Effective October 11, 2026 · Wallpaper Calendar, a DCG app
Wallpaper Calendar is a local-first desktop app. Your events live in files on your own computer, there is no account, and the app runs no analytics or tracking of any kind. It talks to us in only a few ways: installed copies check for updates, Pro checks its license key when you activate it on a computer, it sends one word if you answer the optional question on first run, and, if you use shared calendars or invites, it sends those calendars and invites to our relay encrypted, so that we cannot read them. Each is described below, along with the feedback box on this website and the optional features that talk to other services.
Events, tasks, notes and settings are stored in plain files under your own user folder (%LOCALAPPDATA%\WallpaperCalendar on Windows, ~/Library/Application Support/WallpaperCalendar on macOS). They stay on your machine, are kept when you update or uninstall, and can be deleted by you at any time by removing that folder. If one of those files is ever found damaged, the app keeps a copy of it in a folder called damaged in the same place before putting an earlier version back, so that nothing in it is lost for good.
If, and only if, you connect a Google account, the app syncs events two-way between your device and Google Calendar. It asks Google for two permissions: calendar.events, to read and write your events, and calendar.calendarlist.readonly, to see the list of your calendars with their names and colours so you can choose which ones to sync. It also asks Google to sign you in (openid and email), only so it can show which Google account is connected. That email address is kept on your device and nowhere else. Specifically:
Wallpaper Calendar’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Sensitive data is protected with the following mechanisms:
http:// is fetched without encryption. The app never sends your calendar data anywhere unencrypted.%LOCALAPPDATA%\WallpaperCalendar on Windows, ~/Library/Application Support/WallpaperCalendar on macOS), protected by your OS user-account permissions. Tokens never leave your device, are never transmitted to us, and are deleted when you click Disconnect in the app or remove the app’s data folder. You can also revoke them at any time at myaccount.google.com/permissions.If you create or join a shared calendar, the events in that one calendar sync through our relay server so the other people on it can see them. They are encrypted on your device before upload, and the server stores ciphertext it cannot read. You can also share one of your own calendars onto a shared calendar (a Google calendar you can edit included): copies of its events are then encrypted and sent the same way, until you stop sharing it. The alert and countdown pin you give a shared event stay on your device. We can see only technical metadata: the calendar’s id, timestamps, the size of each encrypted item, and what kind of item it is (an event, the shared notes, the to-do list, a notepad, the category list, the folder list). Copies of your own calendars carry an id that stays the same on every shared calendar you share onto, so the relay could tell that those copies come from the same person, though not who that is. Events outside shared calendars never reach our relay. Leaving a shared calendar stops all syncing for it.
People join a shared calendar by invite. Your app makes a key pair on your device the first time it shows your personal invite code, and the 16-letter code is worked out from the public half. The private half never leaves your device. At that point the app files a mailbox for you on our relay, which keeps an id worked out from your code, your public key, a random secret that lets only your app open the mailbox, and the date. From then on the app looks in that mailbox when it starts and every five minutes. Your code is not a secret: all it lets anyone do is send you an invite, and nothing joins until you accept. When the owner of a shared calendar invites you, their app checks that the public key on file matches your code, then seals the invite on their device so that only your app can open it. The relay keeps it in your mailbox with a random id and the time it was sent. Inside, unreadable to us, are the calendar’s id and key, your own access secret for it, the calendar’s name, the sender’s name and a colour. An invite is deleted when you accept or decline it, and after 30 days at the latest. For each person invited, the calendar’s member list on the relay keeps a random member id, a random access secret, the first four letters of their invite code (so the owner can tell people apart), which kinds of items they may change, when they were invited, and whether the owner removed them. No names, calendar names or keys are ever stored in a form we can read.
When you download the app from this website, our server counts the download so we know how many there are, and keeps a short rolling list (the most recent 200 requests) of which file was fetched, the browser type, and the country, purely to tell real downloads apart from search-engine crawlers. We do not store IP addresses for this, we set no cookies, and none of this is linked to you or to anything you do inside the app.
