Wallnote Gallery

Family Art Gallery

Privacy Policy

Last updated: October 9, 2026

Operator: FengShui Master AI Inc. ("we", "us")

Mailing address: FengShui Master AI Inc., 13740 N Highway 183 Ste L2 #409, Austin, TX 78750

Contact: privacy@wallnoteapp.com

Support: support@wallnoteapp.com

Product: Wallnote Gallery (iOS + optional read-only web viewing links), a private family gallery for children's artwork.

1. Who the app is for

Wallnote Gallery is designed for parents and other adults. Accounts are adult-owned. We do not offer child logins. Information about children (such as a first name and age band you enter, and photos of artwork) is provided by the adult account holder and treated as personal information under laws such as COPPA (US) where applicable.

2. Information we collect

Depending on how you use the app, we may process:

A parent may enter a child's birth year and month, not the day, so we can calculate age.

We do not sell personal information. We do not share it for cross-context behavioral advertising. We do not use advertising trackers or cross-app tracking. Product analytics and push, when enabled, are for operating Wallnote Gallery for the parent account.

3. How we use information

4. AI processing

Active provider: Cloudflare Workers AI (Google Gemma model). While this page is published, optional museum notes are sent only to Cloudflare Workers AI, not to Google Gemini, Alibaba Cloud Model Studio, or OpenRouter. Cloudflare processes those requests on its network to provide Workers AI and states that it does not use them to train the models on Workers AI, or to improve Cloudflare or third-party services, without separate consent. The in-app consent screen names Cloudflare Workers AI before you agree.

Museum notes are optional. We do not send a drawing to an AI provider when you upload it.

The first time you tap Generate museum note or Regenerate, the app asks for a separate consent. That consent is separate from creating your account, from product analytics, and from notifications. The consent screen names the AI provider that will receive the drawing before you agree. If the app cannot confirm that provider, it does not name one and does not send the drawing. You can skip and write your own note.

Only when a parent gives that consent and taps Generate do we send the selected artwork JPEG, the child's first name, and their age band to the one provider in the section below. We do not send that drawing to any other AI provider at the same time. The hosted copy of this policy includes only the section for the provider that is active when the page is published. The in-app copy shows the Cloudflare Workers AI section. The consent screen names the same provider.

Cloudflare Workers AI (Google Gemma model)

Used when Cloudflare is the active provider. We send the artwork JPEG, the child's first name, and their age band to Cloudflare Workers AI. The model is a Google Gemma model hosted on Workers AI. The default model id is @cf/google/gemma-4-26b-a4b-it. Cloudflare processes that request on its network to provide Workers AI.

Cloudflare states that it does not use this content to train the models on Workers AI, or to improve Cloudflare or third-party services, unless you give separate consent. Cloudflare does not make that content available to other Cloudflare customers. Cloudflare does not create or train these models. The model is a third-party model hosted on Workers AI and may have its own license terms. Those statements are from Cloudflare's Workers AI data-usage terms, published at developers.cloudflare.com/workers-ai/platform/data-usage (page dated April 21, 2026).

While Cloudflare is active, that drawing is not sent to any other AI provider.

You can skip, write your own note, or edit or replace anything the model returns. You may later revoke that consent in Family, then About this gallery. We will ask again before the next generate.

Each artwork may receive 2 successful AI generations. Each parent may receive 20 successful AI generations per calendar day (UTC). Failed, empty, or timed-out drafts do not count. The first successful note uses Generate. One more successful note uses Regenerate. After two successful notes, AI generation is unavailable for that drawing and you can still write your own. Hitting a cap does not hide photos already in the gallery.

Do not tap Generate if you do not want that image and those child fields processed by the provider named on the consent screen.

5. Storage and processors

We use the following processors to run Wallnote Gallery:

Data is processed in regions configured for these services (our Functions are deployed in us-east1 unless changed).

6. Sharing

We share data with the processors above to run the app, and with other adults you invite into your family. An adult may also create an unlisted viewing link for one child's gallery. Anyone who has that exact URL can view that child's artwork and captions in a browser until the link expires or a parent revokes it. Viewing links are read-only (no upload, no AI generate, no family admin). Images are delivered through short-lived signed URLs, not long-lived public object links. This is not a public social feed. We do not list families or galleries for discovery. We may disclose information if required by law or to protect safety and the service.

We do not sell personal information. We do not share it for cross-context behavioral advertising.

7. Data retention

This is our written retention policy for personal information, including information about children.

We keep personal information only for the purpose it was collected, and only while that purpose still needs it. We do not keep children's personal information indefinitely.

After you delete an account or album, we delete or anonymize the related account data, and we delete residual photos within the cleanup period marked above, except where the law requires us to keep something or we need it for security or fraud.

You may export artwork copies from the iOS app: a single JPEG (share sheet or save to Photos), Save for frame (a JPEG in Photos for a digital photo frame, with the drawing's frame baked in when it has one, up to 50 at a time), or a gallery Export ZIP of up to 50 JPEG copies. Failed downloads are skipped. Frame JPEGs and the ZIP are built on your device. We do not send artwork to digital-frame companies.

You can delete a child's album in the app: open Family, tap the child, then Delete [name]'s album. After you confirm, we delete that child profile, their artwork metadata, and we try to delete their stored photos on R2. Other children's albums stay.

