Privacy policy — Wristly

Operator and scope

Effective 7 October 2026. Hamid Alqwaysim, Jordan, operates Wristly and wristlyapp.com. This policy covers the iPhone app, its account and artwork service, and this website. Contact support@wristlyapp.com for privacy questions or requests.

On your device

Favorites and optional personal text are handled on your device. Your text is composited into the image locally; it is not uploaded to our account service. You choose whether to save an image to Photos or share it with another app. Your device backup settings and the destination app’s policies then apply. Wristly does not read your personal photo library to provide its catalog.

Account and purchases

Sign in with Apple provides an app-specific account identifier. Wristly does not request your name or email from Apple. Our service stores that identifier, an internal account identifier, a purchase-matching token, encrypted Apple credentials used for revocation, and hashed session credentials. We record product and transaction identifiers, subscription validity, credits, unlocked design IDs and reward-verification records to provide your access, restore account access and prevent duplicate grants. Apple processes payments; we do not collect your payment-card number.

Advertising and rewards

Wristly uses Google AdMob and Google’s consent tools. Ad requests are configured as nonpersonalized. The SDK may process IP address and approximate location derived from it, app/device identifiers, ad impressions and interactions, performance information and diagnostics for ad delivery, measurement and fraud prevention. Nonpersonalized advertising can still involve storage and identifiers. Wristly does not request iOS tracking permission or access IDFA. An optional rewarded ad sends an internal user identifier and an opaque reward request ID to Google, which returns signed reward details for server verification. We hide Wristly ads while your subscription is active or credits remain.

Your advertising choices

Where required, Google’s consent form is presented before ads may load. You can revisit advertising privacy choices in the Account area when the consent provider makes that option available. Watching a rewarded ad is optional. A denied or withdrawn consent choice does not remove purchased access.

Hosting, security and support

Cloudflare hosts our website, API, account database and artwork, and processes network/request information, including IP addresses, for delivery and security. The account ledger uses short-lived keyed digests for IP-based abuse prevention instead of storing raw IP addresses in those counters. Our static website has no analytics scripts or first-party tracking cookies. Support emails and attachments you send are processed through Cloudflare Email Routing and the receiving mailbox provider to answer your request. Do not send passwords, verification codes or payment-card details.

Retention and account deletion

Account, purchase, credit and unlock records are kept while your account exists and needed to provide and protect the service. Use Account → Delete account to remove active account records and sessions. This removes unused credits and recorded unlocks; it does not cancel an Apple subscription. We also attempt to revoke the associated Apple credential; if that fails, the app explains how to remove access in your Apple Account. Sign-in challenges expire after five minutes, sessions after at most 30 days, and unused reward requests after one hour; expired records are removed during cleanup. Short-lived abuse counters are also cleaned up.

Backups and limited retained records

Hashed purchase and reward identifiers, without the Wristly account ID, remain for the life of the service to prevent the same transaction being replayed after deletion. These are pseudonymous security records, not a claim of complete anonymity. Cloudflare database recovery can retain recoverable earlier states within a 30-day recovery window. Support correspondence is retained as needed to resolve the request, disputes and applicable legal obligations; you can request deletion. Providers may retain their own billing, security and operational records under their policies and legal obligations.

Sharing and international processing

We use Apple for sign-in and App Store billing, Google for ads and consent, and Cloudflare for hosting and email routing. We disclose only information needed for those functions, support, security and legal obligations. These providers may process data outside Jordan and your country. Their privacy policies describe their safeguards and practices. We do not operate a personal-data brokerage or sell account records.

Rights, children and changes

Depending on your location, you may request access, correction, a copy, deletion, restriction or objection, and withdraw consent where applicable. Contact support@wristlyapp.com; we may verify ownership before responding. You may also contact your local data protection authority. Wristly is not directed to children under 13; if you believe a child provided personal information, contact us. Material policy changes will be reflected here with an updated date and, where required, notice in the app.

Apple privacy · Google privacy · Google partner data use · Cloudflare privacy