Paneglow privacy policy

Paneglow plays images, GIFs and videos you choose as a wallpaper on your new tab page and on the websites you allow. It is built to work entirely on your device. The exceptions are settings sync, which is off unless you turn it on (see Settings sync), and the community gallery, in versions that have one, which receives only the packs you install, upload or report, and your email if you sign in to upload (see The community gallery).

Our promises

Free stays free. Everything Paneglow does for free stays free. A paid extra, where one is offered (Paneglow Pro), only ever adds new features: nothing that was free is moved behind a payment, and there are never ads.
Check it yourself. Settings → "What Paneglow can access" lists every permission and website your browser has granted the extension, and gives back any optional one with Remove. Settings → "Network log" lists every request the extension has made, with the time, the site and why (see The network log).

What the extension stores

Your media and collections: the files you import, their thumbnails, names and tags, which ones are favorites, any depth maps you add to pictures, and for a file you added from the web, the address it came from. A shader wallpaper you add is stored the same way, as the name of a shader built into the extension and the colors and settings you picked. Each item's brightness and main color are also worked out on your device from its thumbnail, so you can search for "dark" pictures or a color, and a smart collection keeps its rule (the search it was saved from). For items from a wallpaper pack, also what the pack says about them (author, licence, credits, whether they were made with AI), their light and dark versions, and how you customized them. These are stored in your browser's extension storage (IndexedDB) on your device.
Pack details you enter on the Packs tab (a pack's name, author, description, licence and credits), remembered for each collection in the extension's local storage on your device.
Your settings and site rules: which sites show a wallpaper, how it looks, and which wallpaper is showing and the one you kept on the new tab for today, and for the new tab clock, the name and date you give a countdown and the places you pick for the world clock (worked out on your device from the browser's own time zone data; the clock's fonts come with the extension). These are stored in the browser's extension storage on your device.
Where sunrise and sunset are, only if you pick a city or type a latitude and longitude in Settings → Day and night: the city's name and its coordinates, to about a kilometre. These are stored in the browser's extension storage on your device. By default nothing is stored: the extension guesses from your computer's time zone each time.
Your quick links: the names and addresses you add to the new tab, their order and any letter color you pick, the addresses of most visited sites or pages you chose not to show, which bookmarks folder to show (its name and the browser's id for it), and whether the number keys open them. These are stored in the browser's extension storage on your device.
Pictures you give your quick links: a picture you upload, paste or drop for a link is made into a small icon (96 pixels square) and stored in the browser's extension storage on your device. Icons are never synced and never downloaded from the web.
Your sound settings: the volume for videos’ own sound, the soundscape volume and mix, and the mixes you saved. These are stored in the browser's extension storage on your device. The soundscape's sounds (rain, wind and the others) are made by the extension as they play: no audio is downloaded or recorded, and the microphone is never used. Once you start the soundscape, it plays on across tabs from a hidden page of the extension's own (Chrome's offscreen document, Firefox's background page) until you stop it; whether it's playing is kept only until the browser closes. A site you turn a video wallpaper's sound on for keeps that in its site rule.
Your scenes, if you make any: their names, and for each a copy of its settings and site rules. Tab group and container collections, if you pick any: the names (or, for a group without a name, the color) of the tab groups you gave a collection, and in Firefox each container's internal number and the name you gave it here. These are stored in the browser's extension storage on your device.
Linked folders: for a collection you link to a folder on your computer, the browser's reference to that folder, its name (not its full path, which the browser doesn't give), and the name, size and date of each file found in it, so later checks import only new files. These are stored in IndexedDB on your device.
The network log: for each request the extension made, when it started, the site's name (not the rest of the address), why it was made and how it ended; the newest 500. It is stored in IndexedDB on your device, apart from your library (see The network log).
About your backups: when you last made one from this browser (its date, size, file name and how many wallpapers it held), whether to remind you to back up, and after a restore, which folders to link again. These are stored in the browser's extension storage on your device and are never synced.
Your Paneglow Pro licence, only in versions that offer Pro and only once you click "Subscribe" or "Restore a subscription": the key ExtensionPay made for this installation, whether it has Pro, which plan, when you subscribed and with which email, whether the subscription is active and when a cancelled one ends, and when it was last checked. These are stored in the browser's extension storage on your device.
Your community gallery sign-in, only in versions with the community gallery and only once you sign in to upload: your email address, the name the gallery shows on your packs, and the sign-in token the gallery gave this browser. These are stored in the browser's extension storage on your device, never synced and never put in a backup. Signing out deletes them.
Which notes about Paneglow Pro you put away, only in versions that offer Pro: when you clicked "No thanks" on one in Settings, so it doesn't come back. This is stored in the browser's extension storage on your device and never synced.

