Privacy Notice

Last updated October 25, 2026

This notice explains what Wallpaper Machine (“we”, “us”), which makes OhMyShot, collects on ohmyshot.org, why, and what you can do about it. We collect as little as the site needs to work.

What we collect

• Account details. Your email address and, if you give one, your name. If you sign up with a password, we store only a salted hash of it, never the password itself. We email that address only to send you a link: one that verifies it after you sign up with a password (you need a verified address to buy), and one that resets your password when you ask. We store only a hash of each link, which stops working once used, after 24 hours (verification) or after an hour (password reset).
• GitHub details. If you sign in with GitHub, we receive your GitHub user ID, username, name and verified primary email address. We don't keep an access token to your GitHub account.
• Purchase details. When you buy, Paddle collects your payment details, email, name and country. We can see your order in Paddle, and we pass Paddle your account ID so the purchase is linked to you. Paddle then tells us when a purchase completes or is refunded, and we keep that record with your account: the amount and currency you chose, Paddle transaction and customer IDs, and dates; Paddle holds your payment details. We never see or store your card or bank details.
• Support emails. When you write to support@ohmyshot.org, we keep the conversation to answer it.
• Technical data. Your IP address is used briefly to limit repeated sign-in attempts and uploads, and to find your country so we can suggest a currency. Our host keeps short-lived request logs for security and troubleshooting.
• Thank-you wall. Off unless you turn it on in your account. If you have Priority Support and turn it on, the thank-you wall on the home page shows, while your support lasts, the name you choose, your picture and the month you first bought it. The picture is your initial on the app's colours, a picture you upload, or your GitHub or Gravatar picture. We fetch GitHub and Gravatar pictures ourselves and serve them from this site, so visitors never contact GitHub or Gravatar and your email address is never shown. To find your Gravatar we send Gravatar a hash of your email address, only when you choose it. The page also counts people with Priority Support who aren't shown, without naming them.

The OhMyShot app

This notice covers the website. The app has no server of its own; uploads go only to storage you set up, and update checks go to GitHub.

Cookies

We set two cookies, both strictly necessary: a sign-in cookie that keeps you signed in for up to 30 days, and a cookie that lasts ten minutes while you sign in with GitHub. We don't use advertising or tracking cookies. Paddle's checkout may set its own cookies to process payments and prevent fraud.

Who processes it

• Cloudflare hosts this site and forwards support email; no analytics.
• Paddle is our reseller and Merchant of Record. It processes payments and handles tax, receipts and refunds as an independent controller under the Paddle privacy notice.
• GitHub handles sign-in if you choose to sign in with GitHub, and supplies your GitHub picture if you choose it for the thank-you wall.
• Gravatar (Automattic) supplies your Gravatar picture if you choose it for the thank-you wall.
• Purelymail hosts ohmyshot.org's email: it delivers the emails we send you, from noreply@ohmyshot.org, and stores the messages you send to support@ohmyshot.org.

These providers may process data outside your country. We don't sell your data or share it with advertisers.

Why we use it

We use your data to run your account, to deliver what you bought (Priority Support and, if you turn it on, the thank-you wall), to keep the site secure, and to meet legal obligations. The legal bases are performing our agreement with you, our legitimate interest in running a secure service, and legal obligations. The thank-you wall relies on your consent, which you withdraw by turning it off.

How long we keep it

Account data is kept until you delete your account. Sign-in sessions end after 30 days or when you sign out. An uploaded picture is deleted when you remove or replace it. We keep the purchase record Paddle sends us for as long as your account exists; Paddle keeps transaction records for as long as tax and accounting law require.

Your rights

You can turn the thank-you wall off, change your name on it or remove your picture at any time in your account. You can also ask for a copy of your data, ask us to correct it, or ask us to delete your account. Depending on where you live, you may also object to or restrict some uses and complain to a data protection authority. Email support@ohmyshot.org and we'll reply within 30 days.

Children

The site isn't directed at children under 16, and we don't knowingly collect their data.

Changes

We'll update the date at the top when this notice changes.

Contact

Privacy questions and requests: support@ohmyshot.org.