Elf Diary privacy notice

Version 2026-11.

This notice explains what information Elf Diary: Santa Calls ("Elf Diary", "the app") and our website, elfdiary.app, collect, why, who helps us process it, how long we keep it, and the choices and rights you have. We have tried to write it for parents, not for lawyers.

Who we are

Elf Diary is made by Aigentis Ltd, a company registered in England and Wales (company number 16537792). Our registered office is Pa103 Technology Centre, University of Wolverhampton Science Park, Glaisher Drive, Wolverhampton WV10 9RU, United Kingdom. Aigentis Ltd is the data controller for the information described here, in the app and on our website.

Contact us at [email protected] about anything in this notice, including your rights. We have not appointed a data protection officer; the same address reaches the person responsible for data protection.

Where Elf Diary is available: for now, the app is offered only in the UK. Before we offer it in the EU, we will update this notice, including naming our representative in the EU.

The short version

• The parent or guardian is the account holder. Children never sign up, log in or pay.
• We ask for as little about your child as we can: a first name, an age band (not a birthday) and a few optional details that help Santa chat. We never ask for a photo of your child.
• Santa's calls, his brief and his free voice note use AI services from Anthropic, ElevenLabs and Google. Before the first of them, the app asks you once, behind your grown-ups PIN, and nothing goes to them until you agree.
• Santa is an AI voice. Calls are not recorded: we do not keep the audio. We keep a written transcript for 30 days so you can read what was said and so we can check every call for safety, then it is deleted automatically.
• Photos you add to the diary are sent to an AI service, which describes the moment in one sentence (never anyone's appearance) and may also suggest logging it as a star or something to work on. We delete the photo straight after and never store it, and it is never shown to Santa. How long the AI service keeps it is under "AI processing".
• Santa's calls are paid for with a Santa Pass and Santa minutes that all your children share, and your first call is free. Apple or Google take the payment; we keep a record of what you bought and how many minutes you have, never your card details.
• Santa's free voice note is made by AI from your child's first name, star count and one kind moment from the diary. We do not keep it: the audio is saved only on your phone.
• There are no adverts, no tracking for advertising and no selling of data. We count how many families reach each step of the app (for example sign-ups or calls each day) as totals only, with nothing that identifies you.
• You can delete your account and your family's data at any time in Settings → Delete all data, or ask us to without the app at elfdiary.app/delete-account.
• Our website sets no cookies and uses no analytics or trackers.

What we collect

About you (the parent or guardian)

• Account details: your email address and the sign-in method you chose (Apple, Google or email and password; passwords are handled by Google Firebase Authentication and we never see them). If you sign in with Apple or Google, they give us your email address, or an Apple private relay address if you choose to hide yours.
• Your first name, so the app and Santa can refer to you.
• Your confirmation that you are the child's parent or guardian, or have their permission, and that you accepted this notice, with the date and the notice version.
• Your grown-ups PIN, stored only as a salted one-way hash (we cannot read the PIN itself).
• Settings: language, time zone, the sound setting and, if you give it, your photo consent (date and terms version).
• Your AI agreement: the date you agreed to Santa's AI notice and the version of the notice you saw (see "AI processing").
• Purchases: a record of each Santa Pass or pack of Santa minutes you buy: the product, the minutes it added, the store transaction ID, whether it was a real or a store test purchase, the date and, if it is refunded, when and how many minutes were taken back. Payment is handled by Apple or Google; we never see your card details. The box you tick before buying (that you have read the terms and the cancellation policy) only switches the buy buttons on: we don't save it.
• Your Santa minutes: when your Santa Pass ends, the minutes you have bought or earned, what is left of your free first call, the minutes set aside for a call in progress, and a record of each bring-a-friend reward that added minutes.
• Gift codes are not offered yet. If we launch them, we will update this notice first.
• Bring a friend: your own bring-a-friend code, the code you added if a friend gave you one, when the reward was paid, and how many friends have earned you a reward this season. Neither of you can see the other's account.

