1. Controller and scope
This policy covers Yelomyth Wallpapers, the Android app under the Yelomyth Labs brand and publisher name, and this privacy webpage. It does not describe the separate desktop wallpaper shop or its payment processes.
Data controller:
Yelomyth Labs
Proprietor: Kevin Mende
Behmstraße 7
13357 Berlin Mitte
Email: info@yelomyth.com
2. Data on your device
The app stores the wallpaper catalogue, favourites and the time they were added, download metadata such as artwork, file path, size and time, and dismissed catalogue notices locally. Your language choice is stored in local preferences. Image previews are cached for faster loading.
There is no Yelomyth user account or Yelomyth cloud synchronisation of favourites or preferences. Loading the catalogue, images and video previews still requires network requests. Android backups are explained separately in section 9.
The app keeps purchase credentials and a separate entitlement status encrypted in secure device storage. The status also contains the validation time. It supports the interface and ad-free state; new protected downloads require server validation.
3. Google Play Billing and purchase validation
Static wallpapers are free. Google Play offers a one-time unlock of all current and future Live Wallpapers and removal of advertising. This is a non-consumable purchase, not a subscription.
Google Play handles payment through your Google account. The app does not collect card or bank details. It receives purchase status and a purchase token from Google Play.
For purchases, restoration and entitlement revalidation, the app sends the following to the Yelomyth entitlement service over HTTPS: platform, product identifier, app package name, purchase token and, when requesting live files, their artwork identifiers. The server verifies the purchase through the Google Play Developer API and acknowledges an eligible purchase with Google when needed. Local purchase status alone never authorises a protected download.
The reviewed first-party server code does not create a persistent purchase or user database. It uses the purchase token to handle the request and verify it with Google. Google’s purchase records and technical hosting logs are separate.
4. Protected Live Wallpapers
After successful server validation, the app receives a time-limited download authorisation. The download sends an artwork identifier and expiry time in the URL and a separate authorisation token in an HTTP header. This authorisation is not saved as a permanent purchase credential.
Full live videos are saved in private app storage and used to play Android live backgrounds. Existing files may be reused through the existing entitlement flow. A new download requires server-confirmed access again.
At your request, static wallpapers are saved to the gallery under Pictures/Yelomyth or set as a background through Android. These exported images are separate from private live videos and image caches.
5. Google AdMob and consent management
Google Mobile Ads (AdMob) and Google’s User Messaging Platform (UMP) are integrated. Ad requests occur only with valid advertising configuration, a resolved entitlement status without an active ad-free entitlement, and permission to request ads from UMP. If the consent flow fails, the app does not request ads during that session. An active unlock suppresses advertising.
UMP requests consent information, displays required privacy messages and stores choices or consent signals locally. Available privacy options can be reopened and choices changed in Settings → “Privacy & ad settings”. When UMP does not offer options, the row remains visible but is disabled.
When the advertising service is used, Google’s SDK documentation describes processing of IP addresses (including approximate location estimation), app and ad interactions, technical diagnostic and performance data, and device or account identifiers such as advertising ID and app set ID. Purposes include advertising, measurement and fraud prevention. Permitted ads depend on consent, region and settings; non-personalised ads do not automatically mean “no data processing”.
The SDK declares permissions for Android advertising ID and AdServices advertising ID, attribution and topics. A declared permission does not prove that every feature is used on every device. You can also manage advertising ID and available privacy features in Android settings.
Further information: Google’s SDK data disclosures and Google’s use of information from partner apps.
6. Permissions, accounts and diagnostics
The app has no Yelomyth sign-in, user uploads or publishing of user-generated content. First-party app code does not access contacts, the camera, microphone or GPS location. Google’s approximate location inference from an IP address is separate.
To save wallpapers to the gallery, the app requests external storage write permission on Android 9 and earlier. On Android 10 and later, it saves its own images through MediaStore without that permission. The app does not scan or upload your existing personal photo library. It accesses its own files and wallpapers it has saved.
No first-party product or marketing analytics service is integrated. The prepared first-party crash reporter sends no reports. Technical measurement by the integrated Google services, particularly the advertising SDK, is separate and described in section 5.
7. Network connections, servers and security
The app loads its catalogue and media over HTTPS from yelomyth.com and uses its purchase-validation and protected-download service. The connection processes your IP address. Hosting provider IONOS supplies the infrastructure. Technical access logs may contain requested paths, timestamps, HTTP status and connection or client information.
