Privacy Policy
Ita Wall Studio ("the site") is a free online tool built and maintained by an independent developer, Yunpojun (云坡君). This policy explains what information the site collects, why, where it is stored, how long it is kept, and how you can view or delete it. If you have any questions, email 58139752@qq.com.
1. Summary
- You can build walls without an account, and your work is stored only in your own browser by default.
- Sharing, remixing other people's walls, liking and earning points require an account: we store your email, nickname and a hashed password.
- Your wall (including images) is only uploaded when you click "Share"; if you tick "publish to the gallery", everyone can see it there.
- The site counts visits and feature usage, but never stores your raw IP address, uses only the cookie needed for login (no advertising or cross-site tracking cookies), and never sells any data.
2. Information stored on your device
The following is kept only in your browser's local storage (IndexedDB / localStorage). The server cannot read it:
- The wall you are editing (auto-saved) and the saves you create;
- Your language choice, an invite code, and starter tasks you finished before logging in (their points are claimed after you log in);
- The date you first opened the site (used for retention statistics, see section 4).
When you log in, your browser keeps a login cookie (itawall_sess, valid for 30 days and not readable by page scripts) that is only used to recognise that you are logged in. Clearing the site data in your browser deletes all of it. The "AI cut-out" feature runs entirely in your browser and your images are not uploaded; the first time you use it, the model files are downloaded from the jsDelivr / IMG.LY CDN.
3. Information stored on the server
| Information | Purpose | Retention |
|---|---|---|
| Account: email, nickname, password (salted hash that cannot be reversed), invite code and who invited you, sign-up time | Logging in, password reset, showing your nickname, invite rewards. Your email is never shown publicly and never used for marketing | Until you delete your account |
| Email codes (hash only) | Confirming the email is yours when signing up or resetting your password | Expire after 10 minutes and are cleaned up daily |
| Login sessions (token hash only) | Keeping you logged in | 30 days; deleted immediately when you log out or change your password |
| Walls you share: name, layout, images, an automatic thumbnail, and whether it is in the gallery | Creating the share link; public walls appear in the gallery where others can view, like and remix them | Until you delete it or your account, or it is removed for breaking the rules |
| Likes, remix records, starter tasks, points and the points log (including tips and redemptions), finishes and templates you redeemed, share counts | Weekly quotas, like counts, points and the items you redeem in the Points shop | Until you delete your account |
| Which days you opened the site while logged in (date only, no time or activity) | Retention statistics for registered users (how many come back on day 1, 7 and 30) | Deleted automatically after 400 days, and immediately when you delete your account |
| A salted hash of your IP address (it cannot be turned back into the IP) | Rate limiting and abuse prevention | Same as the related share; rate-limit counters are deleted automatically after 1 hour to 1 day |
| Reports: the reason you enter and an IP hash | Handling rule-breaking content and preventing abusive reports | Up to 1 year after the report is handled |
Please note: anyone with a share link can see every image and piece of text in the wall, and walls in the gallery are visible to everyone with your nickname next to them. Do not include ID documents, addresses, phone numbers, photos of other people or other private information.
4. Usage statistics
To understand how many people use the site and which features are popular, the site records:
- Page views and how often each feature is used (for example "added a polaroid" or "applied a preset"), aggregated per day and not linked to any individual;
- Daily unique visitors, de-duplicated with a hash of "date + IP + browser identifier + secret key". This value changes every day, so it cannot track the same person across days and cannot be turned back into an IP address. It is deleted automatically after 120 days;
- Retention: your browser stores the date you first opened the site on your device, and once a day reports only a number, "day N since first visit". The server only counts these per day, with nothing that could identify you.
5. Verification and service providers
The site runs on Cloudflare (hosting, data storage and Turnstile verification). Verification before sending an email code is provided by Cloudflare Turnstile, which processes browser and device information to tell humans from bots; see the Cloudflare Privacy Policy. As an infrastructure provider, Cloudflare processes access logs (including IP addresses) under its own policy.
Code emails are sent through Resend (USA), which only receives your email address and the email content; see the Resend Privacy Policy.
Cloudflare and Resend are international services, so your data may be stored or processed outside your country. By creating an account you acknowledge and agree to this.
6. Your rights
- Do it yourself: in your account you can see your shares, points and tasks, change your nickname, remove walls from the gallery or delete them, and delete your account (your account, points and every wall you shared are permanently deleted right away).
- Or email me: from your account email, write to 58139752@qq.com to access, correct or delete your data, or to withdraw consent. I will handle it within 15 working days. Withdrawing consent does not affect processing that happened before.
7. Children
If you are under 14, or under the age of digital consent where you live, please use the share feature only with a parent or guardian's permission. If a guardian finds that a child uploaded personal information without permission, please contact me and I will delete it.
8. Security
The site uses HTTPS, validates and filters uploaded content, and only the author can sign in to the admin panel. No transmission over the internet is completely secure, so please do not upload highly sensitive information.
9. Changes
When this policy changes, the "Last updated" date at the top will change; significant changes will be announced on the site.
This English version is a translation of the Chinese version. If they differ, the Chinese version prevails.