About your child (entered by you)

• First name and, if you add one, a phonetic spelling so Santa says it right.
• Age band (for example 5–7), never a date of birth.
• Language, the elf avatar they chose, what they call you (for example Mummy or Nana), and whether Santa should say girl, boy or child.
• Optional details for Santa: a pet's name, a hobby, up to three wishes, home town, country and the date you count down to. Every one of these can be left blank.
• Diary entries: each nice moment or elf note, the reason you typed or dictated, an emoji tag, any bonus stars you add (up to 3 on a nice moment), the one-sentence description of any photo and, on an elf note, any "make it right" task you write (up to 100 characters).
• How Santa talks about behaviour: Gentle (the setting every child starts with) or Firm but kind, which you choose for each child (see "Children's data").
• Ask Santa requests: if you ask Santa to call about something, whether to celebrate it or work on it, up to three topics (such as tidying or bedtime) and your note of up to 300 characters. It is saved with Santa's call brief.
• Santa's call brief: the short story, talking points, wins and gift hints you approve before a call.
• Santa's free voice note: the date your child's voice note was made, so that each child gets one each season. We do not keep the words or the audio.

About Santa's calls

• Booking details: the time, whether you booked it or used "Call Santa now", whether it was your free call, which children are on the call, the call's status, and the Santa minutes set aside and charged for each child's part.
• Transcripts: the words said by Santa and your child, a short summary and the result of the safety check.
• Call audio is streamed live between your phone and our voice provider and is not recorded or stored by us.
• Reports you send: if you use "Report a problem with this call" on the call summary, the call it is about, the reason you chose (something unsuitable, something upsetting, a technical problem or something else), your note if you write one (up to 500 characters) and the date.
• Christmas Eve: no new live calls start after 12:00 (your time) on 24 December, and a call already under way ends by 12:30. After that, the app plays Santa's voicemail, a recording that comes with the app, and shows a Santa tracker worked out on your phone from its clock. Neither sends anything to us or anyone else. From 12:00 on 24 December until the end of Christmas Day, photo descriptions, Santa's brief and the voice note are paused too, so nothing new goes to our AI services.

About your device

• Device tokens for notifications (so Santa's call can ring), the platform (iOS or Android) and an installation ID.
• App Check signals from Apple App Attest or Google Play Integrity, used only to stop abuse of our servers.
• Stored only on your phone, never sent to us: which advent doors each child has opened, your bedtime elf report settings, each child's voice note from Santa (the audio and its words), and which offers and milestone cards you have closed.

On our website (elfdiary.app)

• Visiting the site: the site sets no cookies and uses no analytics, adverts or trackers. Cloudflare, which hosts it, receives your IP address and the details your browser sends with each request (such as the page, the time and your browser type) so it can deliver the page and protect the site from attacks. We don't receive these details, and Cloudflare shows us totals only, such as visits per day.
• Asking to hear when we launch: "Email me when it launches" on the site opens an email to [email protected]. If you send it, we keep your email address, and your name if you include it, only to send you one email when Elf Diary launches. Then we delete it.
• Emails you send us: if you write to [email protected], we receive your email address and what you write. Forward Email passes our mail on to our mailbox, which is hosted by Google (Gmail).

Voice dictation

If you dictate a diary entry, your phone's own speech recognition (from Apple or Google) turns your voice into text. Depending on your phone, that audio may be handled by Apple or Google on their servers, under their privacy terms; we only receive the text you save.

If you dictate an Ask Santa note, the app asks your phone to turn your voice into text on the phone itself, so the audio does not leave it. If your phone cannot do that, the app says so and you type the note instead.

Do you have to give us this information?

You need to give us an email address or sign-in, your first name, and each child's first name and age band, so that we can provide the app; without them you can't use it. Everything described as optional can be left blank, and Santa's AI features, photo descriptions and notifications each need your agreement or permission first. Joining the waiting list is entirely up to you.

Why we use it, and our lawful basis

Where we rely on legitimate interests, we have weighed them against your rights and your child's, giving children's interests extra weight. You can ask us for the details, and you can object (see "Your rights").