To limit abusive purchase-validation requests, the first-party server stores hourly request counters under a hash of the IP address or IPv6 network prefix. This is a pseudonymous security association, not guaranteed anonymisation. First-party API code does not log purchase or download tokens.
HTTPS, secure device storage, server-side purchase validation and time-limited download authorisations help protect data and media. They do not provide a guarantee of absolute security.
8. Retention and deletion
- Favourites and preferences remain stored locally until you change or remove them, reset app storage through Android or uninstall the app. Download metadata and private live videos remain stored for app use until the relevant app data is removed. The Android backup behaviour in section 9 also applies; no fixed automatic deletion period is implemented.
- “Clear cache” in Settings removes image-preview caches and in-memory image caches. It does not erase all app data, purchase credentials or private live videos.
- You can clear app storage or uninstall the app through Android to remove local private app data. Delete exported images separately in your gallery. Existing system backups are not necessarily deleted and may restore data later.
- Purchase credentials and the entitlement cache are retained locally for as long as needed to validate purchases, restore them and operate the unlock securely. On confirmed permanent denial, the app attempts to remove or invalidate them; a temporary network error does not trigger deletion. Resetting the app does not delete a purchase held by Google Play.
- Server security counters are cleaned up during subsequent validation requests when their hourly window is older than the preceding window. Files can remain longer without further requests or if deletion fails; this is not a guaranteed deletion deadline.
- Google’s data is governed by its respective policies and account settings. See Google’s data retention information.
Hosting and security logs and related backups may be retained by the hosting provider under its operational and security policies, particularly for secure operation, abuse prevention and troubleshooting. We do not promise a fixed deletion deadline that is not documented.
Contact correspondence is retained for as long as necessary to handle the request and meet applicable legal obligations. Where records are subject to statutory retention requirements, they are not deleted contrary to those requirements. Google applies its own retention rules and legal obligations to purchase and billing data it processes. Guaranteed immediate deletion is not promised.
9. Android backup and device transfer
Backup rules exclude private protected full live videos under files/live/ from Android Auto Backup and the configured cloud and device-transfer mechanisms. Other local data, including the database, preferences and UMP consent signals, is not categorically excluded and may be backed up or restored depending on Android, your device and settings.
The encrypted entitlement cache and purchase credentials depend on secure device storage; restoration is not guaranteed. Restored local data never replaces server authorisation for a new protected download. Manage backups through your device or backup provider settings.
10. This privacy webpage
This page delivers text and local styling directly as HTML and CSS. It needs no JavaScript and contains no advertising, analytics pixels, embedded third-party content or remotely loaded fonts. The page code sets no cookies and uses no browser local storage.
Loading the page involves necessary connection data at the web server; sections 7 and 8 also apply to its hosting logs. External links load the linked website only when opened. Clicking the contact address opens your email application; a message is transmitted only when you send it.
11. Recipients, purposes and legal bases
Recipients are Yelomyth’s hosting infrastructure at IONOS and Google for payment handling, purchase validation, consent management and, where enabled, advertising. First-party app code does not send your favourites list to the entitlement service. If you send an email, Yelomyth Labs processes your address and message to respond to your request.
Providing requested app functions and validating purchases serves contract performance (GDPR Article 6(1)(b)); without required purchase data, protected access cannot be verified. Operation and abuse prevention serve the legitimate interest in a secure service (point (f)). Where required, advertising processing relies on consent (point (a)), which can be withdrawn for the future. Processing required by law relies on point (c). We handle contact requests to address pre-contractual or contractual matters (point (b)), or otherwise based on our legitimate interest in responding to enquiries (point (f)).
Google services may process data outside the EU or EEA, including in the United States. Applicable recipients, responsibilities and transfer mechanisms are described in Google’s Privacy Policy and its international transfer information. Exclusively European processing is not promised.
12. Your rights, contact and changes
Subject to the applicable legal conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests for reasons relating to your situation, and to direct marketing at any time. You may withdraw consent for the future without affecting the lawfulness of previous processing. You may complain to a data protection supervisory authority, particularly where you usually live, work or where an alleged infringement occurred.
Contact info@yelomyth.com. Do not send purchase tokens, download authorisations, passwords or complete payment details. If identity verification is necessary, we will discuss it with you individually.
This policy will be updated when the app or its data handling changes. The revision date appears at the top of the page.