Nothing about you is sent to the developer, except what you choose to send the community gallery: your email address when you sign in to upload, the packs you upload, and the reports you make (see The community gallery). Unless you turn on settings sync, nothing else is sent to any server either. No account is needed for anything else, and there are no analytics, no telemetry, no ads and no tracking. The other exception is Paneglow Pro, in versions that offer it, and only after you click "Subscribe" or "Restore a subscription" (see Paneglow Pro).

What the extension reads

The address of a site, only its hostname (for example youtube.com), to decide whether that site should show a wallpaper. The extension never reads, collects or changes the content of the pages you visit.
The current tab's address when you open the toolbar popup, so it can offer "Enable on this site".
The current tab's address while the side panel is open, so its controls are for the page you're on. The browser shows it to the extension only on sites you've allowed, on the extension's own pages, and on a tab where you've clicked the toolbar button. It's used on your device to pick the controls and is never stored or sent anywhere.
The address of an image or video you right-click, only when you choose "Add to Paneglow" on it, so it can download that one file. Nothing else on the page is read. The result shows in a small card the extension draws on that page; the card doesn't read the page either, and the page can't read the card.
On X, the link of the post a right-clicked video is in, only when you choose "Add to Paneglow" on a video there. X streams its videos into the page, so the page has no file address for them; the extension reads the link of the post around that one video, and its picture, to find the file. Nothing else on the page is read.
Your most visited sites, only if you pick "Most visited sites" for the new tab's quick links. The browser asks you first. The list is read on your device to draw the tiles and is never stored or sent anywhere. Switching back to your own links (or off) gives the permission back.
The icons the browser has already saved for your quick links (Chrome only), only if you turn on "Show site icons on quick links". The browser asks you first. They're read from the browser's own cache; nothing is downloaded.
Your bookmarks, only if you pick "A bookmarks folder" for the new tab's quick links. Settings explains this first, then the browser asks you. The browser's prompt says "Read and change your bookmarks" (Chrome) or "Read and modify bookmarks" (Firefox), because browsers don't offer read-only access; the extension only reads them, to list your folders in Settings and to draw the links of the folder you picked, on your device. It never adds, changes or deletes a bookmark, and never stores or sends your bookmarks anywhere (only which folder to show is stored, as above). Switching back to your own links (or off) gives the permission back.
The files in a folder you link to a collection, and only that folder and the folders inside it, after you pick it in the browser's folder picker and the browser asks you to allow it. The extension lists the files there and reads the pictures and videos among them to import the new ones, when the library opens, when you click "Check now" and, at most every few minutes, when you open a new tab. It never changes, moves or deletes anything in the folder. The browser asks again after it restarts (unless you chose "Allow on every visit"), and "Unlink" stops the extension reading the folder. Available in Chrome, Edge and other Chromium browsers; Firefox can't link a folder.
The colors of the wallpaper on your new tab (Firefox only), only if you turn on "Match Firefox's toolbar to the wallpaper". They're worked out on your device from the wallpaper's thumbnail and handed to Firefox to color its toolbar, and never sent anywhere. When you turn it on, the extension also reads whether your Firefox theme makes websites light or dark, so they stay that way, and keeps that on your device. Turning it off gives Firefox its theme back.
The colors of your own wallpaper on the new tab, to color the clock, search box and links so they stay readable. The new tab measures the picture or video frame it is showing, shrunk to a few dozen pixels, on your device. Only the colors for the next new tab are kept, in the extension's storage; nothing is sent anywhere.
Your computer's time zone and whether it uses a light or dark theme, which every web page can see, to switch wallpapers and the extension's own theme at sunrise and sunset or with light and dark mode. The time zone is read in the browser to guess roughly where sunrise and sunset are, from a list of time zones that comes with the extension; nothing is looked up online. The extension never asks the browser for your location.
Where the pointer is on the new tab page, only while a shader wallpaper that follows it plays there, and only with "Shaders follow the pointer on the new tab" on (Settings → Shader wallpapers). It's used to draw the next frame and is never stored or sent anywhere. Wallpapers on websites never read it.
Which tab group a tab is in, and the group's name and color, only if you give a tab group its own collection: the browser asks you first (Chrome says "View and manage your tab groups"; Firefox doesn't ask). The extension reads this when a new tab or a site's wallpaper opens, and when a tab joins or leaves a group, to know which collection to play. It never creates, changes, moves or closes a tab group. Before you allow it, the toolbar popup only notices whether the current tab is in a group, to offer this; that needs no permission. "Stop using tab groups" in Settings gives the permission back.
Which Firefox container a tab is in (Firefox only), only to play the collection you gave that container, when a new tab or a site's wallpaper opens. Firefox tells every extension each tab's container, with no permission. It doesn't tell it containers' names, so you name them in Settings. Nothing about your containers or their cookies is read beyond that.
Whether your device is charging, only if you turn on "Show still images while on battery power", so wallpapers can stop moving while it runs on battery. This is checked in the browser and is never stored or sent anywhere.
Where the mouse pointer is on the new tab page, only if you turn on parallax (Settings → Effects and motion), so the wallpaper can move with it. It's read on the new tab page itself, used to draw the next frame, and never stored or sent anywhere. The extension never reads the pointer on websites.
That you've clicked or pressed a key on a page, only on a site where you've turned on its video wallpaper's sound, because that sound waits for one. Only that one happened is noted, never where you clicked or what you typed, and it's never stored or sent anywhere.
Whether your computer is in use: the browser tells the extension when the computer has had no mouse or keyboard input for a while, or its screen is locked (Chrome only), so wallpapers can pause until you're back ("Pause wallpapers while the computer is idle", on unless you turn it off). Only that state ("active", "idle" or "locked") is kept, on your device, and never sent anywhere. Nothing about what you were doing is read.
How busy your processor is (Chrome only), only if you turn on "Show still images while the processor is busy": the browser's own rating of the load ("nominal", "fair", "serious" or "critical"), so wallpapers can stop moving under heavy load. On the sites you allowed, the extension's script on the page receives this rating from the browser and passes it to the wallpaper; it is the same for every page and says nothing about the page. It is never stored or sent anywhere.

