Legal

Privacy Policy

Effective date: June 8, 2026  ·  Last updated: August 31, 2026

1. Who We Are (Data Controller)

The data controller responsible for your personal information is:

• Operator: Katya Apps
• Contact email: support@katyaapps.com
• Address: Amman, Jordan

2. Information We Collect

2.1 Information you provide to us

• Account information. If you sign in with Google, we receive your Google account identifier, display name, email address, and profile photo as permitted by your Google settings.
• Profile information. Display name, biography, profile and cover images, website link, and social or gaming handles you choose to add.
• User-generated content. Wallpapers and live wallpapers you upload, titles, tags, AI prompts associated with an upload, comments, and likes.
• AI generation inputs. The text prompts you enter and any reference images you provide to generate or edit wallpapers.
• Purchases. Records of in-app purchases and subscriptions, including the purchase token and product identifier supplied by Google Play, and your credit balance. We do not receive or store your full payment-card details; payments are processed by Google Play.
• Messages and chat content. If you use the messaging features: the text of your direct and group messages, voice messages you record (microphone access is used only while you hold the record button), wallpapers you share into chats, stories you post, chat customization choices, and related metadata such as delivery/read status and timestamps.
• Communications and reports. Messages, copyright/DMCA notices, and abuse reports you submit to us, including their contents.

2.2 Information collected automatically

• Device and installation identifiers. A device identifier generated by the App, your Android Advertising ID, and Firebase installation/messaging identifiers used for push notifications.
• Approximate location. We derive your country from your IP address (using a geolocation database) to select the appropriate advertising provider and to apply regional settings. We do not collect precise GPS location.
• Usage and log data. Interactions such as downloads, views, likes, AI generations, credit claims, app version, device model, operating-system version, language, and the date and time of requests.
• Network information. Your IP address, which is processed transiently to deliver content, detect your country, and protect against abuse and rate-limit violations.

3. How We Use Your Information

We use your information to:

• Provide, operate, and maintain the App and deliver wallpapers and features you request;
• Generate, edit, and upscale AI images based on your prompts and reference images;
• Operate the community feed, profiles, comments, follows, and leaderboards;
• Deliver the messaging features — direct messages, group chats, voice messages, stories, presence (online/last seen), and search across your own conversations;
• Screen content for safety and legal compliance, and moderate user-generated content (see Section 5);
• Process purchases, manage credit balances, and prevent fraudulent or duplicate transactions;
• Send push notifications you have not disabled (for example, social activity and daily credits);
• Select and display advertising, including determining the appropriate ad provider for your region;
• Detect, prevent, and respond to abuse, spam, security incidents, and policy violations;
• Respond to your requests, reports, and legal notices; and
• Comply with applicable laws and enforce our Terms of Use.

4. Legal Bases for Processing (EEA / UK)

If you are in the EEA or the UK, we process your personal information under the following legal bases of the GDPR / UK GDPR:

Purpose	Legal basis
Providing the App and the features you request	Performance of a contract (Art. 6(1)(b))
AI generation and content delivery	Performance of a contract (Art. 6(1)(b))
Content moderation, safety, and abuse prevention	Legitimate interests, and compliance with legal obligations (Art. 6(1)(f), 6(1)(c))
Personalized advertising	Consent (Art. 6(1)(a)) where required
Non-personalized advertising and analytics	Legitimate interests (Art. 6(1)(f))
Push notifications	Consent / legitimate interests, subject to your device settings
Legal compliance and responding to lawful requests	Compliance with a legal obligation (Art. 6(1)(c))

Where we rely on consent, you may withdraw it at any time. Where we rely on legitimate interests, you may object to that processing (see Section 12).

5. AI-Generated Content and Content Moderation

The App offers AI image generation and hosts user-generated content. To provide these features and to keep the community safe, we share certain content with specialized service providers:

• AI image generation. The text prompts and any reference images you submit are sent to our AI generation provider (Runware) to produce or edit an image. Prompts may also be sent to a language-model provider (DeepSeek) to refine your prompt.
• Content safety screening. Text you submit (including prompts, titles, tags, profile names, and biographies) and images you upload or generate are screened for unsafe content using automated content-moderation services (OpenAI and Anthropic). Profile photos, cover images, and the photos you provide to the AI features are checked before they are stored; images you publish to the community feed are screened and may be removed if they violate our rules. Any image that fails review is rejected or removed. Reports you submit may be analyzed by an automated classifier (DeepSeek) to assist our review.