We do not use your information or your child's for advertising, profiling or automated decisions that have legal or similarly significant effects.

AI processing

Elf Diary uses AI from three companies: Anthropic and ElevenLabs, which act as our processors under contract, and Google, which runs AI models for ElevenLabs inside its service. Anthropic's terms don't allow it to train its models on what we send, and we have switched off ElevenLabs' use of our content to train its models.

We ask first. Before your first Santa call (booked or "Call Santa now"), Santa's brief or his voice note, the app shows you, once and behind your grown-ups PIN, which companies get what, why and for how long, and asks you to agree. If you choose "Not now", nothing is sent to them and only those features wait: the diary, the star jar and the rest of the app keep working. Photo descriptions have their own consent, which you give when you add your first photo. We keep the date you agreed and the version of the notice. There isn't a switch in the app to withdraw this agreement yet: email us and we will withdraw it (Santa's calls, his brief and his voice note then wait until you agree again), or use Delete all data.

• Anthropic (Claude):
  • receives the diary photo as you took it (without its location and other hidden details), so it may show your child. It describes in one sentence what happened, and is told never to describe anyone's face, body or appearance. Then, judging only from the scene, it suggests whether to log it as a star or something to work on, which you can keep or change before saving; we process the photo in memory and delete it straight after;
  • drafts Santa's call brief from the last month of diary notes and your Ask Santa request, which you then edit and approve;
  • writes the words of Santa's free voice note from your child's star count and up to 7 recent nice moments;
  • checks each call transcript for safety concerns.

    Before diary notes and your Ask Santa note go to Anthropic for the brief or the voice note, we replace your child's name with "the child", remove email addresses, links, phone numbers, postcodes, street addresses and school names, and drop a surname typed straight after your child's name. We use the Anthropic API under its commercial terms, which do not allow training on what we send. Anthropic keeps everything we send it (the photos, diary notes, voice note words and transcripts above) for up to 30 days and then deletes it, or for up to 2 years if its automated safety systems flag it. We don't have a zero data retention agreement with Anthropic.

• ElevenLabs: provides Santa's voice and runs the live conversation. Your child's voice is streamed in real time so Santa can answer. Inside its service, ElevenLabs uses other AI models, run for it by Google Cloud: Anthropic's Claude writes Santa's replies (with Google's Gemini as a back-up if Claude isn't available), and Google's Gemini checks Santa's replies during the call and sums the call up afterwards. ElevenLabs says its agreements with these providers don't allow them to train their models on the conversation. It lists every company it uses at compliance.elevenlabs.io/subprocessors. ElevenLabs keeps the conversation's transcript for 2 days so it can be passed to us, and then it is deleted; we also ask ElevenLabs to delete each conversation when we delete the transcript.
  • Once you approve Santa's brief, Santa also gets your Ask Santa request as one line: celebrate or work on, the topics and your note, with the same contact details, school names and surnames removed.
  • Santa gets the way you chose for him to talk about behaviour (Gentle or Firm but kind). For a child set to Firm but kind, he also gets whether an elf note is still open and up to two of your make-it-right tasks, with the same contact details, school names and surnames removed.
  • For the free voice note, ElevenLabs turns Santa's words into his voice. It receives only those words (at most 70), which include your child's first name or its phonetic spelling, the star count and one kind moment from the diary. The audio comes straight back to your phone and we do not store it. As soon as the note is made, we ask ElevenLabs to delete the words and the audio; deleted items can stay in ElevenLabs' backups for up to 30 days.

Santa is an AI character, not a real person. We say so during sign-up, on the booking screen and in the store listing. A grown-up must answer the call first and stay with the child.