Network requests

The only network requests the extension makes are ones you start yourself, and each one is listed in Settings → Network log as it happens:

Importing from a URL: the file at the address you paste is downloaded once and stored on your device. Access to that site is requested for the download and removed again afterwards, unless you had already allowed that site.
Adding an image or video from the right-click menu: the same, for the file you right-clicked. Videos a site streams into the page in pieces (a blob: address, as on YouTube) have no file to download, so the extension says so and downloads nothing.
Importing from X: for a post link you paste, or a video you right-click on X, the extension asks X for that one post's public data at cdn.syndication.twimg.com (the data X's embedded posts are drawn from) to find its video and picture files, then downloads those from video.twimg.com or pbs.twimg.com. Pictures from X are downloaded at their original size rather than the smaller copy the page shows. Access to those three hosts is requested for the import and removed again afterwards. Nothing about you is sent: the requests carry no cookies.
The wallpaper gallery (the Gallery tab, in versions that have one): the gallery is a list of wallpaper packs on the developer's website, whose address the Gallery tab shows. The first time you open it, the extension asks your browser for access to that one site; nothing is downloaded until you allow it. After that, opening the Gallery downloads the list of packs and their cover pictures from that site, and clicking Install downloads that pack. Nothing about you is sent: the requests carry no cookies, no referrer, no account or identifier, and nothing from your library. As with any website, the site's host can see your IP address and which files were downloaded. A pack is checked against the gallery's checksum and shown to you before anything is added. "Remove access" on the Gallery tab (or your browser's extension settings) takes the access back.
The community gallery's uploads and reports (in versions with the community gallery): "Sign in with Google" opens the gallery's sign-in page in the browser's sign-in window, which goes on to Google's own page, where you pick your account, and back; like a page you open in a tab, the browser loads it, not the extension, and the extension receives only the gallery's sign-in for you, with your email address and the name you chose. Uploading sends the pack you chose, its cover and the details you typed, with your sign-in. "My uploads" asks the gallery for your packs, and changing your name or taking a pack down tells it so. "Report" sends the reason and anything you write, without your name or email. All of these go only to the gallery's site, and only when you click; see The community gallery for what it keeps.
Store links in the gallery: a pack sold elsewhere has a link to its store page, which opens in a new tab only when you click it. Nothing is bought or paid inside the extension.
Shader wallpapers and generated pictures are drawn on your device from code that comes with the extension. Nothing is downloaded for them, ever.
New tab search: searches you type in the new tab search box go to your browser's default search engine, exactly as if you had typed them in the address bar.
Paneglow Pro, only in versions that offer it and only after you click "Subscribe" or "Restore a subscription": requests to extensionpay.com about this installation's Pro licence. They're all listed under Paneglow Pro.
Links you click: a quick link opens its site (when you click it or press its number key), "Support Paneglow" or "Get more wallpaper packs" (when shown) opens that page in a new tab, and the new tab's info card (off unless you turn it on) links to the page a wallpaper came from, which opens in a new tab without telling that page where you came from. So do the licence and credit links a wallpaper pack shows, which are never opened or fetched otherwise. The extension itself sends nothing to them.
Settings sync, only if you turn it on: the extension writes your settings to the browser's own sync storage, and the browser uploads them with the rest of your synced browser data (see below). The extension makes no request of its own for this.

