Privacy at Kittelfdora Kids

Here's the honest picture: this site asks almost nothing of you. There are no ads, and nothing about your child is ever sold or shared. We do use Google Analytics to measure how the site is used, in the plainest way it comes: a count of which pages get opened. A section further down spells out exactly what that sees, and how to switch it off on your device. Every game and story is free to play without an account, and grown-ups can open a free family account, which is the one part of the site that stores anything about you by name. This page explains all of it.

This is an informational page, not a wall of legal boilerplate. We keep it accurate and update it when the site changes.

What we collect

Two things count as personal information, and both are a grown-up's choice: an email address for the newsletter, and a free family account. We never ask a child for either one. The site also counts page views through Google Analytics, which isn't about who your child is; the measuring-the-site section further down covers exactly what it sees.

The newsletter

• The newsletter is for parents and teachers, not for children.
• We use double opt-in: after you sign up, we send a confirmation email, and nothing starts until you click the link inside it.
• MailerLite processes the emails for us. Your address lives in their system on our behalf, under their privacy policy.
• There's a newsletter tick-box on the sign-in page. If you tick it, your address goes to MailerLite the same way, and only then. Signing in on its own never adds you to anything.

The family account

An account is free, it belongs to a parent, and nothing on this site needs one. Every game, story and puzzle stays open to everyone. What an account opens is your child's room, and the pictures they save in it.

There's no password to invent. You type your email address, and the email we send back has two ways in: a six-digit code you can type on the sign-in page, and a link you can tap. Either one signs you in and you only need one, which matters if the tablet your child plays on has no email app on it. Resend (resend.com) sends that one email for us. We don't ask for open or click tracking on it, we put no tracking pixel in it, and it isn't a mailing list. The two pictures in it travel inside the message itself, so nothing is fetched from us when you open it, and there's no signal for us to receive. Every email we send carries a plain-text version as well, so reading with images off loses the pictures and nothing else. That email also spells out what the account will hold, because using either the code or the link is how you agree to it.

Here is everything an account holds:

• Your email address, plus the date you agreed and which version of that notice you saw.
• Up to four child profiles. A profile is a nickname you choose, up to twenty letters. No birthday, no photo, no surname.
• Your child's room: which house, which room colour, and which window view. Every one of those is a pick from a short fixed list, so there is nowhere in it to type anything.
• The pictures your child saves in their room. There's a section on those further down.
• Which of those pictures your child has pinned up on the board in their room. A list of choices, nothing more about the pictures themselves.
• Saved game progress for those profiles: which game, and how far. Numbers only, never free text. The room above is the first thing that uses this. The other games still don't save to an account.
• A record of anything bought in our shop, so it can be downloaded again. The shop isn't connected to accounts yet, so nobody has one of these.
• A record that keeps you signed in on this browser. No IP address, no device details.

The family page has a button that downloads all of it as one file, and a button that deletes the account. Deleting happens straight away and takes the pictures with it. We show no ads, and none of this is sold or shared.

Cookies we set ourselves

There are three of them, they're all ours, and none of them turns up until you do something that needs one: switch the language, or ask to sign in.

When a parent signs in, we set a cookie called kf_session. It keeps you signed in, and it does nothing else: it carries no measurement and no advertising, not now and not later. It lasts 30 days and renews while you keep coming back, with a hard stop six months after it was made. Signing out deletes it. Google Analytics sets its own cookies separately, and the next section explains those and how to switch them off.

There's a second one, and it's measured in minutes rather than months. When you ask for a sign-in email, we set kf_pending. It holds one random value, and its only job is to tie the six-digit code in that email to this browser, so the code works nowhere else. A code read off somebody else's screen is no use to anyone. It carries no address and nothing about you, it's never read for anything but that one check, and it goes the moment the sign-in finishes, or 15 minutes later if it doesn't.

The third one has nothing to do with signing in. If you use the language switch at the top of the page, we set kf-lang, which remembers the language you picked so the site opens in it next time. That one choice is all it holds, it's never read for anything else, and it lasts a year. Anyone who uses that switch sets it, child or grown-up, and it says nothing about who they are.

Measuring how the site is used

We measure how the site is used, so we can see which pages people open and keep the parts that work. It is kept deliberately small, and none of it is about who your child is.

