Privacy and data controls

Who operates Wondaar

Wondaar is operated by Chris Grunthaner, doing business as Wondaar, in New York, USA. Privacy, access, correction, account-deletion and photo-removal requests are handled through admin@wondaar.com, which the operator monitors.

Information we use

Wondaar stores your email, display name, password hash, account/session and device records, and optional recovery or authenticator information to provide and protect your account. Collection details, item identifiers, inventory records and photos support collection management, backup and synchronization. Prices, costs, notes and storage locations belong to private inventory and are not public item fields.

The apps keep offline copies on your devices. Signing out can leave an offline collection available and is different from deleting an account. Wondaar cannot remotely erase every device or retrieve somebody else’s screenshots.

Profiles, shared items, articles, comments and messages use information you choose to provide. Technical logs can include IP addresses, request information and device/app details for reliability, abuse prevention and security. Feedback and support contain the text and technical details you submit. Automatic crash reports do not automatically attach collection records or photos; you can turn them off in the app. Avoid secrets or unnecessary personal information in feedback.

Website contact messages use the details you enter to answer your enquiry. Update subscriptions use your email and recorded consent/confirmation to send updates. The unsubscribe link stops those emails. Contacting support or requesting removal does not subscribe you to marketing.

Private collections and public sharing

Your inventory is private unless you choose to share an item. Choosing Public shares the supported item details and every photo attached to that item, including later additions, subject to the service’s moderation and visibility controls. Other collectors can view those public photos in Wondaar.

Choosing Private stops the item’s public sharing through the service. It cannot retrieve copies already captured by others. Public sharing and catalog-photo contribution are separate choices: sharing an item does not itself permit a separate catalog copy. Private-only inventory photos are outside the public-submission screening workflow.

Optional catalog contributions

Contributions require acceptance of the existing versioned photo terms. You keep ownership and must have the rights needed to contribute the photo. The recorded license permits storage, resizing, cropping, editing, display and distribution through official Wondaar applications and services. It does not give other collectors a general license to export, republish, sell or reuse the image elsewhere. This notice does not add an AI-training license.

Private stops future contributions, Ask requests permission and Automatic submits eligible copies after consent. Turning contributions off does not automatically withdraw an accepted catalog copy or remove private photos.

Pending contributions can remain linked to their contributor for review and withdrawal. Approved contributions become separate catalog copies with factual item associations, file hashes and identity-free terms receipts. The contributor association is removed from the approved record; historical backups and operational records do not instantly lose every older association. Accepted catalog copies can remain after the source item or account is deleted. A particular copy can be reviewed through the catalog-photo removal route.

Public automated image screening is not active. Human moderation remains in place. Any later provider screening requires updated disclosures and appropriate consent for its actual use.

Request account deletion

In Android, open Account and choose Request account deletion. Re-enter your password, type DELETE and review the notice before submitting. You may instead email admin@wondaar.com to begin a support request without installing or signing in to the app. Include the account email and a reply address. Never email passwords, reset/recovery codes or identity documents.

When an in-app request is accepted, the service disables sign-in, revokes sessions and records a date after a 30-day waiting period. Android signs out and attempts to erase that phone’s private local collection copy. If erasure fails, the app warns you to clear its storage before giving the phone to someone else. Other devices can retain offline copies.

Automatic permanent cloud deletion is currently disabled. The recorded waiting date is not a completion guarantee; requests may remain queued while the process is inactive. A support email by itself changes no account. Support verifies ownership and tells you what action was actually taken. Contact support if a request was made in error; cancellation or restoration is not guaranteed.

Once activated, the planned purge removes the account, private Vault, public profile/community content, messages, account-photo originals/thumbnails and unapproved catalog associations. Accepted catalog copies have a separate removal-review process.

Retention and backups

Active account and collection data remain while needed to provide the service. While permanent purge is disabled, a deletion request does not establish a fixed cloud-erasure deadline.

Encrypted backup archive objects are configured for deletion 30 days after creation, with soft deletion disabled. The planned live-deletion and narrow restore-ledger safeguards prevent recovery from reviving an actually purged account. This does not promise a 60-day maximum measured from a deletion request while permanent purge is inactive.

Ordinary cloud application/service logs currently use a 30-day retention setting. Required hosting security/audit logs use 400 days. These settings do not establish a universal deadline for every provider’s separate billing or security records.

The purge design gives restricted evidence of a reported message an expiry 180 days after the report. Cleanup is part of successful purge processing; a separate daily cleanup for that restricted table is not currently active.

Closed or dismissed in-app reports become eligible for cleanup when that account submits another report and the old report was received over 180 days earlier. Older closed reports can also be removed to enforce the account’s report storage limit. This is not guaranteed daily expiry. Open reports can remain while investigation or support is needed.

Privacy/removal support emails and case records are reviewed manually each month. Closed cases over 90 days old are deleted at that review unless information is still needed for a documented legal or security issue. An exception is limited to the information needed and reviewed again. This is a periodic manual process, not automatic deletion exactly 90 days after closure.

Permanent item identifiers, record types and record IDs remain reserved to prevent ID reuse; the Vault association is removed when that Vault is deleted. Previously accepted catalog copies and permission receipts follow the recorded terms and removal-review process. User-held copies and historical backups do not disappear immediately.

Service providers

Google Cloud hosts the API and protected backup/operations workloads. Neon stores PostgreSQL account and collection records. Cloudflare R2 stores photo and update objects. Resend delivers transactional and update emails. These providers handle information needed for their service functions under the applicable arrangements. This notice makes no unverified data-location, provider-training or zero-retention promise.

Privacy and photo-removal requests

Email admin@wondaar.com to request access, correction, deletion or review of a particular catalog photo. We may need to verify ownership or relevant facts before acting. Initial requests do not require a Wondaar account. For a photo, include its ID/link or enough item details to locate it, a brief reason and a reply address. Do not send passwords, reset/recovery codes, identity documents or extra photo files.

An authorized person reviews the request. Receiving an email does not automatically remove a photo. Account deletion, catalog-photo removal and newsletter unsubscribe are distinct. The draft-email action opens an unsent draft for you to review and send; opening it does not send a request or confirm receipt.

Changes to this notice

We will publish a dated notice when practices change and obtain additional consent where required for a new use. Catalog contributions remain governed by the versioned terms you accepted. Contact admin@wondaar.com with questions about this notice.