Privacy

Wallflower is mostly a client: it runs in your browser (or as a native app) and talks directly to your Mastodon and Bluesky accounts. It also has a small backend of its own — for the reading room, cross-device settings, and article extraction — described in full below. We don't run an advertising network, sell data, or embed third-party trackers.

What stays on your device

• Your account tokens — the OAuth access token from your Mastodon server, and your Bluesky session (OAuth tokens or app password). Kept locally (sessionStorage on the web, the system keychain in the native app). An encrypted, HTTP-only session cookie can restore the web session so you don't re-authorize every visit.
• Your column layout, theme, drafts, and read marker — small JSON blobs kept locally. The layout, read position, and correspondents also sync (see below) if you use the reading room.
• A "has been here" cookie (wallflower-seen) — one bit, so the server knows whether to show the Landing page or the timeline shell on first paint. No credentials, no identifier.

What goes directly to your servers

• Reading and posting — timelines, threads, profiles, likes, boosts, posts — go directly from your browser or device to your Mastodon and Bluesky servers. Wallflower doesn't proxy or log that traffic.
• Avatars, banners, and media load from the URLs your servers return — usually the originating server. Wallflower doesn't re-host them.

What Wallflower's backend stores

Some features need a server of our own (thewallflower.app). When you use them, data is stored on that backend under a random library identifier. Wallflower also keeps the verified account key used to find that library (your Bluesky DID or normalized Mastodon handle), rather than your name or email.

• The Commonplace reading room. Articles and passages you keep, your notebooks, correspondents, and cross-device settings (column layout and read position) are stored so they follow you between devices. Citation pages you choose to publish are, by design, public at a shareable link.
• Your session, to act on your behalf. To derive that identity and fetch on your behalf, the app sends your account details — including access tokens — to the backend, which seals them in an encrypted, HTTP-only cookie (it can read them to make those requests). The cookie lasts up to a year unless you sign out.
• Article extraction and link previews. When you open an article in the reader or a post shows a link card, the backend fetches that URL server-side (guarded against internal-network abuse) and returns the cleaned result. The URL is fetched, not retained as browsing history.
• Patron purchases and listening. If you subscribe, Wallflower stores Apple’s transaction identifier, product, renewal date, and subscription environment with your reading-room identity so access can follow you across devices. Episodes you request, their status, and the generated audio remain in your private library until they expire or you delete your data.

What Wallflower measures

We keep the smallest picture we can of whether the app is healthy and being read. It is first-party, uses no cookies, and is never tied to your identity.

• A daily count of unique readers. When a real, non-demo timeline first shows content that day, the server records a one-way hash of your IP and client signature, salted with a value that rotates every day, plus whether you are using the web, iPhone/iPad, or Mac app. We can count distinct active clients on a day; we can't identify you, link you across days, recover your IP, or know which account or posts you used. It expires within about a day.
• Anonymous product-health counters. The app counts a few coarse milestones — for example, opening sign-in, choosing a provider, reaching a first timeline, or a broad sign-in failure category. These are stored only as daily totals for up to 30 days, not as a per-reader trail.
• Anonymous error reports. If the app crashes or stalls, it sends a short note — an event name and a sanitized error message, query strings stripped — so we can fix it. No identity and no record of what you read.

Notifications you opt into

If you enable remote notifications, Wallflower's relay receives Mastodon notification events or polls Bluesky on your behalf, filters the event types you selected, and forwards a short alert through Apple Push Notification service. To do that, the relay stores your Mastodon access token or Bluesky app password and the push subscription keys encrypted at rest, plus your Apple device token. Disabling notifications or deleting your Wallflower data removes those registrations and schedules retryable cleanup if a provider is temporarily unavailable.

What Wallflower does not do

• No third-party analytics, tag managers, advertising, or tracking scripts.
• No tracking cookies — only the functional session and "seen" cookies above.
• No cross-site tracking, no advertising profiles, no selling or sharing.
• No marketing emails or unsolicited notifications.

PDFs on your device

PDFs you import into Wallflower and annotations written into those copies stay on that device. They are not uploaded to Wallflower’s backend or included in cross-device Commonplace sync.

Signing out and deleting your data

Signing out clears your local tokens and the backend session cookie. It doesn't revoke the app on your Mastodon or Bluesky server — do that from that server's connected-apps settings. To delete the reading-room and settings data the backend holds for you, use Delete your data in Settings. The app immediately blocks the deleted library and schedules its reading data, generated audio, provider subscriptions, and other stored content for removal; provider and object-storage cleanup can finish asynchronously and retry after the request returns. A minimal permanent tombstone containing the verified account key and a deletion generation is retained only to prevent an old signed-in device from recreating deleted data. Deletion can't be undone. You can also email andrew@leahey.org if you can't reach the button.

A correction June 2026

Until June 2026, this page said “no third-party scripts” — but the site was quietly loading Cloudflare’s Web Analytics beacon (static.cloudflareinsights.com), which is a third-party script. That contradicted what we told you here, and a reader rightly caught it. We’ve removed the beacon. This page was rewritten again in July 2026 to describe the reading-room backend and Bluesky support accurately.