Who else processes your data

We share information only with service providers that help us run Elf Diary, under contracts that limit what they can do with it:

• Google Firebase (Authentication, Cloud Firestore, Cloud Functions, Cloud Tasks, Cloud Messaging, App Check, Remote Config): hosting, storage and notifications. Our database and server functions run in London (europe-west2). Firebase sign-in, notifications, App Check and Remote Config are run by Google globally, including in the United States.
• Anthropic and ElevenLabs: AI processing as described above, including Google Cloud, which runs Claude and Gemini inside ElevenLabs' service.
• RevenueCat: records your in-app purchases and refunds and tells us about them. We give it your account ID; through its software in the app it also receives the store's purchase receipt and basic device details. Never your name or email.
• Cloudflare: hosts our website and protects it from attacks.
• Forward Email: passes on emails sent to [email protected]. Google (Gmail) hosts the mailbox they arrive in.
• Apple and Google: sign-in and push notifications. Through the App Store and Google Play they also take your payment and handle refunds, under their own terms and privacy policies, and tell us (through RevenueCat) what was bought or refunded. For payments, Apple and Google don't act for us: each is a separate controller of your payment information.

Each provider that processes data for us is bound by a contract (a data processing agreement) that lets it use the data only to provide its service to us, requires it to keep the data secure, and gives your data the same protection this notice describes.

Some of these providers process data outside the UK and the EU (for example in the United States). Where they do, we protect it with a recognised safeguard. For people in the UK, that is UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework, for US companies certified under it), or the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. For people in the EU, it is the EU–US Data Privacy Framework, for US companies certified under it, or the EU Standard Contractual Clauses. Google, ElevenLabs and Cloudflare are certified under the Data Privacy Framework and its UK Extension. For Anthropic, RevenueCat and Forward Email, we rely on the EU Standard Contractual Clauses with the UK Addendum, in our data processing agreements with them. You can ask us for a copy of the safeguard used for a provider. We are in the UK, which the European Commission has recognised as giving adequate protection (its adequacy decision for the UK).

We never sell your information or your child's.

How long we keep it

When you use Settings → Delete all data, we delete your account, every child's profile and diary, briefs and Ask Santa requests, booked calls, call summaries and transcripts, the reports you sent about calls, your Santa minutes and purchase records and your bring-a-friend code, and ask ElevenLabs to delete your conversations and RevenueCat to delete its record of your purchases. Unused Santa minutes and any time left on your Santa Pass are lost. Apple and Google keep their own records of what you bought, under their own privacy policies. On your phone, Delete all data also removes the voice notes saved for your account (if that fails, the app tells you they may still be there); other settings stored only on your phone stay until you delete the app. This cannot be undone.

Without the app: if you no longer have the app, email [email protected] from the email address on your account and ask us to delete your account. We will check it's you, delete everything listed above within one month and tell you when it's done. Step-by-step instructions are at elfdiary.app/delete-account.

Children's data

Elf Diary is used by families with children aged about 3 to 10, so we follow the UK Children's Code:

