. Only totals without any link to a person are kept longer.
• Sign-in sessions: until you sign out or the session expires (at most 365 days without use).
• E-mail sign-ups that are never confirmed: deleted after 30 days.
• Web server access logs: 7 days. Rate-limit counters: 3 days.
• Records of automated traffic (bot addresses): kept on our block list for as long as they are needed to protect this site and our other websites, with no fixed time limit. You can ask us to remove an address (write to the contact address above).
• Database backups: rolling, overwritten after 14 days.
• Your cookie choice: 12 months in your browser; an anonymous record of it (random id, choice, time, no name or address) for 2 years, to show that consent was given. A choice made in Google's consent window is kept by Google in your browser for up to 13 months.

Your rights

Under the GDPR you may ask for access to your data, correction, deletion, restriction of processing and a copy in a portable format; you may object to processing based on legitimate interest and withdraw consent at any time (this does not affect what happened before). You may complain to the data protection authority of the country you live in.

Under KVKK Article 11 you may learn whether your data is processed, ask for information about it, learn the purpose and whether it is used for that purpose, learn the third parties at home or abroad it is passed to, ask for correction, deletion or destruction and for those to be passed on to the third parties, object to a result against you that comes from automated analysis alone, and claim compensation for damage caused by unlawful processing. If we do not answer or you disagree with the answer you may complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).

The fastest way: on your account page, "Download my data" gives you everything we hold about your account as a file, and "Delete account" removes the account with its lists, votes and download history at once. Otherwise write to support@wallpaperduck.com from the address on the account; we answer within 30 days and free of charge.

Children

The site is not meant for children under 16. We do not knowingly keep accounts for them; if you think a child has made one, write to us and we will delete it.

Security

The site is served only over HTTPS. Passwords are stored as scrypt hashes, sign-in tokens only as hashes, and only the operator has access to the server and the database.

Changes

Important changes to this notice are announced on the News page. When the cookie part changes, the banner asks for your choice again.

Cookie list

Necessary (always on)

Analytics (only with your consent)

Advertising (non-personalised for everyone, personalised only with your consent; in the EEA, UK and Switzerland as chosen in Google's consent window)

Cookie settings