Installed copies of the free calendar for Windows ask this website whether a newer version is out, a few seconds after they start and every six hours after that. The request says, at most, which version of the calendar is asking, and nothing about you. We count these checks per day to know roughly how many copies are in use, and keep nothing else about them. The free Mac version never checks on its own, and neither does the portable zip run straight from the folder you unzipped it to. Installed with the zip’s install.cmd, it checks like any installed copy.
The Pro edition asks our license server, license.dcgapps.com, instead, and only once your license key is entered under Settings > Account > License: on Windows on the same schedule, and on a Mac a couple of minutes after it starts and every six hours after that. That check says only which version is asking. When a newer version is out, the download of it also sends your license key, in the request’s header and over HTTPS, so that the server can check the key before it hands over the update. Pro on Mac now does this too, the same way as on Windows. The key holds the email address you bought Pro with and Stripe’s id for that purchase.
Each Pro key includes one download, so the license server counts how many times each key has been used to download Pro, and how many times it has fetched each update. For that it keeps a scrambled form of the key and the counts, with the dates and the name of the file downloaded last, and nothing else: not the key itself, not your email address and no network addresses. The scrambled form is worked out from what your key holds (the email address and the purchase) together with the secret key we sign license keys with, so it cannot be turned back into the address, and nobody without that secret key can match it to an email address. If we switch a key off, for example one passed around in public, the server also keeps its scrambled form on a list, with the date and a short note of why, never an email address. The download page at license.dcgapps.com/get checks the key you paste there and counts the download the same way. The page for a lost key, license.dcgapps.com/lost, sends the email address and receipt number you type there to Stripe, which handled your payment, to find your purchase, and keeps neither.
Each Pro key works on two computers. When you activate Pro, the app sends your key, a scrambled id of the computer, and the computer’s Windows or macOS version and its maker and model to our license server, license.dcgapps.com, over HTTPS. Once this computer is activated, the app does not ask again. Until then, for example while the server cannot be reached or the key is already on two other computers, the app tries again each time it starts. The app works that id out on your computer from the id Windows or macOS gives the machine, scrambled so that it cannot be turned back into it. The server keeps a scrambled form of each, the key’s and the computer’s, at most two computers per key. For each computer it also keeps the dates it was first and last activated, and its Windows or macOS version and its maker and model (for example “Dell XPS 15” and “Windows 11 Home”), so that your computers can be told apart, for example when you ask to have a key’s computers reset. It keeps nothing else: not the key itself, not your email address, not the computer’s own id, never the computer’s name or your name, and no network addresses. Both scrambled forms are worked out with the secret key we sign license keys with, so nobody without it can match them to you or to your computer. The server answers with a signed note for that one computer, which the app keeps with its settings, so Pro works offline from then on.
If you send a message from the feedback box on this website, we keep the message, the date, and your name and email address if you choose to give them, so that we can read it and reply. We also keep the network address it came from for about an hour, only to stop anyone sending more than a few messages an hour, and then delete it. Messages are read only by us and are never sold or shared. To have yours deleted, email contact@dcgapps.com.
The first time the app runs it asks where you found DCG apps, with a few buttons (search, Reddit, YouTube, a friend, another DCG app, somewhere else) and a Skip option. If you tap one, your device sends us that single word and which DCG app is asking, and nothing else: no name, no account, no identifier, and no way to tie it back to you. We use it only to learn which channels bring people in. Skipping sends nothing, and the question is never asked again.
Features you can turn on make direct requests from your device to: Open-Meteo (weather: the city name you type, to find it, and after that the city’s coordinates), iCal feed addresses you paste, and Anthropic (the AI assistant in Pro, only if you provide your own API key). Each command you give the assistant goes to Anthropic with your API key, along with the title, date, time and repeat rule of the events you can edit near today, up to 500 of them, so it can answer about them or change them. That includes events synced from Google and events on shared calendars. Anthropic handles them under its own terms. None of these are active until you turn the feature on.
One further request happens only when you press the Detect button next to the weather location: your device asks an IP geolocation service (ipwho.is, with get.geojs.io as a fallback) to estimate your city. Those services see your IP address, which is how the estimate is made, and they receive nothing else. We store only the resulting city name and coordinates, on your own device. Detect never runs on its own, and typing your city by hand avoids the request entirely.
If this policy changes, the update will be posted here with a new effective date. Questions: contact@dcgapps.com.