Privacy at Kittelfdora Kids

Here's the honest picture: this site asks almost nothing of you. There are no ads, and nothing about your child is ever sold or shared. We do use Google Analytics to measure how the site is used, in the plainest way it comes. It counts which pages get opened and roughly how long they stay open, and it notes where a visit came from, like another website or a link in one of our own posts. A section further down spells out exactly what it sees, and how to switch it off on your device. Every game and story is free to play without an account. Grown-ups can join our newsletter or open a free family account, and those two are the only parts of the site that keep anything about who you are. This page explains all of it.

This is an informational page, not a wall of legal boilerplate. We keep it accurate and update it when the site changes.

What we collect

Two things count as personal information, and both are a grown-up's choice: an email address for the newsletter, and a free family account. We never ask a child for either one. The site also counts page views through Google Analytics, which isn't about who your child is; the measuring-the-site section further down covers exactly what it sees.

The newsletter

• The newsletter, the Elfcat News, is for parents and teachers, not for children.
• There are two ways to join, and one list behind them: the newsletter box on our pages, and the optional tick-box on the sign-in page. Either way you get the same confirmation email, and you end up on the same list.
• We use double opt-in. After you sign up, we send you a confirmation email, and you're not on the list until you click the link inside it. Before that, your address just waits, unconfirmed. If you ignore that email, nothing happens. The link stops working after three days, and the unconfirmed address is then deleted.
• The tick-box on the sign-in page starts empty, and nothing happens unless you tick it yourself. Signing in on its own never adds you to the newsletter, and ticking the box doesn't open an account. Even if you do both at once, the newsletter still waits for you to click the link in its own confirmation email.
• The list is ours, kept in our own database, not at a mailing-list company.
• For each address we keep the address itself, the language of the page you signed up on, a note that says waiting or confirmed, the date you signed up and the date you confirmed, and the scrambled keys used for the confirmation link and the leave link. We don't keep your IP address, your device or browser, which page or which box you used, any record of you opening a newsletter or clicking a link in it, or anything about your child.
• The newsletter list is separate from family accounts and isn't connected to them. We don't check one against the other, and the address on the list is used for the newsletter and nothing else. Deleting a family account doesn't take you off the newsletter, and leaving the newsletter doesn't touch your account.
• Resend (resend.com) sends the confirmation email for us, so they see your address in order to deliver it. It follows the same rules as the sign-in email further down: we don't ask for open or click tracking, there's no tracking pixel, and its pictures travel inside the message, so nothing is fetched when you open it.
• Every newsletter we send will carry a link to leave, and leaving deletes your address from our list. You don't have to wait for one: write to [email protected] at any time and we'll delete it for you.
• We used to run the newsletter through a mailing-list company called MailerLite. If you signed up back then, your address may still be on that old list. Nothing on our site signs anyone up for it any more, and we haven't copied anyone from it to our own list. To be taken off it, write to [email protected].

The family account

An account is free, it belongs to a parent, and nothing on this site needs one. Every game, story and puzzle stays open to everyone. What an account opens is your child's room, and the pictures they save in it.

There's no password to invent. You type your email address, and the email we send back has two ways in: a six-digit code you can type on the sign-in page, and a link you can tap. Either one signs you in and you only need one, which matters if the tablet your child plays on has no email app on it. Resend (resend.com) sends that email for us, just as it sends the newsletter's confirmation email. We don't ask for open or click tracking on it, we put no tracking pixel in it, and asking for it never puts you on a mailing list. The two pictures in it travel inside the message itself, so nothing is fetched from us when you open it, and there's no signal for us to receive. Every email we send carries a plain-text version as well, so reading with images off loses the pictures and nothing else. That email also spells out what the account will hold, because using either the code or the link is how you agree to it.

Here is everything an account holds:

• Your email address, plus the date you agreed and which version of that notice you saw.
• Up to four child profiles. A profile is a nickname you choose, up to twenty letters. No birthday, no photo, no surname.
• Your child's room: which house, which room colour, and which window view. Every one of those is a pick from a short fixed list, so there is nowhere in it to type anything.
• The pictures your child saves in their room. There's a section on those further down.
• Which of those pictures your child has pinned up on the board in their room. A list of choices, nothing more about the pictures themselves.
• Saved game progress for those profiles: which game, and how far. Numbers only, never free text. The room above is the first thing that uses this. No game saves its progress to the account yet.
• A record of anything bought in our shop, so it can be downloaded again. The shop isn't connected to accounts yet, so nobody has one of these.
• A record that keeps you signed in on this browser. No IP address, no device details.

