Account protection without unnecessary friction
New customer passwords require a 15-character minimum and support long passphrases. Passwords use salted, memory-hard scrypt hashing. Existing supported hashes are upgraded on successful sign-in. Passwords are not stored as readable text and cannot be emailed back to you.
Sign-in, recovery, verification, and generation requests have rate limits. Customer and administrator sessions are separated. Browser sessions use HttpOnly, Secure cookies on HTTPS, and state-changing requests must come from the application’s origin. Recovery and verification tokens are random, stored as hashes, time-limited, and single-use.
Email verifies control of the address
Our standard flow lets you create one successful wallpaper, then asks you to verify the account email before continuing. A failed generation does not consume that first result. Your first saved image remains available for download.
Email verification is different from identity, age, or payment verification. It confirms access to an inbox. Account recovery sends a 30-minute reset link and revokes existing sessions after a completed reset. The account guide explains the complete flow.
Personal AI connections stay personal
Personal provider keys are encrypted on the server. Saved keys are not returned in connection lists, account exports, public gallery pages, or share links. Enter secrets only in the dedicated API key field. Changing a provider host requires entering its key again.
Personal API requests use public HTTPS endpoints with private-network and redirect checks. Image download URLs do not receive your API authorization headers. Your selected provider receives the prompt and any source image needed for a revision; its privacy, retention, billing, and usage terms still apply. Review supported connection formats.
Keep private work separate from published work
Successful creations are saved privately. Publication is a separate action, requires verified email, and may require administrator review. A public wallpaper page can reveal the artwork, title, creative prompt, display name, and selected settings. Review those details before sharing.
Downloading an image does not publish it. Public pages can be copied or indexed. You can make your own published wallpaper private again; copies already downloaded by others are outside the app’s control. Read the Privacy Policy for data handling and support requests.
Report a concern responsibly
Use the security report contact form to describe a suspected issue. Include the affected route, a clear description, and safe reproduction steps using your own account. Do not include active credentials or another person’s private content.
These controls are a description of the current product, not a claim of an independent audit or a promise that every external AI provider is secure. Keep your inbox protected, use a unique password, and revoke unfamiliar sessions from Account & security.