Privacy Policy — Irida

Effective date: 1 October 2026 App: Irida (live & AI wallpapers) Developer / data controller: Kirill (independent developer), contact: [email protected]

1. Who we are

Irida is a mobile app that provides live, photo, and AI-generated wallpapers. This policy explains what data we handle and why. We designed Irida to be privacy-light: we do not ask for your name, email, phone number, or create an account.

2. What we collect

a) Device identifier. On first launch we generate a random token (a UUID) that identifies your installation so we can track your credit balance and unlocked content. It is not linked to your real identity. On our server we store only a one-way hash of this token, not the token itself.

b) Content you submit for AI features.

• Text prompts you type for "text-to-wallpaper" are sent to our server and to our AI processing partner (fal.ai) to generate an image, and are stored in our generation history (linked to your device token) so we can deliver and re-serve your result.
• Photos you choose for the "stylize my photo" feature are downscaled on your device and sent to our AI partner (fal.ai) to produce the stylized result. We do not store your input photo on our servers; it is processed to create the result and handled by fal.ai under their policy.

c) On-device preferences. Your chosen interests, language, favorites, and unlocked wallpapers are stored only on your device and are not sent to us.

d) Purchases. If you buy credits, sparks or a subscription, the purchase is processed by Google Play Billing. We use RevenueCat, a purchase-management service, to confirm your purchase and restore it on a new phone: RevenueCat receives an anonymous app-user identifier, the product you bought and its purchase status. We receive a purchase token to grant your entitlement — we never receive or store your card details.

e) Install attribution (Android). So we can tell which advertising campaign an install came from, the app uses Tenjin, a mobile measurement partner. Tenjin receives your device's Google Advertising ID (a resettable identifier you control in Android Settings → Privacy → Ads), together with basic install and app-version information, and the fact that a purchase of a given product occurred. It does not receive your prompts, your photos, your generated wallpapers, or any payment details. You can reset this identifier, or switch it off entirely, in your Android settings at any time; the app keeps working either way.

f) Reports about content. If you flag an AI-generated image as offensive (tap "Report" under a result), we store the image's identifier, the reason you chose, the time, and your device identifier, so we can review it and improve our filters. Reports are deleted when you delete your data.

g) Crash diagnostics. When the app crashes or hits an error, it sends us an error message and stack trace, the app version, Android version, and your device identifier. We use it only to fix bugs and delete it automatically after 30 days.

h) Push notifications (optional). If you allow notifications, the app sends your Expo push token to our server so we can deliver notifications such as new wallpaper packs. Delivery is handled by Expo and, on Android, Google's Firebase Cloud Messaging. You can turn notifications off at any time in Android settings.

i) Technical logs. Like any online service, our servers and Cloudflare process your IP address and request metadata to deliver the service and protect it from abuse. We do not use IP addresses to identify you.

We do NOT collect: your name, email, phone, contacts, precise location, or biometric data. We do not use advertising SDKs and we show no ads. The third-party SDKs in the app are the purchase service named in (d) and the attribution partner named in (e); there are no other analytics or advertising SDKs.

3. AI processing & model training

Your prompts and photos are used only to generate the result you requested. We do not use your content to train our own AI models, and we do not sell it. Generation is performed by our processor fal.ai; we instruct them to process your content solely to return your result. See fal.ai's privacy policy for their handling.

4. How we use data

To provide the wallpapers and AI features, generate and deliver your results, manage your credit balance, prevent abuse/fraud, and comply with law. Where GDPR applies, our legal bases are performance of our service (to you) and legitimate interests (security and abuse prevention).

5. Who we share it with (processors)

• fal.ai — AI image/video generation and photo stylization (receives your prompts and, for stylization, your chosen photo). See fal.ai's privacy policy.
• DigitalOcean — server hosting of our backend.
• Cloudflare — delivers our API/content over HTTPS (network proxy).
• Google Play — payments (if you purchase).
• RevenueCat — purchase confirmation and restore (receives an anonymous app-user ID and purchase status). See RevenueCat's privacy policy.
• Expo — over-the-air app updates and push notification delivery (receives your push token if you allow notifications, plus app and runtime version).
• Tenjin — install attribution on Android (receives your Google Advertising ID, install and app-version data, and the fact that a purchase occurred). See Tenjin's privacy policy.

We do not sell your data. We do not share your prompts, photos, or generated images with anyone for advertising. The advertising identifier described in §2(e) is shared only with our attribution partner, and only to measure where installs come from.

6. International transfers

Our backend is hosted in the United Kingdom (DigitalOcean, London). Our AI partner may process content on servers in other countries, including the United States. Where required, transfers rely on appropriate safeguards (such as the processors' standard contractual clauses).

7. Permissions we request

• Photos — we do not request broad access to your photos or videos. You pick a photo to stylize with Android's system photo picker, and wallpapers are saved to your gallery without read access to it (on Android 12 and older the system storage permission may be used only to save the file).
• Notifications — optional; only if you allow them, to tell you about new wallpaper packs.
• Set wallpaper — to apply a wallpaper you chose.
• Motion sensors (gyroscope) — for the parallax/tilt effect; processed on-device, never transmitted.
• Internet — for AI features and content.
• Advertising ID (com.google.android.gms.permission.AD_ID, Android only) — read by our attribution partner to measure which campaign an install came from; see §2(e). You can reset or disable it in Android settings.

7a. AI content, safety and reporting

AI-generated images are produced by third-party models and may occasionally be inaccurate or inappropriate. We block prompts that ask for sexual, violent, hateful or third-party-protected content and rely on our provider's safety filters. If you see an image that is offensive or harmful, tap Report under the result and choose a reason, or email [email protected]; we review reports and improve our filters and may restrict misuse.

8. Data retention

Your device record and generation history are kept until you delete them (see §10) or your installation is inactive for 24 months, after which they are removed automatically. Crash diagnostics are kept for 30 days. Input photos for stylization are not retained by us.

9. Children

Irida is not directed to children under 13 (or the minimum age required in your country). We do not knowingly collect data from children. If you believe a child provided us data, contact us and we will delete it.

10. Your rights & how to delete your data

You can delete all data tied to your device at any time, in the app: Settings → Legal → Delete my data. This immediately removes your device record, credit balance, premium status, generation history, push token, crash diagnostics and content reports from our server, and clears local data on your device. Data already held by third parties (for example, the advertising identifier at Tenjin or purchase records at RevenueCat and Google Play) is governed by their policies; contact us and we will forward deletion requests where we can.

You can also email [email protected] with the subject "Delete my data". We action email requests within 30 days. See also our Data deletion page.

Depending on your region (EEA/UK — GDPR, California — CCPA/CPRA), you may have additional rights (access, correction, portability, objection, and the right not to have personal information sold — which we do not do). Contact us to exercise them.

11. Security

Traffic between the app and our server is encrypted in transit (HTTPS/TLS). Your device token is stored in your device's secure keystore, and only a one-way hash of it is stored on our server. No method is 100% secure, but we use reasonable technical measures to protect your data.

12. Changes

We may update this policy; material changes will be reflected by a new effective date at this URL.

13. Contact

Kirill (independent developer) — [email protected]