The family page has a button that downloads all of it as one file, and a button that deletes the account. Deleting happens straight away and takes the pictures with it. We show no ads, and none of this is sold or shared.

Cookies we set ourselves

There are three of them, they're all ours, and none of them turns up until you do something that needs one: switch the language, or ask to sign in.

When a parent signs in, we set a cookie called kf_session. It keeps you signed in, and it does nothing else: it carries no measurement and no advertising, not now and not later. It lasts 30 days and renews while you keep coming back, with a hard stop six months after it was made. Signing out deletes it. Google Analytics sets its own cookies separately, and the next section explains those and how to switch them off.

There's a second one, and it's measured in minutes rather than months. When you ask for a sign-in email, we set kf_pending. It holds one random value, and its only job is to tie the six-digit code in that email to this browser, so the code works nowhere else. A code read off somebody else's screen is no use to anyone. It carries no address and nothing about you, it's never read for anything but that one check, and it goes the moment the sign-in finishes, or 15 minutes later if it doesn't.

The third one has nothing to do with signing in. If you use the language switch at the top of the page, we set kf-lang, which remembers the language you picked so the site opens in it next time. That one choice is all it holds, it's never read for anything else, and it lasts a year. Anyone who uses that switch sets it, child or grown-up, and it says nothing about who they are.

Measuring how the site is used

We measure how the site is used, so we can see which pages people open and keep the parts that work. It is kept deliberately small, and none of it is about who your child is.

Google Analytics

We use Google Analytics for this, and it runs for everyone by default. It records each time a page is opened, and roughly how long it stays open on the screen. From each visit it sees an approximate location (a country or a city, worked out from the network, never a precise one), rough device and browser details, the time, the address of the page, and, when there is one, where the visit came from. Google is the company that receives this, acting for us, and their own terms cover it:how Google uses data from sites that use its services.

The page address reaches Google with everything after a question mark or a # removed, with one exception: campaign labels. Some links carry them after the question mark, like the link in our Instagram or YouTube profile, or a link under one of our posts. The labels say which site the link was on, what kind of link it was, which campaign it belongs to, and which post. We keep them so we can see which of our own posts and links bring people here.

A label gets through only if it's a short, plain word made of the letters a to z, numbers, hyphens and the _ sign, and it's changed to lower case on the way. Everything else after the question mark is still removed, so an email address, a sentence, or anything with an @, a space or another symbol in it can't pass.

On our own links we write the labels ourselves. They say where the link was placed, and we never put a name, an email address, or anything about a person or a child in them. Nothing anyone types on our site ever goes into them. A link someone else made can carry labels too. Only short, plain words get through from those as well, but we don't write them, so we can't vouch for what's in them.

The address a visit came from is trimmed too. If it was another website, Google sees that site's name, like instagram.com or google.com, and never which page on it. If it was one of our own pages, Google sees which of our pages it was. Nothing after a question mark or a # ever goes with it.

We hold it to the basics on purpose. There is no advertising, no remarketing and no profile-building. Google Signals is switched off, so nothing is tied back to a Google account, and ad personalisation is off. We send no User-ID and no account or session id, and we never add a name, an email address, a drawing, anything typed, or anything searched. To tell one visit from the next, Google Analytics sets its own cookies, named _ga and _ga_…; those are the analytics cookies mentioned in the section above.

What Google keeps comes in two parts. The visit-by-visit detail, meaning each page opening with its device, rough location, how long it stayed open, link labels and where the visit came from, is deleted after two months. The totals in Google Analytics' standard reports, like how many times a page was opened or how many visits came from a certain site or from one of our links, are kept, and the two-month setting doesn't delete them. They're counts, with no ID for any visitor in them.

You can switch it off for this device. Turn it off here and no more of these measurements leave this browser, and the _ga cookies are cleared:

This choice is remembered in this browser only. On a different browser or device, or after you clear your browsing data, you would set it again.

Cloudflare

Our pages are served through Cloudflare, and Cloudflare also measures how they perform: roughly how fast a page loaded, the rough region a visit came from, and which browser it used. This one loads a small measurement script in the browser (from static.cloudflareinsights.com). It sets no cookies, it does not follow visitors from site to site, and it builds no profile. It is Cloudflare's own measurement rather than ours, so the switch above does not turn it off; Cloudflare's own privacy terms cover what it sees.