• High privacy by default, and only the minimum information about your child.
• No adverts, no in-app purchases and no links out of the app in child mode; anything that costs money or leaves the app sits behind your grown-ups PIN. Offers (the free call, the Santa Pass and Santa minutes) are shown only to you, in the grown-ups area. If Santa's minutes run out during a call, Santa says goodbye, and nothing on your child's screen mentions buying more.
• For a child set to Gentle (the default), the child's screens only ever reward and celebrate; the lowest state is "Santa's still deciding". If you choose Firm but kind for a child, their home screen also shows, while an elf note is open, a warm "On the naughty list for now" card with your make-it-right task as the way back, and celebrates when they are back on the Nice List. Bonus stars only ever add to the jar. The AI never adds or takes away a star: a photo suggestion is shown only to you, is judged from the scene and never from how anyone looks, and nothing is saved until you choose.
• Ask Santa requests are about your child. Santa celebrates what you asked, or turns something to work on into one small, friendly challenge and says he believes in your child. A note about something to work on is never passed to Santa as your words: Santa says the elves noticed, and never that you told him, complained or asked him to mention it. He never threatens, never mentions coal and never says presents depend on it, and he mentions a naughty list only if you chose Firm but kind for that child (see the next point).
• How Santa talks about behaviour is your choice, for each child. Every child starts on Gentle: Santa never mentions a naughty list and turns elf notes into a friendly challenge. With Firm but kind, Santa praises your child first, names the behaviour kindly (what they did, never who they are) and says why it matters; while an elf note is not made up for, he says they are on the naughty list for now and exactly how to make it right. Whatever you choose, Santa never threatens (no "no presents", coal or "Santa won't come"), never calls your child naughty or bad, never shames them or compares them with anyone, reassures them if they get upset, and ends the call warmly. The setting only uses what you choose and write in the diary: it is not used to profile your child and adds no new information about them.
• What reaches Santa's call is sent as you wrote it. The diary notes, pet and hobby that Santa gets for the call, and anything said during it, reach ElevenLabs as written, and the call's transcript reaches Anthropic for the safety check. None of this is redacted, so details such as a friend's name, a place, a school or a surname can get through.
• Your Ask Santa note and make-it-right tasks are redacted first. Before your note goes to Anthropic for Santa's brief and to ElevenLabs as Santa's request, and before your make-it-right tasks go to ElevenLabs, we remove contact details, school names and a surname typed after your child's name (see "AI processing"). We do the same, and replace your child's name with "the child", for the diary notes, wishes, pet and hobby we send to Anthropic for the brief and the voice note. Redaction can miss things, so please don't type or say surnames, addresses or schools.
• Santa never asks your child for personal details such as their address, school or full name, never asks them to keep secrets and never promises gifts. His voice note follows the same rules.
• These are the rules Santa is built to follow, and we check every call for them afterwards. AI can still make mistakes, so please stay with your child during the call.
• Please don't write about health or other sensitive things. Don't put details about your child's health, or other sensitive things such as religion, in the diary or your notes for Santa.
• Photos of other people: if a photo shows anyone else, please make sure they are happy for it to be described by AI.
• Every transcript is checked automatically after the call, and you can read it in the app. If anything Santa said worries you, use "Report a problem with this call" on the call summary and we will look into it.

We have carried out a data protection impact assessment (DPIA) for Elf Diary.

You consent on your child's behalf as their parent or guardian.

Children don't sign up or type anything into Elf Diary. What your child says to Santa is part of the call transcript described above. If we learn that a child has given us information any other way, without a parent or guardian, we delete it.

Your rights

You have the right to:

• access the information we hold about you and your child;
• correct anything that is wrong (most of it you can edit in the app);
• delete it (Settings → Delete all data, or ask us);
• restrict some processing;
• receive your data in a portable format;
• withdraw consent at any time, for example photo consent in Settings, without affecting what happened before.

Your right to object. You can object at any time to anything we do on the basis of legitimate interests (see the table above). We will then stop, unless we have compelling reasons to carry on, such as keeping a child safe.

Email [email protected] to use any of these rights. It's free. We may need to check it's you, for example by asking you to write from the email address on your account. We will reply within one month; if a request is complex we may take up to two more months, and we will tell you why.

If you are unhappy with how we handle your information, please tell us first. You can also complain to the UK Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. If you live in the EU, you can complain to the data protection authority in your country (the list is at edpb.europa.eu).

Security

Data is encrypted in transit and at rest by our providers. In the app, only you can see your family's data; our servers check every request. A small number of our staff can see a call's transcript and your report when they need to: to look into a call you report or one our safety check flags, or to answer a request from you. The grown-ups area is protected by your PIN, and the app holds no secret keys. Nobody can list bring-a-friend codes, and each family can try at most 10 a day.

Changes to this notice

We will update this notice when the app or the website changes. If a change matters, we will tell you in the app before it takes effect. The version and date are at the top, and you can ask us for an earlier version.

Contact

Aigentis Ltd, Pa103 Technology Centre, University of Wolverhampton Science Park, Glaisher Drive, Wolverhampton WV10 9RU, United Kingdom
Company number 16537792
Email: [email protected]

The same text is in the app, under Settings. Questions: [email protected]