This screening is automated; the providers above do not perform human review of your content on our behalf, and we instruct our providers not to use your content to train their models. AI-generated images are produced by a machine-learning model and may not be unique. We strictly prohibit, screen for, and report unlawful content, including any sexual content involving minors.

6. Messaging, Stories, and Chat

The App includes an optional messaging feature: one-to-one direct messages, invite-only group chats, voice messages, wallpaper sharing, and stories that expire after 24 hours. Messaging requires a signed-in account. This section explains how that data is handled.

• Storage and encryption. Your messages and voice messages are transmitted over encrypted connections (HTTPS/TLS) and the message text and voice-recording links are additionally encrypted at rest (AES-256) on our servers. Messaging is not end-to-end encrypted: we hold the encryption keys and can access message content where necessary to run automated safety screening, review content that is reported to us, enforce our Terms, comply with legal obligations, or protect our users. We designed it this way deliberately so that abuse inside chats can be acted on.
• Automated safety screening. The text of messages is screened by an automated content-moderation service (OpenAI, see Section 7). Content that the screening flags, and messages that other users report, may be reviewed by our moderation team. We strictly screen for and report unlawful content, including any sexual content involving minors.
• Voice messages. Voice recordings are captured only while you actively record, are limited in length, and are stored on our servers so recipients can play them. Recordings that never become part of a sent message are deleted automatically.
• Stories. Stories are visible to other users while live and expire after 24 hours, after which the media files are deleted from our systems as part of routine housekeeping.
• Presence and receipts. People you chat with can see delivery and read indicators, typing/recording activity, and your online / “last seen” status. You can turn off your online status in the App’s settings (“Hide online status”), which hides it everywhere.
• Chat search. When you search your messages, the matching runs on our servers over your own conversations only; your search terms are processed transiently and are not logged.
• Push notifications. New-message notifications are delivered through Firebase, but the notification payload never contains the message text; the App fetches the content over an encrypted connection when you open the conversation.
• Chat customization. Your cosmetic choices (bubble style, font, background selection) are stored with your account. If you set a personal photo as your chat background, that photo stays on your device only — it is never uploaded to our servers and no other user can see it.
• Blocking and requests. A first message from someone you don’t follow arrives as a request that you must accept before the conversation continues. We store your block list to enforce your choices.
• Deletion. Deleting a conversation removes it from your view; like most messaging services, the other participant keeps their copy of the conversation. Deleting a message hides it from the conversation. Deleting your account permanently deletes the messages, voice recordings, and stories you sent from our systems (see Section 12.1).

7. How We Share Your Information

We do not sell your personal information for money. We share information only as described below:

7.1 Service providers (processors)

We use trusted third-party providers to operate the App. They process information on our behalf and under contract:

Provider	Purpose	Data involved
Google Firebase	Push notifications, app infrastructure	Device/installation identifiers, push token
Google Play Billing	In-app purchases and subscriptions	Purchase tokens, product IDs
Google Sign-In	Optional account sign-in	Account ID, name, email, photo
Google AdMob	Advertising (most regions)	Advertising ID, device data, IP
Yandex Ads	Advertising (certain regions)	Advertising ID, device data, IP
Runware	AI image generation and editing	Prompts, reference/generated images
OpenAI	Text and image content moderation (including chat-message safety screening)	Submitted text and images, message text
Anthropic	Automated image-safety screening	Uploaded images
DeepSeek	Prompt enhancement, report classification	Prompts, report text
Cloudflare R2	Image and media storage / delivery	Uploaded and generated media, voice messages, story media
MaxMind GeoIP	Country-level geolocation	IP address (to derive country)

Each of these providers processes data under its own privacy policy. We encourage you to review them:

