Privacy at Kittelfdora Kids

Here's the honest picture: this site asks almost nothing of you. We show no ads here. We do use Google Analytics to measure how the site is used, in the plainest way it comes. It counts which pages get opened and roughly how long they stay open, and it notes where a visit came from, like another website or a link in one of our own posts. We also advertise Kittelfdora Kids to grown-ups inside ChatGPT, and to see whether those ads bring people here, OpenAI's measurement code runs on every page. It gives your browser a random code that lets OpenAI recognise that browser on later visits, and OpenAI receives that code, the page address, your IP address and a few other details. There's no switch for it on our site. A section further down spells out exactly what each of these sees, and how to switch Google Analytics off on your device. Every game and story is free to play without an account. Grown-ups can join our newsletter or open a free family account, and those two are the only places where we keep anything about who you are. This page explains all of it.

This is an informational page, not a wall of legal boilerplate. We keep it accurate and update it when the site changes.

What we collect

Two things we keep count as personal information, and both are a grown-up's choice: an email address for the newsletter, and a free family account. We never ask a child for either one. Outside companies also measure visits to our pages. Google Analytics counts page views for us. OpenAI's measurement code checks whether our ads in ChatGPT bring people here, and it gives each browser a random code that OpenAI can recognise again. The measuring-the-site section further down covers exactly what each one sees.

The newsletter

• The newsletter, the Elfcat News, is for parents and teachers, not for children.
• There are two ways to join, and one list behind them: the newsletter box on our pages, and the optional tick-box on the sign-in page. Either way you get the same confirmation email, and you end up on the same list.
• We use double opt-in. After you sign up, we send you a confirmation email, and you're not on the list until you click the link inside it. Before that, your address just waits, unconfirmed. If you ignore that email, nothing happens. The link stops working after three days, and the unconfirmed address is then deleted.
• The tick-box on the sign-in page starts empty, and nothing happens unless you tick it yourself. Signing in on its own never adds you to the newsletter, and ticking the box doesn't open an account. Even if you do both at once, the newsletter still waits for you to click the link in its own confirmation email.
• The list is ours, kept in our own database, not at a mailing-list company.
• For each address we keep the address itself, the language of the page you signed up on, a note that says waiting or confirmed, the date you signed up and the date you confirmed, and the scrambled keys used for the confirmation link and the leave link. We don't keep your IP address, your device or browser, which page or which box you used, any record of you opening a newsletter or clicking a link in it, or anything about your child.
• The newsletter list is separate from family accounts and isn't connected to them. We don't check one against the other, and the address on the list is used for the newsletter and nothing else. Deleting a family account doesn't take you off the newsletter, and leaving the newsletter doesn't touch your account.
• OpenAI's measurement code runs on the pages with the newsletter box, and it can scramble an email address typed into that box and send the scrambled version to OpenAI. That happens in your browser, apart from our list. The OpenAI part of the measuring section further down explains it.
• Resend (resend.com) sends the confirmation email for us, so they see your address in order to deliver it. It follows the same rules as the sign-in email further down: we don't ask for open or click tracking, there's no tracking pixel, and its pictures travel inside the message, so nothing is fetched when you open it.
• Every newsletter we send will carry a link to leave, and leaving deletes your address from our list. You don't have to wait for one: write to kids@kittelfdora.com at any time and we'll delete it for you.
• We used to run the newsletter through a mailing-list company called MailerLite. If you signed up back then, your address may still be on that old list. Nothing on our site signs anyone up for it any more, and we haven't copied anyone from it to our own list. To be taken off it, write to kids@kittelfdora.com.

The family account

An account is free, it belongs to a parent, and nothing on this site needs one. Every game, story and puzzle stays open to everyone. What an account opens is your child's room, and the pictures they save in it.

There's no password to invent. You type your email address, and the email we send back has two ways in: a six-digit code you can type on the sign-in page, and a link you can tap. Either one signs you in and you only need one, which matters if the tablet your child plays on has no email app on it. Resend (resend.com) sends that email for us, just as it sends the newsletter's confirmation email. We don't ask for open or click tracking on it, we put no tracking pixel in it, and asking for it never puts you on a mailing list. The two pictures in it travel inside the message itself, so nothing is fetched from us when you open it, and there's no signal for us to receive. Every email we send carries a plain-text version as well, so reading with images off loses the pictures and nothing else. That email also spells out what the account will hold, because using either the code or the link is how you agree to it.