The network log

Settings → Network log lists every request the extension itself has made: the downloads above, the gallery's requests, and ExtensionPay's, in versions with Paneglow Pro. Each entry has the time, the site's name (for example pbs.twimg.com), the reason (such as "Import from a URL" or "Gallery: the list of packs") and how it ended (OK, an error code, no answer, or cancelled). The rest of the address is not kept, so nothing like a licence key ends up in it.

It stays on your device. It's kept in the extension's own storage, apart from your library. It is never synced, never put in a pack, and never sent anywhere.
It holds the newest 500 requests, and "Clear the log" empties it. Removing the extension deletes it.
What isn't in it: pages that open in a tab, such as a link you click, a search from the new tab or ExtensionPay's checkout page. The browser loads those like any page you visit, not the extension.

Settings sync

"Sync settings across your computers" (Settings → Sync) is off by default. You turn it on separately on each computer.

What is synced: your settings except the ones listed below (a city or coordinates you entered for sunrise and sunset sync rounded to a tenth of a degree, about 10 km), your site rules (the sites' addresses, how each shows a wallpaper, and any CSS you added for a site), your schedule, your scenes, the collections you gave tab groups, your quick links (their names, addresses, order and letter colors, any most visited sites or pages you chose not to show, which bookmarks folder to show and whether the number keys open them; not your bookmarks themselves), and your collections: their names, play order, and which items they hold (for a smart collection, its rule and the items you left out of it, and each computer works out the rest from its own library). Items are named by a short fingerprint of the file: the first 16 characters of its SHA-256 hash, which says nothing about what the file shows.

What is never synced: your media itself (the files, thumbnails, depth maps, names and tags, which are favorites, and the addresses files came from), the pictures you gave your quick links, which wallpaper is showing or kept for today, site access (each computer asks for its own), the network log, and the settings that belong to one computer: the switch that turns every wallpaper off, "Show still images while on battery power", "Shrink heavy videos when importing them", "Scale huge pictures when importing them", "Color grading on sites too", low-power mode, pausing while the computer is idle, still images while the processor is busy, how shader wallpapers play (Settings → Shader wallpapers), your sound volumes and current soundscape mix (the mixes you saved do sync), and the collections you gave Firefox containers (Firefox numbers containers separately on each computer).

Who holds it: the browser's sync service, under your browser account. The developer never receives it.

Chrome stores it in your Google Account with your other Chrome sync data, under Google's privacy policy. It is encrypted on your device only if you set a sync passphrase in Chrome. It syncs only while you're signed in to Chrome with sync on.
Firefox sends it through Firefox Sync with your Mozilla account, under Mozilla's privacy notice. Firefox Sync encrypts it on your device before it's uploaded, so Mozilla can't read it. It syncs only while you're signed in with Add-ons checked in Firefox's Sync settings.
Other Chromium browsers (Edge, Opera, and others) sync it through their own accounts, if they sync extension data at all.

Turning it off stops syncing on that computer. The synced copy stays in your browser account for your other computers until you choose "Delete synced settings" in Settings → Sync (turn sync off on your other computers first, or they sync theirs again). Do that before removing the extension if you want the synced copy gone too.

Paneglow Pro

Some versions of Paneglow offer Paneglow Pro, an optional subscription paid monthly or yearly, and show a "Paneglow Pro" section in Settings. Versions without that section have no Pro and send nothing for it. Pro is sold through ExtensionPay (extensionpay.com), which takes the payment with Stripe.

Our pledge: Everything free today stays free. Pro only ever adds new features. Nothing that has shipped free will move behind it, and Pro adds nothing to this policy beyond what this section describes: still no ads, no tracking, no telemetry, and nothing sent before you click.