Google Analytics

We use Google Analytics for this, and it runs for everyone by default. It records one thing: that a page was opened. From each visit it sees an approximate location (a country or a city, worked out from the network, never a precise one), rough device and browser details, the page address with anything after a question mark stripped off, and the time. Google is the company that receives this, acting for us, and their own terms cover it:how Google uses data from sites that use its services.

We hold it to the basics on purpose. There is no advertising, no remarketing and no profile-building. Google Signals is switched off, so nothing is tied back to a Google account, and ad personalisation is off. We send no User-ID and no account or session id, and never a name, an email address, a drawing, anything typed, or anything searched. Google Analytics keeps this usage data for two months and then deletes it. To tell one visit from the next it sets its own cookies, named_ga and _ga_…; those are the analytics cookies mentioned in the section above.

You can switch it off for this device. Turn it off here and no more of these measurements leave this browser, and the _ga cookies are cleared:

This choice is remembered in this browser only. On a different browser or device, or after you clear your browsing data, you would set it again.

Cloudflare

Our pages are served through Cloudflare, and Cloudflare also measures how they perform: roughly how fast a page loaded, the rough region a visit came from, and which browser it used. This one loads a small measurement script in the browser (from static.cloudflareinsights.com). It sets no cookies, it does not follow visitors from site to site, and it builds no profile. It is Cloudflare's own measurement rather than ours, so the switch above does not turn it off; Cloudflare's own privacy terms cover what it sees.

Settings saved on your device

Here is everything stored in your browser's local storage:

• kf-muted remembers whether you turned game sounds off.
• kf-timer remembers whether you want the puzzle timer visible.
• kf-volume remembers how loud you set the sound in the games that have a volume slider.
• kf-melody-best-4, and one key like it for each Music Grove board size, remembers the longest tune you echoed on that board, so Melo can greet you with it when you come back.
• kf-stardust remembers the stardust gathered in the storybooks and little games: a number, and a short list of which specks were already picked up, so the same speck is not offered twice. There is nothing about you in it.
• kf-signed-in is a yes or no marker saying a grown-up signed in on this browser. It holds no email address and no name. Signing out removes it.
• kf-room remembers how your child arranged their room: which house, the room colour, and the window view. No dates and no counters are in it. This is the copy the room actually runs on, and while a grown-up is signed in, a copy is kept with the account as well. The room section further down explains that half.
• kf-analytics-consent-v1 remembers whether a grown-up switched analytics off on this device, using the button in the measuring-the-site section above. It holds one word, on or off, and nothing about you.

Apart from the room, none of these leave your device and we never see them. Clearing your browser data removes them, and the games simply start fresh.

The stardust pouch

While your child reads one of the storybooks, or plays one of the little games, small specks of stardust can be picked up along the way. The pouch is saved in this browser, on this device, and nothing is sent to us: it holds a number and a short list of which specks were already found. There is no score to beat, no streak, and nothing expires or disappears. Every story and game ends exactly the same way whether the pouch is full or empty, and they work normally if your browser saves nothing at all. Clearing your browser data empties the pouch.

Your photos in the jigsaw game

Our puzzle table lets you turn one of your own photos into a jigsaw. The photo is opened by your browser, on your device, and stays there. It is never uploaded, never stored by us, and never leaves your device.

Your child's room

The room is your child's own corner: a house, a room colour, a window view, and a cabinet that fills with stardust jars as your child reads. While nobody is signed in, all of that stays in this browser, we never see it, and the room works exactly as it does otherwise. Signing in adds two more things to the room, the pictures your child saves and the board they pin them to, and both have their own sections below.

When a parent is signed in, the room is kept with the account too, under that child's profile, so it opens the same way on the tablet and on the laptop, and clearing your browser data doesn't empty it. The copy in the browser is still the one the room runs on, so a slow connection or no connection at all never gets in your child's way.

What we hold is a short list of choices: which house, which colour, which view. Each one is a pick from a fixed list, so there's nowhere in it to type anything. No dates, no counters, nothing about how long or how often your child played. The stardust jars on the cabinet aren't in it. They come from reading, and they stay on the device with the stardust itself, which is the section further up.

When the same room has been open in two places, the newest choice wins: which house, which colour, which view. A child who repaints their room means it. The pictures aren't part of that. They're a separate list, and nothing about syncing can remove one.

