Your data
Privacy
No ads. No tracking companies. Your elf photo is used to make your story and then deleted from our server.
Who we are
My Elf Moved (the app and elfmoved.com) is made by APPS 365 LTD, a company registered in England and Wales (company number 13955007), registered office 20-22 Wenlock Road, London, England, N1 7GU. We are the data controller for the information described here. Contact: hello@elfmoved.com.
We give everyone the same privacy protections, wherever you live.
What we collect, and why
| What | Why | Lawful basis | How long |
|---|---|---|---|
| The photo you take of your elf (and, when Tree Inspection is on, of your tree) | To check the photo, describe the scene to the AI (and, for Play, suggest what your elf could do with the things around it), make your free still previews and your story video | To provide the service you asked for (contract) | Deleted from our server within 24 hours of delivery to your phone. A photo we cannot use (for example because a person is in it) is deleted at once. Photos of stories you never make, or that fail, are deleted within 24 hours. Our AI providers keep copies under their own terms (see below) |
| The story videos and previews we make | To deliver them to your phone | Contract | Deleted from our server within 24 hours of delivery (when the app has finished your video on your phone), or after 7 days if that never happens. The short written description of the scene is deleted 30 days after that. Your copy stays on your phone until you delete it |
| A short record of each video we made for you, kept after the rest of the story is deleted: the story id, the move, a one-way coded version of your app id, our job number and the video service's task id, and when it was delivered | So you can still report a video with "Report this video" | Legitimate interests | Until 90 days after the video was delivered, or until you delete your data |
| A random app id made by the app (not your name, email, phone number or advertising id), the app version, which version of the AI notice you agreed to and when, and the choices you make in the app (your elf's voice, and whether your elf talks) | To give you your free story, keep your credit balance and story history, remember your choices, apply fair-use limits, show that you agreed before a photo was sent, and answer support requests | Contract, and our legitimate interest in preventing abuse | Until you delete your data in the app or ask us to. If you stop using the app, we delete your data 12 months after you last use it, unless you still have bought stories. Then we keep your app id, your story balance, your purchase records and any unused recovery code, so your bought stories never expire, and clear only your notification token and your AI consent record (the app asks again before your next photo). After you delete your data we keep only a one-way coded version of the id, so a reinstall does not get a second free story. On Android, a copy of the id also goes into your phone's own Google backup (Android Auto Backup, when it is on), together with the small settings files the app and its parts keep on the phone (for example notification settings and the update service's install id). That backup is kept in your Google account and is not sent to us; it lets a reinstall, or a new phone set up from that backup, keep the same id and the stories you bought |
| A notification token, only if you allow notifications | To tell you when your story is ready | Contract | Until you turn notifications off, delete your data, the token stops working, or 12 months after you last use the app |
| A one-way coded version of your recovery code, only if you ask the app for one | To move the stories you bought to a new phone | Contract | Until 30 days after it is used, or until your app id's data is deleted. A code you have not used yet stays while you have bought stories |
| Reports you send about a video (the reason and any note) | To check AI-made videos and improve the moves | Legitimate interests | Up to 2 years |
| Purchase records: what you bought, when, and the store's transaction id (we never see your card or bank details) | To add the stories you bought, handle refunds and keep the accounts the law requires | Contract and legal obligation | As long as tax and accounting law requires: up to 6 years. While your app id still exists they stay, because your story balance is worked out from them |
| Your email address, if you join the launch list on this website (only after you tick the box and confirm by email), with the wording you agreed to, the time, and a one-way coded version of your IP address | To send one email when the app is in the App Store and Google Play, and to prove you asked for it | Your consent | Until the launch email has gone out (the whole list is then deleted 30 days later) or you unsubscribe (deleted within a day). Sign-ups that are never confirmed are deleted after 30 days |
| Messages you send through the support page (your name if you give it, your email and your message) | To reply and help you | Legitimate interests | Up to 2 years |
| Your IP address | To keep the service secure and stop abuse (for example, limits on how many forms one connection can send) | Legitimate interests | Limit counters use a one-way coded version and are deleted within 3 days. Our web host keeps standard server logs for a short time |
Things we never do
- No advertising, no ad networks, no analytics or tracking companies.
- We never sell your data or share it for marketing.
- We never use your photos to train AI models.
- Our fonts and files are served from our own website, so loading a page does not tell any other company about your visit.
Children
My Elf Moved is for adults aged 18 or over only, not for children to use. Please keep children out of the photo: just the elf where it sits. Photos with people in them are not used to make stories and are deleted at once. We do not knowingly collect information from children; if you think a child has sent us something, write to us and we will delete it.
Who processes data for us
The app asks you to agree before your first photo is sent. These companies receive data to provide the service:
- Google (Gemini API) checks your photo, describes the scene (and, for Play, the things around your elf), makes the free still previews, and makes the video for 7 moves: "Climbs into the spot", "Comes alive and waves", "Floats down on a balloon", "Appears in a swirl of sparkles", "Wakes up and stretches", "Sneezes a sparkle" and "Plays in its scene". We use Google's paid API service: your content is not used to improve Google's products, and Google keeps prompts and answers for a limited time to detect abuse.
- Magnific (Freepik, Spain), with the Kling video model, makes the video for all the other moves (35 moves: walking, running, acrobatics, rides, reindeer moves and Build-up). It receives your photo and the preview made from it. Under its terms Magnific may keep what it receives and makes, and use it for security and to improve its products, but not to train its own AI models.
- Expo (USA) passes "your story is ready" notifications to Apple and Google, if you allow notifications: it receives the notification token and the message. The app also asks Expo's update service (EAS Update) for app updates each time it starts: that check sends a random install id made by the update service, the app version and whether the phone is an iPhone or Android and, like any connection, your IP address.
- RevenueCat (USA) keeps track of in-app purchases, linked to the random app id. Deleting your data in the app also asks RevenueCat to delete its record.
- Apple and Google sell the in-app purchases in their stores and handle payment and refunds; their own privacy policies apply to that.
- Our web hosting provider runs this website, our servers and our email.
Every company we share your data with must give it the same or equal protection as this notice describes.
Our own server deletes photos and videos at the times above. We cannot promise that every copy everywhere is gone at that moment: Google and Magnific keep what they receive for the limited purposes their terms allow, as described here.
Some of these companies work outside the UK and the European Economic Area. Where they do, we rely on safeguards recognised by data protection law, such as standard contractual clauses.
Every story video is made by AI. The app marks it as AI-made: a small "AI" mark on the moving part of the video, "AI video" on the end card of shared copies, and a label inside the video file.
Cookies
This website uses one cookie, and only because it is strictly necessary, so there is no cookie banner:
| Cookie | Purpose | Lasts |
|---|---|---|
| elf_csrf | Stops other websites from sending forms (like the launch list) in your name | 30 days |
On https it has the __Host- prefix. Our own staff sign-in uses two more cookies that only staff ever receive.
How we keep it safe
Everything travels over encrypted connections. API keys are encrypted on our server and the encryption key is kept apart from the data. We keep nightly backups for 14 days, so something you delete can remain in an encrypted backup for up to 14 days before it is gone for good.
Your rights
You can ask to see, correct, export or delete your data, object to or restrict how we use it, and withdraw consent at any time (for the launch list: the unsubscribe link in the email). The quickest way to delete app data is in the app; see how to delete your data. Or write to hello@elfmoved.com and we will answer within 30 days.
You can also complain to a data protection authority: in the UK, the Information Commissioner's Office (ico.org.uk), or the authority where you live.
Changes
If we change how we use your data, we will update this page before the change takes effect and, where the law requires it, ask you again.