Nothing is sent until you click "Subscribe" or "Restore a subscription". Opening Settings, or the Pro section, sends nothing before that. Neither does the note about Pro in Settings, picking a plan, or the supporter credits: the prices and the list of supporters come with the extension.
What's sent, and when. Each request goes to extensionpay.com and carries no cookies:
- Your first click asks ExtensionPay for a key for this installation, a random code. An installation in developer mode asks for a test key.
- The key, to ask whether it has Pro. This happens while a subscription or restore you started is open (up to every 2 seconds for 2 minutes once ExtensionPay's page says it went through, and when you come back to Settings), when you open the Pro section of Settings (at most once a minute, or every few seconds for half an hour after you click "Manage or cancel"), about once a week while you have Pro, and just after a subscription you cancelled ends.
- Nothing else: nothing about your media, your settings, the sites you visit or your device.
You subscribe, restore and cancel on ExtensionPay's website, in a tab the extension opens: the payment page for the plan you picked, or, from "Manage or cancel", your own subscription page there. Your email and payment details go into ExtensionPay's and Stripe's pages, under their privacy policies, and never into the extension. ExtensionPay tells the extension which email you subscribed with, which plan, whether the subscription is active, and when a cancelled one ends, so Settings can show them; that stays on your device.
When a subscription ends, nothing is deleted or sent: Pro features show as their free versions on your device, and everything you set comes back if you subscribe again.
Access to extensionpay.com is asked for in the click. The extension uses it only to hear ExtensionPay's page say the subscription or restore went through, and reads nothing else there. It's removed again once Pro is confirmed, or after 30 minutes, unless you had already allowed that site.
In Firefox, the click also asks for your consent to send the key (Firefox calls it "authentication information"). You can withdraw it in Add-ons and themes → Paneglow → Permissions and data; no more checks are made after that, and Pro stays as it last was.
Offline, Pro keeps working from what's stored on your device. Only an answer from ExtensionPay changes it, for example when a subscription ends or after a refund.

Pack files (.wallpack) you export contain the media, names, tags and collection order of one collection, each item's framing, trim, light and dark versions and customization, and the details you enter for the pack (name, author, description, licence, credits, whether it was made with AI, and a cover picture). They never contain your site rules or settings, or which items are favorites. A pack only leaves your device if you share it yourself, for example by uploading it to the community gallery, where anyone can download it.

Backup files (.lwbackup, from "Export everything" on the Backup tab) contain everything listed under "What the extension stores" except the Pro licence, the backup details themselves and the pictures you gave your quick links (those stay on this computer): all your media and collections, your settings, your site rules (so the addresses of the sites you show wallpapers on), your quick links, and the names of linked folders and their options. They never contain the browser's reference to a folder, the list of files found in a linked folder (or any of its files that aren't in your library), which wallpaper is showing, or anything the extension doesn't store. Making a backup sends nothing anywhere: the file is written only where you save it. In Firefox, which saves it to your downloads, it's first written to the extension's own storage on your device and downloaded from there; that copy is deleted the next time you make a backup or open the Backup tab, once it's 30 minutes old (or when you remove the extension). Restoring one reads only the file you pick. Treat a backup as private, like the browser data it comes from; it only leaves your device if you copy or share it yourself.

"Save original", on the new tab or in the library, saves a copy of that one file to your computer through the browser's own download, only when you click it.

The community gallery

Versions with the community gallery let anyone install packs other people shared, and let you share your own. It runs on the developer's server, hosted by Cloudflare. Browsing and installing need no sign-in; uploading does.

What the gallery keeps:

For everyone who installs or reports a pack: to count each person's install once a day, and to limit how many requests one person can make, the gallery keeps a fingerprint of your IP address (a salted hash, from which the address can't be read back) with the pack and the day. These are deleted after a day. The address itself isn't stored by the gallery, though Cloudflare, like any web host, sees it to answer your request.
For a report: the reason, what you wrote, when, and the same kind of fingerprint, so one person's report counts once. Reports carry no name or email, and are kept until the pack is deleted.
If you sign in to upload: you sign in with your Google account. Google tells the gallery that account's email address and its id for the account (a number that stays the same if the email changes), and nothing else: not your name, picture, contacts or anything from your Google account. The gallery keeps those two; the name you choose for it to show on your packs (or none, and they show as "Anonymous"); and each pack you upload, with its file, cover, details, size, checksum, when you shared it and how many times it was installed. A sign-in under way is kept for at most 10 minutes; your sign-in is kept as a hash of its token until you sign out, or for a year. Google learns that you signed in to Paneglow's gallery, as with any "Sign in with Google", under Google's privacy policy.