Pictures saved in your child's room

When your child is signed in, the pictures they make are saved to their room, so they can find them again next time. That is the whole reason they're saved. Three games save one today. My Sticker Book saves the painted version of what your child built, and it saves on its own, without anyone tapping anything. The Coloring Workshop saves the page your child coloured in, and The Painting Forest saves the picture they drew, both only when your child chooses to keep them.

Each picture belongs to the child who made it. It shows up in that child's room and nowhere else, so two children on one family account never see each other's drawings. You can still see all of them yourself, from the family page.

Two of those are kept as a pair. In My Sticker Book and The Painting Forest, what your child made is saved beside the painted version of it, and the two count as one picture: they open together and they come down together. A coloured page is a single picture, because the blank drawing underneath it is ours, not your child's, so there is no second frame worth keeping.

When nobody is signed in, nothing is saved. The picture appears on the screen, it can be downloaded, and it's gone when the page closes. The games play the same either way, and they never say which one just happened. In the two games that end in a painted picture, the painting itself still happens outside our site, signed in or not, and the section below walks through that.

A saved picture is your child's own artwork: shapes they placed, a page they coloured, or lines they drew. It is never a photograph, because none of these games has a camera. We write nothing on a picture ourselves. What is on it is whatever your child made, and a child drawing on a blank page can draw letters, or their own name, and that is kept with the rest of the picture. In the room, each picture opens, downloads and can be removed on its own, and they stay until somebody removes them. A picture kept as a pair comes down as one, so removing it removes both. Deleting the account removes all of them at once.

AI and the painted pictures

Two games end in a painted picture. In My Sticker Book your child builds one out of shapes. In The Painting Forest they draw one freehand on a blank page. Either way, one button turns what they made into a painted version, and here is exactly how that happens. The Coloring Workshop is not one of these. There your child does the colouring themselves, and nothing leaves our site.

The game flattens what your child made into one plain picture, our own server sends that picture to Google's Gemini model, and the painted version comes back. Our server makes that call, not your browser, and the key that lets us make it never leaves our server.

That picture is the only thing that travels. We attach nothing to it: no name, no email address, no account details, nothing about your device, and never a photograph of a person, because none of our games has a camera. What is inside the picture is whatever your child made, and on the drawing page that can include letters or a name, because a child holding a pencil can write one. We have no way to tell a name from any other line they drew. Google's own privacy policy applies to what reaches them.

This happens whether or not anybody is signed in, because the painting is done outside our site either way. Signed out, we keep no copy of it at all: the painted picture comes back to the screen, you can download it, and it's gone when the page closes. Signed in, the painted picture is kept in your child's room, and what your child made is kept beside it, which is the section just above.

Our puzzles on other websites

Anyone may place one of our jigsaw puzzles on their own website. When our puzzle runs there, it loads from our servers, so, like any web page, our servers briefly see the visitor's IP address and browser as the request arrives. We do not add any tracking to it: no analytics, no cookies, no counting. The photo picker and the sharing buttons are switched off in that embedded view.

Players and puzzles from other companies

Some pages include content that comes from other companies. When it loads, that company's servers are contacted and their own privacy policy applies:

• YouTube: our videos use YouTube's privacy-enhanced mode (youtube-nocookie.com).
• Spotify: music players on our listening pages.

How long we keep things

The newsletter email, for as long as you're subscribed. Every newsletter has an unsubscribe link, and unsubscribing removes your address through MailerLite.

The Google Analytics usage counts, for two months, and then Google deletes them.

Everything in a family account stays until you delete it. We don't delete accounts for going quiet, and we don't email anyone to pull them back. If an account is closed from the link in that email, it stays as well. Closing locks it rather than erasing it, and from then on [email protected] is the way to see what's in it, get a copy, or have it removed. Two things expire on their own. The code and the link in a sign-in email stop working fifteen minutes after we send them, or the moment you use one of them, whichever comes first. The record that keeps you signed in expires thirty days after your last visit, and in any case six months after it was made.

Children's data

We never ask a child for personal information. Nothing on this site asks a child to type in who they are, and every game works without an account of any kind.

When a parent opens a family account, four things linked to their child sit on our side: the nickname the parent chose, the room the child arranged, the pictures they saved in it, and which of those pictures they pinned up on the board. The parent can see, download and delete all four. We don't ask for a birthday, a surname, a photo or a home address, and there is no box anywhere on the site to type one into. The one way a child can put words into anything we keep is by drawing them.

Questions

Write to us at [email protected]. A real person reads it.

Last updated: 21 August 2026.