WaiMama App Privacy Policy
Draft, not yet in force.
Last updated: 3 November 2026
This policy covers the WaiMama mobile app, made by Elma Studio AB ("we," "us"). Our website, waimama.app, has its own Privacy Policy.
1. The short version
- No accounts. Nobody signs up or logs in.
- We don't collect personal information from children. No names, photos, birthdates or location.
- Reading progress stays on the device. Which questions have been read, the text size and the language are stored on the phone or tablet, and never sent to us.
- No ads, no trackers, no analytics.
- Purchases go through Apple or Google. We never see your payment details.
- Our own small server only hears from the app when a grown-up uses invites, sends feedback or suggests a language, all behind the parent gate.
2. Who we are
Elma Studio AB, org.nr 559600-5354, c/o Tim Schulz, Rönngatan 6, 211 47 Malmö, Sweden. Email: info@elmastudio.co. We are the data controller for the personal data described here.
3. What we don't do
WaiMama doesn't create accounts; ask for a child's name, age, email address or photo; use the camera or microphone; collect location; use advertising identifiers or cross-app tracking; show ads; or include any third-party analytics, marketing or crash-reporting SDK.
4. What is processed, by whom, and for how long
| What | Who | Why | How long |
|---|---|---|---|
| Reading progress, text size, language, what's unlocked, your invite details | Stored on your device only, apart from the invite details in the rows below | So the App works, including offline | Until you delete the App. "Start over" in settings clears progress |
| A random install ID, your invite code, how many families joined with it, whether you used a code | Our server, hosted by Cloudflare | To run invites. Created only when a grown-up opens "Invite a friend". The ID identifies an install, not a person | While the invite program runs, or until you ask us to delete it. Tell us your code so we can find it |
| What you send in "Send feedback" or "Suggest a language": your note, plus the app language, app version and device platform | Our server, hosted by Cloudflare | To read and act on it. Please don't include your child's name | One year, or sooner if you ask. Reports aren't linked to an install, so tell us what you wrote so we can find it |
| An email address, only if you add one when suggesting a language | Our server, hosted by Cloudflare | To reach you if you'd like to help with that language, and for nothing else | One year, or sooner if you ask |
| IP address, in passing | Cloudflare, when the App contacts our server | To route requests and limit abuse. We turn it into a salted hash for an hourly limit, kept at most two hours. We never store the address and keep request logs off | Handled by Cloudflare under its own policy |
| An anonymous app user ID and purchase and receipt data | RevenueCat | To check what's been bought and show totals in sales reports. It has no name or email attached | Under RevenueCat's policy |
| Purchase data | Apple or Google | To take payment, handle renewals and refunds | Under their policies |
| Crash and diagnostic data | Apple or Google, at system level, if you've allowed it | Outside the App. We don't add any crash reporting | Under their policies |
Today the questions, stories and illustrations are part of the App itself, so reading one sends nothing to us or to anyone else. If new questions ever arrive as downloads, we'll update this policy before that starts.
Legal bases (GDPR). Purchases and running the App: contract (Art. 6(1)(b)). Limiting abuse: legitimate interests (Art. 6(1)(f)). What you choose to send us, including invites and an email address: consent (Art. 6(1)(a)), which you can withdraw at any time by asking us to delete it.
5. Children
WaiMama is made for children aged about 5 to 8 and read together with a grown-up. It's designed so that we collect no personal information from children, with the goal of meeting the substance of COPPA in the US, GDPR Article 8 in the EU, and the UK Children's Code. We don't claim certification under any of them.
The App is offered in Apple's Kids Category and under Google Play's Families policy, which restrict what an app for children may collect, and what ads and analytics it may use. Everything that sends something to us, opens a purchase, or leaves the App sits behind a parent gate. Nothing in the App encourages a child to buy or share anything. The App has no chat, social features or way for a child to contact anyone.
If you think we've received personal information about your child, for example a name in a feedback note, tell us and we'll delete it.
6. Who we share with
Only the parties in Section 4. We don't sell personal information or share it with advertisers or data brokers. We may disclose information if the law requires it, or to protect our rights, and if the company is sold, this policy continues to apply.
- Apple's privacy policy
- Google's privacy policy
- RevenueCat's privacy policy
- Cloudflare's privacy policy
7. International transfers
Some of these providers process data outside the EU/EEA, including in the United States. Where they do, the transfer relies on safeguards such as the European Commission's standard contractual clauses or the EU–US Data Privacy Framework.
8. Your rights
You can ask us for access to your data, correction, deletion, restriction, a copy, or object to processing, and withdraw consent. Because we hold so little and it isn't tied to a name, please tell us something that lets us find it, like your invite code. Write to info@elmastudio.co. You may also complain to a supervisory authority: in Sweden, Integritetsskyddsmyndigheten (IMY) (the complaint page is in Swedish; general guidance in English).
9. Security
We keep what we hold small, so there's less to protect. Only we can read what's stored on our server, and payment details are handled by Apple, Google and RevenueCat, never by us. No system is completely secure. If something goes wrong that affects personal data, we'll do what the law requires, including telling those affected and the authorities where needed.
10. Changes
If we change this policy we'll update the date above, and tell you in the App for material changes. If we ever add something that collects personal information from a child, we'd put the required parental consent in place first.