Settings saved on your device

Here is everything stored in your browser's local storage:

• kf-muted remembers whether you turned game sounds off.
• kf-timer remembers whether you want the puzzle timer visible.
• kf-volume remembers how loud you set the sound in the games that have a volume slider.
• kf-melody-best-4, and one key like it for each Music Grove board size, remembers the longest tune you echoed on that board, so Melo can greet you with it when you come back.
• kf-stardust remembers the stardust gathered in the storybooks and little games: a number, and a short list of which specks were already picked up, so the same speck is not offered twice. There is nothing about you in it.
• kf-signed-in is a yes or no marker saying a grown-up signed in on this browser. It holds no email address and no name. Signing out removes it.
• kf-room remembers how your child arranged their room: which house, the room colour, and the window view. No dates and no counters are in it. This is the copy the room actually runs on, and while a grown-up is signed in, a copy is kept with the account as well. The room section further down explains that half.
• kf-garden-… remembers a child profile's care-garden journey: the chosen animal, an optional animal name, the date care began, four completed care chapters, whether the friend is asleep, the Healer check, the return-home steps, and which friends already returned to the wild. It stays only in this browser and is never copied to the account. A grown-up can reset it from that profile's account card. Deleting the profile or account, or clearing browser data, removes it too.
• kf-analytics-consent-v1 remembers whether a grown-up switched analytics off on this device, using the button in the measuring-the-site section above. It holds one word, on or off, and nothing about you.

Apart from the room, none of these leave your device and we never see them. Clearing your browser data removes them, and the games simply start fresh.

The stardust pouch

While your child reads one of the storybooks, or plays one of the little games, small specks of stardust can be picked up along the way. The pouch is saved in this browser, on this device, and nothing is sent to us: it holds a number and a short list of which specks were already found. There is no score to beat, no streak, and nothing expires or disappears. Every story and game ends exactly the same way whether the pouch is full or empty, and they work normally if your browser saves nothing at all. Clearing your browser data empties the pouch.

Your photos in the jigsaw game

Our puzzle table lets you turn one of your own photos into a jigsaw. The photo is opened by your browser, on your device, and stays there. It is never uploaded, never stored by us, and never leaves your device.

Your child's room

The room is your child's own corner: a house, a room colour, a window view, and a cabinet that fills with stardust jars as your child reads. While nobody is signed in, all of that stays in this browser, we never see it, and the room works exactly as it does otherwise. Signing in adds two more things to the room, the pictures your child saves and the board they pin them to, and both have their own sections below.

When a parent is signed in, the room is kept with the account too, under that child's profile, so it opens the same way on the tablet and on the laptop, and clearing your browser data doesn't empty it. The copy in the browser is still the one the room runs on, so a slow connection or no connection at all never gets in your child's way.

The care garden is different from the room. The chosen animal, an optional animal name, the date care began, four care chapters, the Healer check, and the return-home progress stay only in this browser for that child profile. They do not appear on another device and are not copied to the account. A grown-up can reset this care journey from the profile card. Deleting the profile or account, or clearing browser data, removes it too.

What we hold is a short list of choices: which house, which colour, which view. Each one is a pick from a fixed list, so there's nowhere in it to type anything. No dates, no counters, nothing about how long or how often your child played. The stardust jars on the cabinet aren't in it. They come from reading, and they stay on the device with the stardust itself, which is the section further up.

When the same room has been open in two places, the newest choice wins: which house, which colour, which view. A child who repaints their room means it. The pictures aren't part of that. They're a separate list, and nothing about syncing can remove one.

Pictures saved in your child's room

When your child is signed in, the pictures they make can be saved to their room, so they'll find them again next time. That is the whole reason they're saved. Three games save one today. My Sticker Book saves the painted version of what your child built. The painting starts only when your child taps "Let the forest paint it", and it saves on its own as soon as it comes back. My Drawing saves the picture your child drew, together with its painted version, only when they tap "Save in My Room". The Coloring Workshop saves the page your child coloured in only when they tap "Put it in my room". There is one exception: when your child presses "Let the forest paint my picture" in the Coloring Workshop, the painted version saves on its own as soon as it comes back, the way My Sticker Book does.

Each picture belongs to the child who made it. It shows up in that child's room and nowhere else, so two children on one family account never see each other's drawings. You can see a child's pictures yourself by opening that child's room, and the data download on the family page lists every picture the account holds.

