Privacy Policy

This Privacy Policy applies to the RemuWalls mobile application (package identifier: com.remuwalls, hereby referred to as “Application”) created and operated by Appnexia Studio (hereby referred to as “Service Provider”, “we”, “us”, or “our”) as a Freemium (Free & Subscription-supported) service. This service is provided “AS IS”.

1. Information Collection and Use

To provide you with the Application's core features—specifically user authentication, Real-Time Partner Sync, cloud favorites, daily sync quotas, and subscription management—the Service Provider collects and processes the following categories of personal and technical information when you register, sign in (via Email or Google Sign-In / OAuth 2.0), or use the Application:

• Account & Profile Data: Display name (First Name and Last Name), Username, Email Address, and unique account UUID.
• Google OAuth Authentication Data: When you tap "Continue with Google", we receive your verified Google email address, display name, profile image URL (if present in OAuth metadata), and cryptographic Google ID Token / OAuth subject identifier.
• Partner Sync & Push Notification Data: Your paired group identifier, active device identifier, and Firebase Cloud Messaging (FCM) registration token used strictly to deliver real-time wallpaper sync updates between paired partners.
• Subscription & Billing Entitlement Data: Google Play purchase tokens, product identifiers (such as Starter, Plus, or Unlimited plans), and daily sync quota counters (we never receive or store your credit/debit card numbers).
• Device & Advertising Identifiers: Device model, Operating System version, Google Advertising ID (AD_ID), and crash/performance diagnostics.
• In-App Usage Data: Wallpapers viewed, downloaded, favorited, or synced, and rewarded ad completion verifications.

The Application does not collect precise GPS location data and does not use your personal data or Google user data to train Artificial Intelligence (AI) or Machine Learning (ML) models.

2. Google OAuth 2.0 & Google API Services User Data Policy

The Application integrates Google Sign-In (Continue with Google) via Android Credential Manager, Google Identity Services, and Supabase Auth. To ensure complete transparency and compliance with Google's OAuth 2.0 policies, we disclose the exact manner in which the Application accesses, uses, stores, protects, and shares Google user data:

• OAuth Scopes & Data Accessed: We request only non-sensitive OpenID Connect scopes ("openid", "email", and "profile" / userinfo.email and userinfo.profile) after you grant explicit consent. This provides us only with your Google email address, basic display name, and cryptographic Google ID Token.
• How We Use Google User Data: We use this data exclusively to authenticate your identity without requiring a separate password, create your user record in our "profiles" table with an auto-generated default username, and maintain your authenticated session for Partner Sync and saved favorites.
• How We Store & Protect Google User Data: Your authenticated email address, derived username, and user ID are transmitted over TLS/HTTPS encryption and stored encrypted at rest (AES-256) in our managed Supabase database. We never access private Google Workspace or personal data such as Gmail messages, Google Drive files, Google Photos, or Google Contacts.
• Strict Prohibition on Unauthorized Sharing & AI Training: We do not sell Google user data. We do not use or transfer Google user data for serving advertisements (including retargeting, personalized, or interest-based advertising). We do not transfer Google user data to data brokers, and we do not use Google user data to develop, improve, or train generalized or foundational AI/ML models.
• Human Access Restrictions: We do not allow humans to read your Google user data unless we have your affirmative consent for a specific support request, it is necessary for security or abuse investigation, or it is required to comply with applicable law.

3. Log Data & Diagnostic Information

Whenever you use the Application, in the event of an error, network failure, or app crash, we collect diagnostic data and information (through Google Play Services and Firebase Analytics/Diagnostics) called Log Data. This Log Data may include your device's Internet Protocol (“IP”) address, device model, operating system version, app version code, the configuration of the Application when utilizing our Service, the time and date of the event, and stack trace diagnostics strictly to identify and fix bugs.

4. Advertising IDs, Rewarded Ads & Consent Management (UMP)

While mobile applications do not use standard browser cookies, the Application uses secure authentication session tokens, unique device identifiers (including the Google Advertising ID via com.google.android.gms.permission.AD_ID), and third-party SDKs (such as Google AdMob and Google Analytics for Firebase) to keep you logged in, measure aggregated app performance, serve advertisements to free-tier users, and verify rewarded video ad completions (via AdMob Server-Side Verification) when you unlock bonus sync credits.

Where required by regional privacy laws (such as GDPR in the EEA/UK), the Application presents a certified consent dialog powered by the Google User Messaging Platform (UMP) SDK so you can grant, customize, or withdraw your consent for personalized advertising. You can also reset or delete your device's Advertising ID at any time in your Android system settings (Settings → Google → Ads).