• Google (Firebase, Play Billing, Sign-In, AdMob) — policies.google.com/privacy
• Yandex Ads — yandex.com/legal/international_ads_privacy_policy
• Runware — runware.ai/privacy
• OpenAI — openai.com/policies
• Anthropic — anthropic.com/legal/privacy
• DeepSeek — DeepSeek privacy policy
• Cloudflare — cloudflare.com/privacypolicy
• MaxMind — maxmind.com/en/privacy-policy

7.2 Other disclosures

• Legal and safety. We may disclose information to comply with applicable law, legal process, or enforceable governmental request; to enforce our Terms; to protect the rights, property, or safety of our users, the public, or us; and to report unlawful content (such as child sexual abuse material) to the appropriate authorities.
• Business transfers. If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to this Policy.

8. Advertising and Analytics

The App is supported by advertising. We use Google AdMob in most regions and Yandex Ads in certain regions, selected based on your country. Advertising partners may use your Advertising ID and related device information to deliver and measure ads.

• Consent in the EEA, UK, and Switzerland. Where required, we present a consent prompt (using Google’s User Messaging Platform) before personalized ads are shown. You can change your choice at any time from the App’s privacy settings.
• Your controls. You can reset or delete your Advertising ID, or opt out of ad personalization, in your device settings (Settings → Google → Ads on Android).
• For more information, see Google’s and Yandex’s respective privacy and advertising policies.

9. Identifiers and Similar Technologies

The App does not use browser cookies in the traditional sense, but it and our partners use device identifiers, advertising identifiers, software development kits (SDKs), local storage, and similar technologies to operate features, remember settings, deliver ads, and analyze usage. You can manage advertising identifiers through your device settings as described in Section 8.

10. International Data Transfers

We and our service providers may process and store your information in countries other than your own, including the United States and other jurisdictions that may have data-protection laws different from those in your country. Where we transfer personal information out of the EEA or the UK, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision, where applicable.

11. Data Retention

We retain personal information for as long as necessary to provide the App and for the purposes described in this Policy, unless a longer retention period is required or permitted by law. In particular:

• Account, profile, and community content are retained until you delete them or delete your account.
• AI prompts and reference images submitted for generation are processed to produce your result and are not retained by our providers for training; generated images you publish are retained until removed.
• Messages and voice recordings are retained until they are deleted — for example when you delete a message, when your account is deleted, or when the recipient’s copy is removed. Stories expire after 24 hours and their media files are deleted. Unsent voice recordings are purged automatically.
• Purchase and transaction records are retained as required for accounting, tax, and fraud-prevention purposes.
• Moderation and safety records may be retained as needed to enforce our policies and to comply with legal obligations.

When information is no longer needed, we delete or anonymize it.

12. Your Rights and Choices

Depending on where you live, you may have some or all of the following rights regarding your personal information:

• Access — request a copy of the personal information we hold about you;
• Rectification — correct inaccurate or incomplete information;
• Deletion — request that we delete your personal information;
• Restriction and objection — restrict or object to certain processing, including processing based on legitimate interests and direct-marketing/advertising;
• Portability — receive your information in a portable format;
• Withdraw consent — where we rely on consent, withdraw it at any time;
• Lodge a complaint — complain to your local data-protection authority.

12.1 How to exercise your rights

• In-app deletion. You can delete your account and associated data from within the App’s settings. You can also remove individual uploads and profile content at any time.
• By email. Contact us at support@katyaapps.com to make a request. We may need to verify your identity before acting on your request, and we will respond within the timeframe required by applicable law.

12.2 U.S. state privacy rights

If you are a resident of California or another U.S. state with comprehensive privacy legislation, you may have rights to know, access, delete, and correct your personal information, and to opt out of the “sale” or “sharing” of personal information or “targeted advertising.” We do not sell personal information for money. To the extent the use of advertising identifiers constitutes “sharing” or “targeted advertising” under applicable law, you may opt out via your device’s advertising controls (Section 8) or by contacting us. We will not discriminate against you for exercising your rights.

12.3 California Privacy Rights (CCPA/CPRA)

This section provides the disclosures required by the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”). Where another U.S. state grants comparable rights, we honor the equivalent rights for residents of that state.

