Privacy policy

Effective 30 September 2026

This policy covers the Craftums app for iPhone, iPad and Android, and this website, craftums.com. Craftums is made for young children, so it is built to keep what they make on their own device.

1. Who we are

Craftums is made by Ellemsoft, based in Finland. We are responsible ("controller") for the little personal data described below. You can reach us at hello@craftums.com.

2. What stays on your device

Everything a child makes in the app is stored only in the app's own private storage on the device: the cut-out pictures of their creations (we call them Craftums) and their names, paint and outfits, island things, Draw & Go tracks, STORY books and their voice recordings, and the app's settings. We do not receive any of it, and we cannot see it.

Deleting a thing in the app (behind a grown-up hold) deletes it from the device. Deleting the app deletes everything.

3. The camera

The app uses the camera only when a child or grown-up chooses to scan something. The photo is saved to a temporary file on the device, the creation is cut out of it on the device, and the photo is deleted. Only the cut-out picture is kept, on the device. The app does not ask for access to your photo library.

4. No third-party code that collects data

The app contains no third-party SDKs that collect data: no advertising, analytics, crash-reporting or tracking code from anyone. The creation is cut out of the photo by the app's own code, on the device, the same on Android, iPhone and iPad.

5. Voices in picture books (STORY)

A grown-up can let the app use the microphone to record a short voice for a page of a picture book made in STORY. Recordings are at most 30 seconds, are stored only on this device, and are played only in that book. They are never sent to us or anyone else, never analysed, and are not included in the device's cloud backups. Deleting the page or the book deletes its recording; deleting the app deletes all of them. Microphone access can be turned off at any time in the device's Settings.

Nothing else in the app uses the microphone, and nothing in the app listens to or reacts to voices.

6. Playing together (ADVENTURE)

If a grown-up starts "play together", the tablet and the grown-up's phone connect through our small server in the EU (hosted by Hetzner). Only button presses travel between them: which choice was picked, as short codes like "jump". No pictures, drawings, names or sound ever leave the tablet. To make the connection work, our server necessarily sees the internet (IP) addresses of the two devices while they are connected, and for one minute to stop misuse. Nothing is written down, logged or kept: when the adventure ends, the session is gone. We use no analytics, advertising or tracking, and we never sell or share data.

More detail for the curious:

• The server is at play.craftums.com, in Hetzner's data centre in Helsinki, Finland. Hetzner Online GmbH hosts it for us as a processor.
• We process the two IP addresses only to provide the connection the grown-up asked for, and to stop misuse (a limit on how many codes one address can try per minute).
• A session ends when the adventure ends, when the tablet leaves ADVENTURE, after 10 minutes without messages, or after 60 minutes at the most.
• The grown-up's phone needs no app and no account. The web page sets no cookies. It keeps one random session token in that browser tab's session storage, so the phone can reconnect after a short drop; it is gone when the tab is closed.
• Between the devices travel only fixed codes (which obstacle, which word choices, which language, which choice was pressed, how many more obstacles before the end), never free text.

7. Printing

A grown-up can print a Craftum as a sticker sheet or a colouring page. The page goes to the device's own print dialog, and from there to the printer (or file) you choose. The app itself sends nothing anywhere.

8. Everything the app sends over the internet

We checked the app's code for every way it can reach the internet. There is exactly one:

1. ADVENTURE's "play together" connection to play.craftums.com, only after a grown-up presses start (section 6).

The app contains no advertising, analytics, crash-reporting, social or tracking code. There are no in-app purchases. It has no accounts and no links out of the app for children to follow. The grown-up Settings screen, behind its hold, has two links: to this policy and to our help page. They open in your device's browser, where section 13 applies.

9. The app stores

You get Craftums from Apple's App Store or Google Play. Apple and Google handle the download and any payment under their own privacy policies. If you have agreed in your device's settings to share diagnostics with app developers, Apple or Google may show us crash reports and summary figures (such as the number of installs) that do not identify you.

10. Device backups

The app never makes backups itself. If you have turned on your device's own backup (for example iCloud or Google backup), the operating system may include the app's data, such as the cut-out pictures and books, in that backup, under your account with Apple or Google. We have no access to it. STORY's voice recordings are excluded from these backups, so they do not move to a new device.

11. Children's privacy

Craftums is designed for children. What a child makes, including photos and voice recordings, is made, stored and used only on the device and is never transmitted to us. The only personal data we process ourselves are the IP addresses of the tablet and the phone during ADVENTURE's "play together", which a grown-up starts. They are used only to make the connection work and to stop misuse, and are not kept. We do not show ads, build profiles, or share or sell data. Grown-up areas (settings, printing, deleting, and turning on the microphone) are behind a hold-to-open button.

12. Deleting data and your rights

Because everything a child makes stays on the device, you are in control of it: delete things in the app, or delete the app to delete everything. We hold no copy and no account we could look up or delete.

Under data protection law (such as the GDPR in the EU and the UK GDPR) you have the right to ask us about, correct, delete or restrict personal data we hold about you, to object to its use, and to complain to a data protection authority, such as the Office of the Data Protection Ombudsman in Finland (tietosuoja.fi) or the one where you live. In the US, parents may ask us what information we have about their child and ask us to delete it. For ADVENTURE, we keep nothing after a session ends, so in practice there is nothing to look up. Write to hello@craftums.com with any question.

13. This website

craftums.com is a set of plain pages. It uses no cookies, no analytics, no trackers, no ads and no scripts, and loads nothing from other websites: the font and pictures come from this server. The server is ours, at Hetzner in Helsinki, Finland. To send you a page, it necessarily sees your IP address and what your browser asks for, while it answers. It is configured to write no access log for this website, so we keep no record of visits or of IP addresses.

14. Changes and contact

If the app starts doing anything new with data, we will update this policy first and change the date at the top. Questions: hello@craftums.com.

If you email us, we use your address and message only to answer you. We delete the conversation once your question is settled.