WaiMama Privacy Policy
Draft, not yet in force.
Last updated: 30 October 2026
This policy covers the WaiMama mobile app, made by Elma Studio AB ("we," "us").
1. The short version
- No accounts. Nobody signs up or logs in.
- We don't collect personal information from children. No names, photos, birthdates or location.
- Reading progress stays on the device. Which questions have been read, the text size and the language are stored on the phone or tablet, and never sent to us.
- No ads, no trackers, no analytics.
- Purchases go through Apple or Google. We never see your payment details.
- Our own small server only hears from the app when a grown-up uses invites, sends feedback or suggests a language, all behind the parent gate.
2. Who we are
Elma Studio AB, org.nr 559600-5354, c/o Tim Schulz, Rönngatan 6, 211 47 Malmö, Sweden. Email: info@elmastudio.co. We are the data controller for the personal data described here.
3. What we don't do
WaiMama doesn't create accounts; ask for a child's name, age, email address or photo; use the camera or microphone; collect location; use advertising identifiers or cross-app tracking; show ads; or include any third-party analytics, marketing or crash-reporting SDK.
4. What is processed, by whom, and for how long
| What | Who | Why | How long |
|---|---|---|---|
| Reading progress, text size, language, what's unlocked, your invite details | Stored on your device only, apart from the invite details in the rows below | So the App works, including offline | Until you delete the App. "Start over" in settings clears progress |
| A random install ID, your invite code, how many families joined with it, whether you used a code | Our server, hosted by Cloudflare | To run invites. Created only when a grown-up opens "Invite a friend". The ID identifies an install, not a person | While the invite program runs, or until you ask us to delete it. Tell us your code so we can find it |
| What you send in "Send feedback" or "Suggest a language": your note, plus the app language, app version and device platform | Our server, hosted by Cloudflare | To read and act on it. Please don't include your child's name | One year, or sooner if you ask. Reports aren't linked to an install, so tell us what you wrote so we can find it |
| An email address, only if you add one when suggesting a language | Our server, hosted by Cloudflare | To reach you if you'd like to help with that language, and for nothing else | One year, or sooner if you ask |
| IP address, in passing | Cloudflare, when the App contacts our server | To route requests and limit abuse. We turn it into a salted hash for an hourly limit, kept at most two hours. We never store the address and keep request logs off | Handled by Cloudflare under its own policy |
| An anonymous app user ID and purchase and receipt data | RevenueCat | To check what's been bought and show totals in sales reports. It has no name or email attached | Under RevenueCat's policy |
| Purchase data | Apple or Google | To take payment, handle renewals and refunds | Under their policies |
| Crash and diagnostic data | Apple or Google, at system level, if you've allowed it | Outside the App. We don't add any crash reporting | Under their policies |
Legal bases (GDPR). Purchases and running the App: contract (Art. 6(1)(b)). Limiting abuse: legitimate interests (Art. 6(1)(f)). What you choose to send us, including invites and an email address: consent (Art. 6(1)(a)), which you can withdraw at any time by asking us to delete it.
5. Children
WaiMama is made for children aged about 5 to 8 and read together with a grown-up. It's designed so that we collect no personal information from children, with the goal of meeting the substance of COPPA in the US, GDPR Article 8 in the EU, and the UK Children's Code. We don't claim certification under any of them.
Everything that sends something to us, opens a purchase, or leaves the App sits behind a parent gate. Nothing in the App encourages a child to buy or share anything. The App has no chat, social features or way for a child to contact anyone.
If you think we've received personal information about your child, for example a name in a feedback note, tell us and we'll delete it.
6. Who we share with
Only the parties in Section 4. We don't sell personal information or share it with advertisers or data brokers. We may disclose information if the law requires it, or to protect our rights, and if the company is sold, this policy continues to apply.
- Apple's privacy policy
- Google's privacy policy
- RevenueCat's privacy policy
- Cloudflare's privacy policy
7. International transfers
Some of these providers process data outside the EU/EEA, including in the United States. Where they do, the transfer relies on safeguards such as the European Commission's standard contractual clauses or the EU–US Data Privacy Framework.
8. Your rights
You can ask us for access to your data, correction, deletion, restriction, a copy, or object to processing, and withdraw consent. Because we hold so little and it isn't tied to a name, please tell us something that lets us find it, like your invite code. Write to info@elmastudio.co. You may also complain to a supervisory authority: in Sweden, Integritetsskyddsmyndigheten (IMY).
9. Changes
If we change this policy we'll update the date above, and tell you in the App for material changes. If we ever add something that collects personal information from a child, we'd put the required parental consent in place first.
This website
This policy's other sections are about the App. This one is about waimama.app. The website has no analytics, no cookies and no trackers, and it loads nothing from other companies.
Cloudflare hosts the website and handles the requests that serve its pages, so your IP address passes through Cloudflare, under its own policy. We keep request logs off.