Background Processing, Push Tokens & Device Permissions

To deliver the Real-Time Partner Sync functionality, the Application requests specific Android permissions: Set Wallpaper (SET_WALLPAPER), Foreground Service Data Sync (FOREGROUND_SERVICE_DATA_SYNC), and Post Notifications (POST_NOTIFICATIONS). When you pair with a partner, your device's Firebase Cloud Messaging (FCM) token is registered in Supabase so that when your partner sends a wallpaper sync, your device receives a push payload and runs a background/foreground sync worker to crop and apply the wallpaper to your home or lock screen. When you log out of the Application, your device's active FCM sync token is automatically released.

5. Backend Infrastructure & Google Play Billing

We utilize Supabase as our secure backend infrastructure for user authentication (Email/Password and Google OAuth/ID Token verification), database storage, and Edge Functions. All personal data is encrypted in transit (HTTPS/TLS) and encrypted at rest on Supabase's servers.

All RemuWalls PRO subscriptions (remuwalls_starter, remuwalls_plus, and remuwalls_unlimited) are processed directly by Google Play Billing. Appnexia Studio never collects, accesses, or stores your credit card, debit card, or bank account numbers; our backend only verifies cryptographic purchase tokens issued by Google Play to manage your subscription tier and daily sync quota.

6. Third-Party Service Providers

We share data only with essential infrastructure and SDK providers required to authenticate your account, deliver push notifications, process Google Play subscriptions, analyze crash/usage telemetry, and display advertisements. Below are links to the Privacy Policies of our third-party service providers:

• Google Play Services & Google Identity Services (Google Sign-In)
• Google API Services User Data Policy
• AdMob & Google User Messaging Platform (UMP)
• Google Analytics for Firebase & Firebase Cloud Messaging (FCM)
• Google Play Billing
• Supabase (Authentication, Database & Edge Functions)

7. International Data Transfers

Your information, including Personal Data, may be transferred to — and maintained on — secure servers located outside of your state, province, or country where data protection laws may differ from those of your jurisdiction. By using the Application, you consent to the transfer and processing of your data on secure servers located in Singapore (operated by Supabase) and Google's global cloud infrastructure.

8. Your Data Protection Rights (GDPR, UK GDPR & CCPA)

Depending on your location (including the EEA, UK, or California), you have specific statutory rights regarding your personal data:

• The right to access, update, or request deletion of the personal data we hold about you.
• The right of rectification (to correct inaccurate or incomplete data).
• The right to object to or restrict our processing of your personal data.
• The right to withdraw consent at any time (including revoking Google OAuth permissions via your Google Account settings or updating ad consent).
• The right to data portability (receiving a copy of your personal data in a structured, machine-readable format).

9. Data Retention Policy

We retain your account and profile data for as long as your account remains active so that your Partner Sync connection, saved favorites, and subscription entitlements remain intact whenever you return to the Application. We do not automatically delete inactive accounts. When you request account deletion, all personal data (including your email address, Google OAuth identity link, username, FCM token, favorites, and partner group links) is permanently deleted from our active databases within 7 business days, except where minimal anonymized transaction records must be retained to comply with tax, accounting, or fraud-prevention laws.

10. Account & Data Deletion (In-App & Web Portal)

In compliance with Google Play's Account Deletion Policy and Google OAuth requirements, you can delete your account and all associated personal data at any time—even without reinstalling the Application.

You can also stop all device-level data collection at any time by uninstalling the Application from your mobile device.

11. Children's Privacy (COPPA Compliance)

The Application is intended for general audiences aged 13 and older and is not directed at children under the age of 13. The Service Provider does not knowingly collect personally identifiable information (via Email or Google Sign-In) from children under 13 years of age. If we discover that a child under 13 has provided personal information, we will immediately delete their account and data from our servers. If you are a parent or guardian and become aware that your child has provided us with personal information, please contact us at remuwalls@appnexia.com.

12. Security & Policy Updates

The Service Provider is committed to safeguarding the confidentiality and integrity of your data. We implement industry-standard physical, electronic, and procedural safeguards—including HTTPS/TLS encryption in transit, AES-256 encryption at rest, Row-Level Security (RLS) policies, and cryptographic OAuth ID token validation—to protect the information we process and maintain.

This Privacy Policy may be updated periodically. If we make material changes to how we access, use, or share personal or Google user data, we will update this page and notify users as required by law.

13. Contact Us

If you have any questions or concerns regarding this Privacy Policy, our data handling practices, or Google OAuth data usage, please contact the Service Provider (Appnexia Studio) via email at remuwalls@appnexia.com.