Here is everything an account holds:

• Your email address, plus the date you agreed and which version of that notice you saw.
• Up to four child profiles. A profile is a nickname you choose, up to twenty letters. No birthday, no photo, no surname.
• Your child's room: which house, which room colour, and which window view. Every one of those is a pick from a short fixed list, so there is nowhere in it to type anything.
• The pictures your child saves in their room. There's a section on those further down.
• Which of those pictures your child has pinned up on the board in their room. A list of choices, nothing more about the pictures themselves.
• Saved game progress for those profiles: which game, and how far. Numbers only, never free text. The room above is the first thing that uses this. No game saves its progress to the account yet.
• A record of anything bought in our shop, so it can be downloaded again. The shop isn't connected to accounts yet, so nobody has one of these.
• A record that keeps you signed in on this browser. No IP address, no device details.

The family page has a button that downloads all of it as one file, and a button that deletes the account. Deleting happens straight away and takes the pictures with it. We show no ads here. There's one thing to know about the sign-in box itself: OpenAI's measurement code, which runs on every page, can scramble an email address typed into it and send the scrambled version to OpenAI. The family page shows the signed-in grown-up's email address too, and the same code can read it from the page and send it scrambled. The measuring section further down explains it.

Cookies we set ourselves

There are three of them, they're all ours, and none of them turns up until you do something that needs one: switch the language, or ask to sign in.

When a parent signs in, we set a cookie called kf_session. It keeps you signed in, and it does nothing else: it carries no measurement and no advertising, not now and not later. It lasts 30 days and renews while you keep coming back, with a hard stop six months after it was made. Signing out deletes it.

There's a second one, and it's measured in minutes rather than months. When you ask for a sign-in email, we set kf_pending. It holds one random value, and its only job is to tie the six-digit code in that email to this browser, so the code works nowhere else. A code read off somebody else's screen is no use to anyone. It carries no address and nothing about you, it's never read for anything but that one check, and it goes the moment the sign-in finishes, or 15 minutes later if it doesn't.

The third one has nothing to do with signing in. If you use the language switch at the top of the page, we set kf-lang, which remembers the language you picked so the site opens in it next time. That one choice is all it holds, it's never read for anything else, and it lasts a year. Anyone who uses that switch sets it, child or grown-up, and it says nothing about who they are.

Code from two other companies also sets cookies on our site, under our address. Google Analytics sets _ga and _ga_…. OpenAI's measurement code sets __obref on any visit, and __oppref only when someone arrives by clicking one of our ads in ChatGPT. Unlike our three, __obref needs nothing clicked: a plain visit sets it, for a child as much as a grown-up. The next section explains all of them, and which ones the switch on this page clears.

Measuring how the site is used

We measure how the site is used, so we can see which pages people open and keep the parts that work. Three companies measure things on our pages, and each has its own part below. Google Analytics counts for us, and we've kept it deliberately small. Cloudflare measures how fast pages load. OpenAI's code tells us whether our ads in ChatGPT bring people here, and it runs exactly as OpenAI supplies it.

Google Analytics

We use Google Analytics for this, and it runs for everyone by default. It records each time a page is opened, and roughly how long it stays open on the screen. From each visit it sees an approximate location (a country or a city, worked out from the network, never a precise one), rough device and browser details, the time, the address of the page, and, when there is one, where the visit came from. Google is the company that receives this, acting for us, and their own terms cover it: how Google uses data from sites that use its services.

When you download one of our activity books, Google Analytics counts that as a download too. It records which file it was, and its paper size, A4 or US Letter. It comes with the same basic visit details described above, and nothing that says who you are.

The page address reaches Google with everything after a question mark or a # removed, with one exception: campaign labels. Some links carry them after the question mark, like the link in our Instagram or YouTube profile, or a link under one of our posts. The labels say which site the link was on, what kind of link it was, which campaign it belongs to, and which post. We keep them so we can see which of our own posts and links bring people here.

A label gets through only if it's a short, plain word made of the letters a to z, numbers, hyphens and the _ sign, and it's changed to lower case on the way. Everything else after the question mark is still removed, so an email address, a sentence, or anything with an @, a space or another symbol in it can't pass.