Account deletion is available in the app (not email-only): open Family, then About this gallery, then Delete Account. If you have not joined a family yet, open About and Delete Account on the family setup screen. You confirm with a warning, then type DELETE.

For help, email support@wallnoteapp.com. For privacy or COPPA/parent requests, email privacy@wallnoteapp.com. We delete or anonymize remaining account data within a reasonable period except where retention is required by law or for security/fraud.

8. Children's privacy

Wallnote Gallery is a parent tool. We collect information about children from the adult account holder, not through a child-directed login. Under COPPA, that information (first name, age band, and photos of artwork that may include a child) is treated as personal information.

Separate parental consent for non-essential disclosure. Creating an account lets us store the gallery with service providers that only run the feature you asked for (Google Firebase and Google Cloud for the account and metadata, and Cloudflare R2 for the photos you upload).

Sending a child's artwork, first name, and age band to an AI provider is not required to store the drawing. We ask for a separate parental consent on the consent screen before the first Generate or Regenerate. That screen names the provider before you agree. You can refuse and write your own note. Product analytics and push notifications are separate choices. Agreeing to an AI note does not agree to analytics or push. Leaving analytics on does not agree to send a drawing to an AI provider.

We do not disclose children's personal information to third parties for those parties' own advertising, for sale, or for those parties to train their models. The AI provider named on the consent screen may process the one request as described in the AI section. A further, separate consent would be required before that content is used to train a model.

Parents and guardians may review, export, or delete child-related gallery content through the adult account: delete a single drawing, delete a child's entire album, or delete the adult account. You may also contact us at privacy@wallnoteapp.com.

Product analytics and push notifications describe how the parent uses the app. We do not create child accounts, and we do not send children's names, birth dates, photos, or notes to PostHog or OneSignal. Analytics may include a fixed label such as an age band or frame style, tied to a hash of the parent account, not to a child profile.

9. Information security program

We maintain a written information security program for personal information, including children's information. It is scaled to a small family gallery.

The program includes: the Wallnote privacy team, reachable at privacy@wallnoteapp.com, who coordinates it; access limited to signed-in adult accounts; server-side checks so one family cannot read another's gallery; hashed viewing-link tokens; rate limits; short-lived signed URLs for upload and read; crash reports configured not to attach artwork or default personal data; and terms with the processors above that limit their use of the data to providing the service. We review the safeguards when we add a processor or change what we collect.

A viewing link is unguessable but works like a password: only share it with people you trust. No method of transmission or storage is perfectly secure.

10. Your choices

11. California privacy rights (CCPA / CPRA)

This section applies to California residents. It supplements the rest of this policy.

Categories we collect. In the 12 months before the date above, we collect these categories for the purposes in this policy:

We do not collect precise geolocation, payment card numbers, or government identification numbers. We ask PostHog not to derive a location from IP.

We do not sell or share. We do not sell personal information. We do not share personal information for cross-context behavioral advertising. "Share" in this section has that California meaning, not the family viewing link you choose to create.

Global Privacy Control. If your browser sends a Global Privacy Control signal (Sec-GPC) to our website, we honor it as a request to opt out of sale and sharing. Because we do not sell or share, the signal does not switch on a sale. You can also turn off product analytics in the app. The iOS app itself does not receive a browser GPC signal.

Your requests. You, or someone you authorize, may ask us to:

Send requests to privacy@wallnoteapp.com, or use the in-app delete and edit tools. We will confirm we received the request and respond within 45 days. If a request is complex or you have sent several, we may extend that once by another 45 days, and we will tell you why within the first 45 days. We may need to verify that you are the adult account holder before we complete a request. We will not ask you to pay a fee for a request unless the law allows it because the request is manifestly unfounded or excessive.

12. Other US state privacy laws

If you live in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, or another US state with a consumer privacy law, you may have similar rights to access, correct, delete, and obtain a copy of your personal information, and to opt out of sale, targeted advertising, and certain profiling. We do not sell personal information and we do not use it for targeted advertising or for profiling that produces a legal or similarly significant effect.

Children's data is sensitive. Information about a known child is sensitive personal information under these laws. We process it to provide the family gallery the parent requested. We send it to an AI provider only after the separate parental consent described above. We do not sell it.

Appeal. If we deny a privacy request, you may appeal by replying to that decision through the privacy contact. Tell us you are appealing and include the date of the denial. We will respond to the appeal within 45 days. Where the state's law allows up to 60 days to decide an appeal, we may use that longer period if we need it, and we will tell you. If we deny the appeal, we will explain how to contact your state attorney general when the law gives you that right.

13. International users

If you access the service from outside the United States, you understand your information may be processed in the US or other countries where our processors operate.

14. Changes

We may update this policy. Continued use after an update means you accept the revised policy, unless applicable law requires otherwise. If a change materially reduces how we protect children's information, we will ask for consent again where the law requires it.

15. Contact

Questions, COPPA or parent requests, and privacy rights requests: privacy@wallnoteapp.com Help: support@wallnoteapp.com

Operator: FengShui Master AI Inc. Mailing address: FengShui Master AI Inc., 13740 N Highway 183 Ste L2 #409, Austin, TX 78750

Retention schedule