Privacy
No account, no cookies, no tracking. Here is everything the wall touches.
Last updated: 24 August 2026.
Who is responsible
Savaş Koç. The postal address and email are in the imprint. Write there about anything on this page.
There is no data protection officer. A site this small does not have to appoint one.
The short version
- The site sets no cookies and stores nothing in your browser. There is no consent banner because there is nothing to consent to.
- There is no login, no account, no newsletter, no profile.
- This site's own database holds the picture, its caption, its price and two payment ids from Polar — no name, no email address, no IP address.
- Only Polar sees your email address, on the payment page.
Visiting the site
Cloudflare hosts the site. Every web server sees the requests it answers, and this one is no different. Cloudflare sees your IP address, the time, which page you asked for, which page you came from and which browser you use.
It uses this to send you the page and to block attacks. It does not use it to work out who you are, and does not combine it with anything else.
Why this is allowed: running a site that works is a legitimate interest — Art. 6 (1)(f) GDPR.
Statistics
Cloudflare Web Analytics counts page views, the sites people arrive from, and roughly which country they are in. The visitor number on the wall comes from these totals.
It sets no cookie and writes nothing to your device. It does not fingerprint your browser — that is, it does not build an id out of your settings — and it uses no identifier that would still work on another site. So it cannot follow you anywhere.
Why this is allowed: knowing whether anyone is looking is a legitimate interest — Art. 6 (1)(f) GDPR.
Spam protection
Cloudflare Turnstile guards the upload. To tell a person from a script, it receives your IP address and some signals about your browser.
Why this is allowed: keeping bots off the wall is a legitimate interest — Art. 6 (1)(f) GDPR.
Hanging a picture
Three things happen, in this order:
- The picture is checked. It goes to OpenRouter, which passes it to Google's Gemini model. The model marks it safe or unsafe. Only the picture is sent — nothing about you. A rejected picture is deleted at once, and you are not charged.
- The picture is stored. An accepted picture goes into Cloudflare storage under a random 16-character id. The database records its size, its file type, your caption, the price and the times.
- You pay. Checkout happens on Polar. Polar takes what it needs for payment and tax: email address, payment details, country. Polar decides for itself what to do with that data, so Polar's own privacy policy governs it, not this one. Only two ids and the confirmation that the money arrived come back here.
Why this is allowed: hanging your picture is the deal you asked for — Art. 6 (1)(b) GDPR. Checking it first is a legitimate interest — Art. 6 (1)(f) GDPR.
What everyone can see
Once you have paid, your picture hangs on the wall with its caption and its price. Anyone can look at it, save it, or find it through a search engine. It stays there.
Put nothing in a picture or a caption that you would not put on a poster in the street.
How long things are kept
- Pictures that were never paid for: deleted after one day.
- Pictures on the wall: kept as long as the wall exists. Nothing expires.
- Refunded pictures: taken off the wall at once. The file and its record stay, because tax law requires records of a sale to be kept.
Companies that handle this data
- Cloudflare, Inc. — hosting, storage, statistics, spam protection.
- Polar Software Inc. — payments.
- OpenRouter, Inc. and Google — checking pictures.
All of them are in the United States. Sending data there is covered by the standard contract terms the EU Commission has approved for this purpose, and, where it applies, the EU–US Data Privacy Framework.
What you can ask for
You can ask me to:
- tell you what data is held about you (Art. 15 GDPR)
- correct it (Art. 16)
- delete it (Art. 17)
- stop using it for a while (Art. 18)
- hand it to you in a file you can take elsewhere (Art. 20)
- stop any use justified above as a "legitimate interest" (Art. 21)
Write to the address in the imprint. There is no account here and nothing stored that points to you, so include your Polar order id or your receipt — otherwise your picture cannot be matched to you.
You can also complain to a data protection authority. In Germany that is the authority of the federal state where you live.
Changes
If the site starts doing something new with your data, this page changes with it.