Table of Contents
What Frames is, and what it is not
Frames is an open source Android library, published on Maven Central as dev.jahir:Frames and developed in the Frames repository. A developer adds it to their project and gets a working wallpapers app out of it: a gallery, a full screen viewer, favorites, downloads, Muzei support and a settings screen. I write and publish the library.
I do not publish the apps built with it. The wallpapers, the server they are served from, and every optional feature belong to the developer of each app. If you use a wallpapers app and want to know what it does with your data, that app’s developer is the one who can answer, and their privacy policy is the one that covers you.
This policy covers the library itself: the code I ship, and what that code does on the device it runs on.
It is open source, so anyone can change it. An app built on a modified copy can behave differently from what this page describes, and the services a developer points it at are their choice, not mine. I have no say in either, and no way to know about them.
The short version
Frames sends me nothing. The library has no analytics, no crash reporting, no advertising, no accounts, no login, no device or advertising identifiers and no telemetry. There is no server of mine that it reports to, and I have no way to learn who installed an app built with Frames, which wallpapers they opened, or anything else about them.
What the library stores on the device
- Favorites. One row per favorite in a local database, holding the wallpaper URL and nothing else.
- The wallpaper catalog. The list the app downloads from its own server, which is the name, author, collections, dimensions, file size and URLs of each wallpaper, cached in the same local database so the app opens without a connection.
- Images. The thumbnails and pictures the viewer has already loaded, in the app’s cache folder.
- Settings. Theme, Material You, wifi only downloads, download folder, crop before applying, animations, notifications, and the collections picked for Muzei.
- Downloaded wallpapers, as image files in the folder the user chooses.
None of that is sent anywhere, and none of it is tied to a name, an account or an identifier. Clear cache in the app’s settings removes the cached images and catalog, and uninstalling the app removes the rest.
What leaves the device
Loading wallpapers
Required, because the app cannot show wallpapers without it.
The library requests the JSON file and the image files at the addresses the app’s developer configured. Like any web request, each one tells that server the device’s IP address and the usual HTTP headers. The server belongs to the app’s developer, or to a host they picked, so what it records and for how long is their decision and their policy to describe. Android blocks plain HTTP for apps targeting Android 9 or newer and Frames does not turn that off, so these requests are encrypted as long as the configured addresses are https.
To have something that server recorded about you deleted, write to the app’s developer, because I have no access to it.
Downloading a wallpaper
Optional, and only when the user taps download.
The download runs through Android’s own DownloadManager, which fetches the file from the same server and saves it to the folder picked in settings. The library then asks Android’s media scanner to index the file so it shows up in the gallery. Nothing about the download is reported anywhere.
The about screen
Only when the user opens About.
That screen credits the people behind the library, and their three profile pictures load over HTTPS from jahir.dev, pbs.twimg.com and patrykmichalik.com. The request to jahir.dev reaches my site, which runs on Vercel, so it lands in Vercel’s request logs with an IP address and a user agent for a short retention period. I do not read those logs for this, I do not connect them to anything else, and I keep no other copy. It is the only request in the library that touches a server of mine, and what it asks for is a static image.
License verification
Optional, and off unless the app’s developer turns it on.
With it on, the library checks at startup that the app came from the Play Store, using Google Play’s licensing service through PiracyChecker. The check sends the app’s package name and its licence key to Google Play, and Google Play answers whether the account on the device owns the app. That exchange is Google’s, and Google’s privacy policy covers it.
The rest of the check happens on the device: it reads which store installed the app, looks through the installed apps for known patching tools, and checks whether the build is debuggable. When a patching tool is found, its name is shown in a dialog and goes nowhere else. The only thing kept is a true or false setting saying the app passed.
Donations
Optional, and off unless the app’s developer turns it on.
Donations run entirely through Google Play’s billing. The payment, the card and the receipt are between the user and Google, and the library never sees any of them. To show whether a donation was already made, the library asks Google Play for the purchases on the account and holds the answer, which is the product id, order id, purchase token and purchase time, in memory while the screen is open. It is not written to disk and not sent anywhere.
Muzei
Optional, and only if the user turns Muzei on in the app.
Muzei is a separate wallpaper app. When it is enabled, Frames hands the selected collections to Muzei through its provider: wallpaper names, authors, attribution and image URLs. That is a transfer between two apps on the same device, and it carries nothing about the user.
Notifications
The library posts notifications for download progress, which is why it asks for the notification permission on Android 13 and newer. Those notifications are local to the device.
What is not in the library
- Push notifications. The sample app in the repository shows how to wire OneSignal in, and the library does not include it. A developer who adds it is adding another SDK with its own collection, which is a push token, device model, language and approximate location from the IP address, and declaring that is their job rather than something Frames does for them. OneSignal’s privacy policy describes it.
- Ads, analytics and crash reporting. Not included, in any form.
Permissions, and why each one is there
INTERNET,ACCESS_NETWORK_STATE,ACCESS_WIFI_STATE: fetch the catalog and the images, and respect the wifi only setting.SET_WALLPAPER,SET_WALLPAPER_HINTS,WRITE_SETTINGS: apply a wallpaper to the home screen, the lock screen or both.READ_EXTERNAL_STORAGE,WRITE_EXTERNAL_STORAGE: save downloads on Android 9 and older, where scoped storage does not exist yet. Both are capped withmaxSdkVersionand are not requested on newer versions.POST_NOTIFICATIONS: the download progress notifications.WAKE_LOCK,RECEIVE_BOOT_COMPLETED: let the background job that refreshes Muzei finish its work.VIBRATE: haptic feedback.com.android.vending.CHECK_LICENSE: the optional Play licensing check.com.android.vending.BILLING: the optional donations.
If you are building an app with Frames
You are the one responsible for your users’ data, not me. Two things follow from that.
Your Data safety form describes your server, not mine. The library requests the addresses you configure, so whatever your host records is yours to declare, and so is any optional module you switch on: Play licensing, Play billing, or a push SDK you added yourself.
Your app also needs its own privacy policy. This page describes the library, and it says nothing about your wallpapers, your server, or anything you built on top.
When someone asks me about data in an app I did not publish, pointing them at its developer is the only thing I can do.
Children
The library carries no wallpapers and no content of its own, so it is suitable for all ages. The wallpapers in any given app come from that app’s developer, and the content rating is theirs to get right.
Your rights
I hold no personal data from the library, so there is nothing of yours for me to show you, correct or delete. To exercise a right over data an app collected, write to that app’s developer.
Under the GDPR, the UK GDPR and Colombia’s Ley 1581 de 2012 you can ask for access to your data, for it to be corrected or deleted, and you can object to its use. For the request logs behind the three about screen images, or any question about this policy, write to hola@jahir.dev and I will answer.
Changes
When this policy changes, the date at the top changes with it.