On our own links we write the labels ourselves. They say where the link was placed, and we never put a name, an email address, or anything about a person or a child in them. Nothing anyone types on our site ever goes into them. A link someone else made can carry labels too. Only short, plain words get through from those as well, but we don't write them, so we can't vouch for what's in them.

The address a visit came from is trimmed too. If it was another website, Google sees that site's name, like instagram.com or google.com, and never which page on it. If it was one of our own pages, Google sees which of our pages it was. Nothing after a question mark or a # ever goes with it.

We hold Google Analytics to the basics on purpose. Inside it there's no advertising, no remarketing and no profile-building. Google Signals is switched off, so nothing is tied back to a Google account, and ad personalisation is off. We send no User-ID and no account or session id, and we never add a name, an email address, a drawing, anything typed, or anything searched. To tell one visit from the next, Google Analytics sets its own cookies, named _ga and _ga_…; those are the analytics cookies mentioned in the section above.

What Google keeps comes in two parts. The visit-by-visit detail, meaning each page opening with its device, rough location, how long it stayed open, link labels and where the visit came from, is deleted after two months. The totals in Google Analytics' standard reports, like how many times a page was opened or how many visits came from a certain site or from one of our links, are kept, and the two-month setting doesn't delete them. They're counts, with no ID for any visitor in them.

You can switch Google Analytics off for this device. Turn it off here and no more Google Analytics measurements leave this browser, and the _ga cookies are cleared:

This choice is remembered in this browser only. On a different browser or device, or after you clear your browsing data, you would set it again. It covers Google Analytics only: Cloudflare's measurement and OpenAI's measurement code keep running either way, and the parts below explain both.

Cloudflare

Our pages are served through Cloudflare, and Cloudflare also measures how they perform: roughly how fast a page loaded, the rough region a visit came from, and which browser it used. This one loads a small measurement script in the browser (from static.cloudflareinsights.com). It sets no cookies, it does not follow visitors from site to site, and it builds no profile. It is Cloudflare's own measurement rather than ours, so the switch above does not turn it off; Cloudflare's own privacy terms cover what it sees.

OpenAI (ChatGPT ads)

We advertise Kittelfdora Kids to grown-ups inside ChatGPT. To see whether those ads bring people here, OpenAI's measurement code runs on our pages. We still show no ads on our own site, and this is the only advertising-related measurement on it.

It runs on every page of our site, including the games, the stories and the room, and on our jigsaw puzzles when another website places one on its pages. It runs for every visitor, child or grown-up, by default. The code loads from bzrcdn.openai.com and sends what it collects to bzr.openai.com. OpenAI, a company based in the US, is the one that receives it.

Here's what reaches OpenAI on a visit: a random code that lets OpenAI's measurement recognise this browser again, the address of the page, the address of the page before it, the time, and, when someone arrived by clicking one of our ads in ChatGPT, the reference for that ad click. Both addresses are cut down to the site and the path, so nothing after a question mark or a # goes with them. As with any web request, OpenAI also sees the IP address and browser details.

OpenAI's settings for our account have automatic matching switched on. That means the code can look through a page for contact details such as an email address or a phone number, in the boxes people type into and in text shown on the page, scramble them in the browser (the technical word is hashing) and send the scrambled version to OpenAI. On our site, that means the newsletter box, the grown-ups' sign-in box, and the family page, which shows the signed-in grown-up's own email address. Children are never asked to type into either box.

Its code sets two cookies on our site, under our own address:

• __obref holds the random code that lets OpenAI's measurement recognise this browser again. It's set on any visit, and it lasts 365 days.
• __oppref is set only when someone arrives by clicking one of our ads in ChatGPT. It holds the reference for that ad click, and it lasts 30 days.

It also keeps one short note in the browser's session storage, named oaiq_cs: followed by the ID of our measurement code. That note goes when the tab is closed.

There's no switch on our site that turns this off; we haven't built one. The Google Analytics switch above doesn't stop it either. What works is in your browser. Clearing your cookies removes its two cookies, though a new random code is set on your next visit. If your browser's tracking protection, or a content blocker, blocks scripts from openai.com, the code doesn't load at all and nothing reaches OpenAI.

We haven't found a clear answer in OpenAI's published information about how long OpenAI keeps what reaches it from our pages. OpenAI's own privacy policy applies: OpenAI's privacy policy. What OpenAI does with it beyond measuring our ads is set by that policy, not by us.

