Privacy Policy for the Elf Diaries app

Last updated: 12 October 2026

1. Who is responsible

Klotzbuecher & Klumpe GbR (K2 Solutions) Dechsendorfer Str. 14, 91054 Erlangen, Germany Email: hallo@k2-solutions.io

2. What this is about

Elf Diaries (listed in the US App Store as Christmas Elf Diaries) is an app for iOS and Android that helps parents through the elf door tradition in the run-up to Christmas. The app needs no user account and no sign-in. This policy describes which data the app processes, and which of it ever leaves your device.

3. Data that stays on your device

Everything you enter in the app stays on your device: your elf’s name, your child’s name (optional), the arrival date, the elf character you chose, the age and budget settings, your plan and its status, your notes, favourites, reminders and settings, including your answer to the statistics question. None of it is transmitted to us or to anyone else. You delete it by uninstalling the app. Legal basis: Art. 6(1)(b) GDPR (providing the app).

4. Content from the server (Supabase)

The app loads the activity content — titles, instructions, supply lists, images — from our server. Nothing you have entered is transmitted in the process. For technical reasons the server sees your IP address and details of your app version; these serve only to deliver the content, are not linked to you, and are deleted from the server logs after a short time. The app also works offline using the content shipped with it. Provider: Supabase Inc.; servers located in the EU. Transmission encrypted via HTTPS. Legal basis: Art. 6(1)(b) GDPR.

5. App configuration (Firebase Remote Config)

So that we can adjust features without shipping an app update, the app fetches a configuration from Google Firebase. In doing so, your country code, language, time zone, operating system version, app identifier and a random installation ID are sent to Google — no entries of yours, and no advertising ID. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a stable app).

Measurement is switched off out of the box. After setup, the app asks you once whether you would like to help make it better. Only if you tap “Yes, happy to” does the app record which features are used — for example how many activities are planned or letters created — plus app starts, session length, app version, device type, operating system, language and the approximate region (from a shortened IP address, not from location services). Names, notes and letter contents are never recorded. No advertising ID is used and nothing is used for advertising. Google assigns the events to a random app instance ID and to the vendor’s device identifier (IDFV). You can withdraw consent at any time in the app under Profile > Privacy > “Anonymous usage statistics”. Switching it off resets the analytics data for that installation at Google. Provider: Google Ireland Limited (see above). Data may be transferred to the USA; Google LLC is certified under the EU-US Data Privacy Framework. Retention at Google: up to 14 months. Legal basis: Art. 6(1)(a) GDPR (consent), § 25(1) TDDDG. More on Firebase: https://firebase.google.com/support/privacy

7. Reminders

Reminders for planned days are local notifications from your own device. There is no push server. Your operating system asks for permission when you set your first reminder.

You print or share letters and notes using your device’s own functions (the print dialogue, the share menu). What you pass on to a printer or to another app is up to you.

9. Purchases through the stores

Purchases are handled by Apple (App Store) and Google (Google Play). We receive no personal data from you in the process; the privacy terms of Apple and Google apply.

10. Children

The app is made for parents. It collects no data from children. Your child’s name is used only to personalise the letters and stays on the parent’s device.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21), and the right to withdraw consent at any time. Because we hold no accounts, we cannot link analytics data to any person; you action the withdrawal yourself using the switch in the app. Complaints can be made to the data protection supervisory authority for your federal state in Germany (list: https://www.bfdi.bund.de/DE/Service/Anschriften/anschriften_table-node.html), to the Information Commissioner’s Office in the UK (https://ico.org.uk), or to the supervisory authority where you live.

If you are in California: we do not sell or share personal information as the California Consumer Privacy Act defines those terms, and we do not use it for cross-context behavioural advertising.

12. Changes

We update this policy when the app or the law changes. The current version is in the app under Profile > Privacy and on this page.

Questions about privacy: hallo@k2-solutions.io