Who sees what: packs, their details, the name you chose and install counts are public: anyone with Paneglow can see and install them. Your email address is never shown in the gallery. The gallery's moderators see it next to your packs, to deal with reports and legal requests. It's used only to sign you in and to contact you about your uploads (for example about a report or a copyright notice). It is never sold, never shared beyond the providers below, and never used for marketing.

Moderation: packs appear in the gallery as soon as they're uploaded. A pack that three different people report is hidden until a moderator looks. Moderators can hide or delete any pack, and stop an email address from uploading, which hides its packs too.

Removing it: "Take down" in My uploads deletes that pack's file, cover and listing from the gallery straight away; people who installed it keep their copy. To have your email address and name deleted from the gallery too, email us from that address (see Contact), and we'll delete them and any packs left within 30 days.

Who processes it for us: Cloudflare (the gallery's hosting, file storage and database), only to provide that service. Google provides the sign-in.

Permissions

Settings → "What Paneglow can access" lists everything below that your browser has granted, with what each one is for. Remove gives back any site, optional permission or data consent there, as the browser's own settings would; the permissions given at install can only be taken back by removing the extension.

Site access is optional. The extension asks for access to one site at a time, only when you click "Enable" (or, for a single download, when you import from a URL or the right-click menu), and you can remove it at any time from the popup, the extension's Site rules page, or your browser's extension settings.

The right-click menu ("Add to Paneglow" on images and videos) does nothing until you choose it.

The "idle" permission lets the browser tell the extension when the computer is idle or locked, as described above; browsers show no warning for it.

Linking a folder needs no extension permission: the browser's own folder picker and prompt let the extension read that one folder, only after you click "Link a folder…". When the browser has forgotten that access, the extension shows "Re-allow access" and asks only when you click it.

Access to the gallery's site is optional too: it is asked for when you first open the Gallery and only lets the extension download from that site and, with the community gallery, send it what you upload and report. It never shows a wallpaper there. Signing in to the community gallery uses the browser's sign-in window (the identity permission, which shows no warning), only when you click "Sign in with Google". In Firefox, that click also asks for your consent to let the gallery know your email address and sign you in (Firefox calls them "personally identifying information" and "authentication information"). You can withdraw it in Add-ons and themes → Paneglow → Permissions and data, which signs you out of the gallery in that browser.

Subscribing to or restoring Paneglow Pro (in versions that offer it) asks for access to extensionpay.com while you do, as described above, and in Firefox for your consent to send ExtensionPay this installation's key.

The extension never changes your homepage. In Firefox, Settings → Homepage and new windows shows the address you can set it to yourself, and "Copy address" puts it on your clipboard only when you click it.

In Firefox, the extension can change the browser's colors (the theme permission, which Firefox doesn't ask about). It uses it only while "Match Firefox's toolbar to the wallpaper" is on in Settings.

Three more permissions are optional and asked for only from Settings → Quick links: reading your most visited sites (for "Most visited sites" quick links), reading your bookmarks (for "A bookmarks folder", explained in Settings before the browser asks) and, in Chrome, reading the site icons the browser has saved (for "Show site icons on quick links"). Turning any of them off gives the permission back.

Private windows

Paneglow runs in incognito (Chrome, Edge) or private (Firefox) windows only if you allow it in the browser's extension settings. Then it shows wallpapers there as in normal windows, with two things to know:

A site you turn on in a private window stays on in normal windows too, and appears in Site rules, like any site you turn on. Nothing else about your private browsing is stored: the extension still reads only a site's hostname, and only to decide whether that site shows a wallpaper.
A file you add from a private window is kept, but not the address it came from. The right-click import downloads the file you chose and stores it in your library without its web address.

Wallpapers are sent to the private window from your library on your device; nothing goes over the network for it.

Collections by tab group are optional too: reading your tab groups (tabGroups) is asked for from Settings or the toolbar popup only when you choose to use them, and "Stop using tab groups" gives it back. Collections by Firefox container need no permission.

Removing your data

Removing the extension deletes everything it stored on your device, the Pro licence and the community gallery sign-in included; packs you uploaded to the community gallery stay there until you take them down or ask us to (see The community gallery). Pro can be restored afterwards with the email it was bought with. Backup files you saved stay where you saved them until you delete them. If you used settings sync, delete the synced copy first (above). You can also delete individual items and collections from the library at any time, and clear the network log in Settings.

Contact

Questions about this policy: email Brynk.ex@outlook.com.