Painted pictures are kept as a pair. In My Sticker Book, My Drawing and the Coloring Workshop, what your child made is saved beside the painted version of it, and the two count as one picture: they open together and they come down together. A coloured page kept without the painting is a single picture, because the blank drawing underneath it is ours, not your child's, so there is no second frame worth keeping.

When nobody is signed in, nothing is saved. The picture appears on the screen, it can be downloaded, and it's gone when the page closes. Painting works the same either way. In the three games that can end in a painted picture, the painting itself still happens outside our site, signed in or not, and the section below walks through that.

A saved picture is your child's own artwork: shapes they placed, a page they coloured, or lines they drew. It is never a photograph, because none of these games has a camera. We write nothing on a picture ourselves. What is on it is whatever your child made, and a child drawing on a blank page can draw letters, or their own name, and that is kept with the rest of the picture. In the room, each picture opens, downloads and can be removed on its own, and they stay until somebody removes them. A picture kept as a pair comes down as one, so removing it removes both. Deleting the account removes all of them at once.

AI and the painted pictures

Three games can end in a painted picture. In My Sticker Book your child builds one out of shapes. In My Drawing they draw one freehand on a blank page. In the Coloring Workshop they colour in one of our line drawings. All three work the same way: one button turns what they made into a painted version, and here is exactly how that happens. In the Coloring Workshop that button says "Let the forest paint my picture", and if nobody presses it, the colouring never goes to Google.

The game flattens what your child made into one plain picture, our own server sends that picture to Google's Gemini model, and the painted version comes back. Our server makes that call, not your browser, and the key that lets us make it never leaves our server.

That picture is the only thing that travels. We attach nothing to it: no name, no email address, no account details, nothing about your device, and never a photograph of a person, because none of our games has a camera. What is inside the picture is whatever your child made, and on the drawing page that can include letters or a name, because a child holding a pencil can write one. We have no way to tell a name from any other line they drew. Google's own privacy policy applies to what reaches them.

This happens whether or not anybody is signed in, because the painting is done outside our site either way. Signed out, we keep no copy of it at all: the painted picture comes back to the screen, you can download it, and it's gone when the page closes. Signed in, the painted picture is kept in your child's room on its own in My Sticker Book and the Coloring Workshop, and in My Drawing only when your child taps "Save in My Room". Whenever it is kept, what your child made is kept beside it, which is the section just above.

Our puzzles on other websites

Anyone may place one of our jigsaw puzzles on their own website. When our puzzle runs there, it loads from our servers, so, like any web page, our servers briefly see the visitor's IP address and browser as the request arrives. We do not add any tracking to it: no analytics, no cookies, no counting. The photo picker and the sharing buttons are switched off in that embedded view.

Players and puzzles from other companies

Some pages include content that comes from other companies. When it loads, that company's servers are contacted and their own privacy policy applies:

• YouTube: our videos use YouTube's privacy-enhanced mode (youtube-nocookie.com).
• Spotify: music players on our listening pages.

How long we keep things

A newsletter address, for as long as you're subscribed. Every newsletter will carry a link to leave, or you can write to [email protected] at any time. Either way, your address is deleted from our list. If a confirmation link is never clicked, it stops working after three days, and the unconfirmed address is then deleted.

With Google Analytics, the visit-by-visit detail, each page opening and everything that came with it, is deleted after two months. The totals in its standard reports, such as how many times a page was opened or how many visits came from a certain site or one of our links, are kept, and the two-month setting doesn't remove them. They're counts, with no ID for any visitor in them.

Everything in a family account stays until you delete it. We don't delete accounts for going quiet, and we don't email anyone to pull them back. If an account is closed from the link in that email, it stays as well. Closing locks it rather than erasing it, and from then on [email protected] is the way to see what's in it, get a copy, or have it removed. Two things expire on their own. The code and the link in a sign-in email stop working fifteen minutes after we send them, or the moment you use one of them, whichever comes first. The record that keeps you signed in expires thirty days after your last visit, and in any case six months after it was made.

Children's data

We never ask a child for personal information. Nothing on this site asks a child to type in who they are, and every game works without an account of any kind.

When a parent opens a family account, four things linked to their child sit on our side: the nickname the parent chose, the room the child arranged, the pictures they saved in it, and which of those pictures they pinned up on the board. The parent can see, download and delete all four. We don't ask for a birthday, a surname, a photo or a home address, and there is no box anywhere on the site to type one into. The one way a child can put words into anything we keep is by drawing them.

Questions

Write to us at [email protected]. A real person reads it.

Last updated: 2 October 2026.