Categories of personal information we have collected in the preceding 12 months, the sources, the business/commercial purposes, and the categories of third parties to whom each is disclosed:

• Identifiers (device identifiers, Android Advertising ID, Firebase installation ID, account ID, IP address) — sources: your device and your use of the App; purposes: operate the service, sign-in, security/anti-fraud, advertising; disclosed to: ad networks (AdMob, Yandex), Firebase, our hosting/storage providers.
• Internet or other network activity (app interactions, generation requests, diagnostics) — sources: your use of the App; purposes: operate and improve the service, safety/moderation, analytics; disclosed to: Firebase Analytics, our service providers.
• Commercial information (purchase/subscription records) — sources: Google Play Billing; purposes: fulfil purchases, entitlement, support; disclosed to: Google Play, our service providers.
• Geolocation data (approximate, country-level, derived from IP) — sources: your IP address; purposes: regional ad configuration and legal compliance; disclosed to: ad networks, geo-IP provider.
• Audio/visual information (images and any reference photos you upload for AI features or community posts) — sources: you; purposes: provide the requested feature, safety/moderation; disclosed to: our AI and moderation processors (see Section 7).
• Inferences — we do not build behavioral profiles beyond what the ad networks derive from the advertising identifier we share with them.

“Sale” and “sharing.” In the preceding 12 months we have not sold personal information for monetary consideration. We do “share” (i.e., disclose for cross-context behavioral advertising) the Advertising ID and related device/approximate-location data with our advertising partners (AdMob and, in some regions, Yandex). We do not knowingly sell or share the personal information of consumers under 16.

Do Not Sell or Share My Personal Information. You may opt out of this sharing: (a) in the App via the “Your Privacy Choices” control in Settings, which sets your ads to non-personalized; (b) through your device’s advertising controls (Section 8); or (c) by contacting support@katyaapps.com. We honor opt-out preference signals, including the Global Privacy Control (GPC), where technically feasible.

Right to limit the use of sensitive personal information. We do not use or disclose sensitive personal information for purposes other than those permitted under the CPRA (such as providing the service you requested and safety/security). To the extent any such use exists, you may request that we limit it by contacting us.

Authorized agents. You may use an authorized agent to submit a request to know, delete, correct, or opt out. We may require the agent to provide proof of authorization and may require you to verify your identity directly.

How to exercise these rights: use the in-App controls described above, the support@katyaapps.com address, or our data-deletion page. We will not discriminate against you for exercising any of these rights, and we will respond within the timeframe required by law.

13. Children’s Privacy

The App is intended for users aged 13 and older and is not directed to children under the age of 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe that a child under 13 has provided us with personal information, please contact us at support@katyaapps.com and we will take steps to delete such information and terminate the account.

Age information

The App does not ask for or collect your date of birth, your age, or any age category, and it does not store one on your device or on our servers. The minimum age for using the App is set out in our Terms of Use and on the app store listing, and the store’s own age controls (including any parental controls a family has set up) are what govern who can install it. All users of the App are treated the same way for advertising, analytics, and every feature; the European Economic Area, United Kingdom, and Switzerland consent prompt described in Section 8 applies to everyone in those regions.

Child safety

We prohibit child sexual abuse and exploitation (CSAE) and screen uploaded and AI-generated images for such content. See our Child Safety Standards for how we prevent, detect, and report it, and for our child-safety point of contact.

14. Data Security

We use technical and organizational measures designed to protect your personal information, including encryption of data in transit using HTTPS/TLS, encryption of stored chat message content at rest (AES-256), access controls, and rate limiting. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

15. Third-Party Services and Links

The App may contain links to, or integrate, third-party services (such as social platforms you add to your profile, or links opened in your browser). This Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you use. The privacy policies of the third parties we integrate to operate the App are linked in Section 7.

16. Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide additional notice within the App. Your continued use of the App after the changes take effect constitutes your acceptance of the revised Policy.

17. Contact Us

If you have any questions, requests, or concerns about this Policy or our privacy practices, please contact us:

• Email: support@katyaapps.com
• Operator: Katya Apps
• Address: Amman, Jordan