Privacy policy

1. Who we are

Elmlings is run by Elmer Studio LLC, 7901 4th St N, Ste 300, St. Petersburg, FL 33702, USA.

• Phone: (941) 321-6292
• Email: hello@elmlings.com

When this policy says "we" or "us," it means Elmer Studio LLC.

2. The short version

• Kids never create an account or sign in. We do not ask for names, email addresses, phone numbers, photos, or home addresses.
• Each phone or web browser gets a random ID, like dev_7k2m.... We save game progress under that ID.
• We use the camera to read QR codes and barcodes. We do not save or upload pictures.
• We may use the phone's location for a moment to check which shop the player is in. It is checked on our server and then thrown away. We do not save the location, only the shop and the time.
• There are no ads, no chat, and no third-party tracking or analytics tools.
• We do not sell information.
• A parent can see and delete this phone's game data on the Parents screen in Elmlings Play, or by emailing hello@elmlings.com.

3. What this policy covers

This policy covers:

• Elmlings Play, the game at www.elmlings.com.
• Elmlings Scan, the shop scanner at www.elmling.com and the Elmlings Scan app for iPhone and iPad.

Both apps share the same game data. Some shops that sell Elmlings also use staff-only tools. Those are covered in Section 12.

4. No accounts: how the device ID works

Players never sign in. Instead:

• The first time someone opens Elmlings Play on a phone or in a browser, the game makes a random device ID. It starts with dev_ and is followed by random letters and numbers. It is not based on the phone's name, phone number, serial number, or advertising ID.
• The game also makes a random device secret. The secret stays on the phone. Our server keeps only a scrambled version (a "hash") of it. We use it to check that requests to read or change a player's game data really come from that phone.
• Elmlings Scan makes its own random scanner ID (it starts with scn_) and its own secret, kept in the phone's secure storage on iPhone. The player's device ID and secret are never passed to Elmlings Scan.

Linking a parent's scanner. A parent can link Elmlings Scan on their own phone to a child's Elmlings Play by scanning a short code shown in Play's Parents area. We store only two random device codes and when they were linked. We store no names, and the nickname a parent gives each child stays on the parent's phone. Either side can unlink at any time.

Each phone or browser has its own ID. If you clear the browser's data or use a different browser, the game starts fresh with a new ID.

5. What we collect and why

Everything in this table is saved on our servers under the device ID. None of it includes the child's name or contact details.

We use this information only to run the game, keep it fair, fix problems, and understand how the game and shops are doing overall. We do not use it to build advertising profiles, and we do not use it to contact anyone.

6. What stays only on the phone

Some things are saved only on the phone or in the browser, and are not sent to us:

• Pet care levels (like hunger and happiness)
• Outfits in the local wardrobe
• Quest progress, unless quest backup is on
• The nicknames a parent gives each child in Elmlings Scan
• The device secret itself

These are removed when you delete the app or clear the browser's data for our website.

Play coins are saved with the yard and other game data on our server.

7. What we do not collect

We do not collect:

• Names, email addresses, phone numbers, or home addresses from players
• Photos, videos, or voice recordings
• Contacts, messages, or chat
• Saved GPS location or location history
• Wi-Fi network names
• Advertising IDs

There are no ads in Elmlings, and we do not use third-party analytics or advertising tools.

8. Location

Elmlings uses location in a few limited ways, and only while the app is open:

• Checking in at a shop (Elmlings Play). If a shop's sign does not have a check-in code, the game may ask for the phone's location. The location is sent to our server once, compared with the shop's position, and thrown away. We save only which shop and when.
• Checking in at a shop (Elmlings Scan). If you haven't scanned the shop's sign, Scan can check whether you're inside a shop that takes part. With your permission, it reads the phone's location once and sends it to our server. The server checks whether that spot is inside a shop's area. We check on our server, not on the phone, so that shop bonuses and visit counts can't be faked. The location is used only for that check and is then thrown away. It is never saved, never shared and never used to track you. We save only which shop it was and when. If you say no to location, Scan still works. You can scan the shop's sign to check in, and without a check-in your scans still count, just without shop bonuses.
• Showing nearby shops (Elmlings Play). The Offers and "Where to buy" screens may ask for location to sort shops by distance and show the player on the map. This happens on the phone. See Section 10 about the map pictures.

We never track location in the background. Our database throws away any location or Wi-Fi name that an older version of the app might still send, and we have erased the ones saved in the past.

You can say no to location, or turn it off in the phone's settings. The game still works. Shop check-ins will then need the shop's QR sign.

9. Camera

Elmlings uses the camera to read QR codes on shop signs and toy cards, and barcodes on products. The code is read on the phone. We do not save, upload, or look at camera pictures. Only the code itself (for example, the barcode number) is used.

10. Companies that help us run Elmlings

We use a small number of service providers. They handle information only to provide their service to us.

Elmlings Play (the website) also loads a few things from other companies. When this happens, the phone or browser connects to that company directly, so the company can see the device's IP address and basic browser information. We do not send them the device ID or game data. The Elmlings Scan iPhone app does not load anything from these companies.

• Google Fonts (Google): the lettering used in Elmlings Play loads from Google when the game opens.
• OpenStreetMap: the map pictures on the Offers screen. If the player has allowed location, the map is centered near the player, so the map pictures requested show roughly where the player is.
• Open Food Facts: the scan history screen in Elmlings Play looks up product names and types for scanned barcodes. The barcode numbers and IP address go to Open Food Facts.
• Google Maps: only if someone taps a shop's directions link. This opens Google Maps and leaves our game.

11. We do not sell children's information

We do not sell, rent, or trade any information. We do not share information with other companies for their own use, advertising, or marketing.

We share information only:

• with the service providers listed above, to run the game;
• with partner shops, as described below;
• if the law requires it, such as a valid court order; or
• to protect the safety of our players or others.

Shops. Staff at a shop that sells Elmlings, if they have a staff login, can see the scans and check-ins made at their own shop, including the barcode, the time, and a shortened device ID. They cannot see names, because we do not have any. They cannot see scans made at other shops.

12. Store staff accounts

Staff at shops that sell Elmlings, and our own team, can sign in to staff-only tools. For those adult users we keep an email address, an optional name, a role, and which shop they work for. We use this only to run the staff tools. This part does not apply to players.

13. Parents' rights and choices

If you are the parent or guardian of a child who uses Elmlings, you can:

1. Review the information we have saved for your child's phone.
2. Delete it.
3. Stop further collection by deleting the data and then deleting the app or clearing our website's data from the browser.

Using the Parents screen (fastest)

In Elmlings Play, tap Parents at the top of the screen and answer the grown-up question. The Parents screen shows what this phone has saved: scans, tokens, the yard, the pantry, Elmlings, toy claims, quests, and shop check-ins. To delete it, choose Delete my child's data and type the confirmation word. This removes the data saved for this phone and clears what this phone kept. It does not remove another phone's data.

The Parents screen can also move this phone's play to a new phone with a one-time code, and link or unlink a parent's Elmlings Scan.

By email

Email hello@elmlings.com with the subject line "Privacy request," the device ID (or IDs), and whether you want to see the data, delete it, or both.

• Elmlings Play shows a short form of the ID on the Parents screen.
• Elmlings Scan (website or app) shows its own scanner ID (starting with scn_) near the bottom of the scan screen, and has a Delete this scanner button that removes the scanner and its links straight away. Scans already made stay with each child.

If your child uses more than one phone or browser, each has its own ID. Please send each one.

We will reply within 30 days. To protect your child, before we send anyone a copy of the data we may ask you to confirm the request from the same phone, for example by reading us the short ID shown on the Parents screen.

Deleting data cannot be undone. The pets, tokens, yard, and claimed toy cards for that phone will be gone. The code printed on a toy card can be claimed again afterward.

14. How long we keep information

We keep information only as long as we need it to run the game, and then we delete it.

15. How we protect information

We take reasonable steps to protect the information we keep:

• Our apps talk to our servers over encrypted connections (HTTPS).
• We keep as little as we can. There are no names or contact details to leak.
• Through our apps, a player's game data can be read or changed only with the device secret held by that player's phone. We store only a scrambled version of that secret, and the public parts of our database cannot be used to read other players' data.
• Staff tools require a sign-in. Shop staff see only their own shop. Only our own administrators can see activity across all players.

No system is perfectly secure. If we learn of a problem that affects your child's information, we will fix it and tell affected parents where we can.

16. The Elmlings Scan app for iPhone and iPad

The app asks for two permissions:

• Camera, to read QR codes and barcodes. No pictures are saved.
• Location while using the app, only when you haven't scanned the shop's sign, to check which shop you're in. One reading is sent to our server for that check and then thrown away. Only the shop and the time are saved.

The app does not ask for background location, contacts, photos, microphone, or tracking permission. It has no ads and no in-app purchases.

17. Children's privacy

Elmlings is made for children, so we have designed it to collect as little as possible. Children never type a name, email address, or phone number into Elmlings, and we do not ask for one. If you think your child has sent us personal information, for example in an email, contact us at hello@elmlings.com and we will delete it.

18. Changes to this policy

If we change this policy, we will post the new version here and update the date at the top. If a change means we collect or share children's information in a new way, we will show a notice in the game before the change takes effect.

19. Contact us

Questions or requests? Email hello@elmlings.com or call (941) 321-6292.

Elmer Studio LLC
7901 4th St N, Ste 300, St. Petersburg, FL 33702, USA