Settings saved on your device

Here is everything stored in your browser's local storage:

• kf-muted remembers whether you turned game sounds off, for one visit. A second key, kf-muted-visit, carries that choice from page to page in the browser's session storage, which is cleared when the tab closes, so the next visit starts with the sound on.
• kf-timer remembers whether you want the puzzle timer visible.
• kf-volume remembers how loud you set the sound in the games that have a volume slider.
• kf-melody-best-4, and one key like it for each Music Grove board size, remembers the longest tune you echoed on that board, so Melo can greet you with it when you come back.
• kf-stardust remembers the stardust gathered in the storybooks and little games: a number, and a short list of which specks were already picked up, so the same speck is not offered twice. Once a child profile is chosen, each profile keeps its own pouch, kf-stardust-…. There is nothing about you in either.
• kf-books-read remembers which Play a Story books were read to the end on this browser, so they can stand on the bookshelf in your child's room. It's a short list of books, with no dates and nothing about you. Once a child profile is chosen, each profile keeps its own list, kf-books-read-….
• kf-signed-in is a yes or no marker saying a grown-up signed in on this browser. It holds no email address and no name. Signing out removes it.
• kf-active-profile remembers which child profile is chosen on this browser, so each child gets their own room, stardust pouch, bookshelf and care garden. It holds no name, just the code your account uses for that profile. Deleting that profile or the account removes it.
• kf-room remembers how your child arranged their room: which house, the room colour, and the window view. No dates and no counters are in it. This is the copy the room actually runs on, and while a grown-up is signed in, a copy is kept with the account as well. The room section further down explains that half. Once a child profile is chosen, each profile's room is kept the same way, under kf-room-….
• kf-room-adopted remembers which child profile took over the room that was arranged on this browser before any profile was chosen, so that room goes to one child only. It holds no name, just that profile's code.
• kf-room-touched remembers that your child has already tapped something in their room. Until that first tap, the things that answer a tap twinkle one by one when the room opens; after it, the room stops doing that. It holds a yes and nothing else.
• kf-room-fullview-seen remembers that your child has opened the full view from their window once, so the window glass stops twinkling to invite them. It holds a yes and nothing else.
• kf-garden-… remembers a child profile's care-garden journey: the chosen animal, an optional animal name, the date care began, four completed care chapters, whether the friend is asleep, the Healer check, the return-home steps, and which friends already returned to the wild. It stays only in this browser and is never copied to the account. A grown-up can reset it from that profile's account card. Deleting the profile or account, or clearing browser data, removes it too.
• kf-analytics-consent-v1 remembers whether a grown-up switched Google Analytics off on this device, using the button in the measuring-the-site section above. It holds one word, on or off, and nothing about you.

Apart from the room, none of these leave your device and we never see them. Clearing your browser data removes them, and the games simply start fresh. OpenAI's measurement code also keeps a short note of its own, in session storage rather than local storage. It isn't ours, and the OpenAI part of the measuring section explains it.

The stardust pouch

While your child reads one of the storybooks, or plays one of the little games, small specks of stardust can be picked up along the way. The pouch is saved in this browser, on this device, and nothing is sent to us: it holds a number and a short list of which specks were already found. There is no score to beat, no streak, and nothing on the site makes stardust expire or takes it away. Every story and game ends exactly the same way whether the pouch is full or empty, and they work normally if your browser saves nothing at all. Clearing your browser data empties the pouch.

Your photos in the jigsaw game

Our puzzle table lets you turn one of your own photos into a jigsaw. The photo is opened by your browser, on your device, and stays there. It is never uploaded, never stored by us, and never leaves your device.

Your child's room

The room is your child's own corner: a house, a room colour, a window view, and a cabinet that fills with stardust jars from the storybooks and from the memory games that go with our videos. The room opens only once a grown-up has signed in. Until then, the page asks for a grown-up and the room stays closed. It also holds the pictures your child saves and the board they pin them to, and both have their own sections below.

When a parent is signed in, the room is kept with the account too, under that child's profile, so it opens the same way on the tablet and on the laptop, and clearing your browser data doesn't empty it. The copy in the browser is still the one the room runs on, so a slow connection or no connection at all never gets in your child's way.

The care garden is different from the room. The chosen animal, an optional animal name, the date care began, four care chapters, the Healer check, and the return-home progress stay only in this browser for that child profile. They do not appear on another device and are not copied to the account. A grown-up can reset this care journey from the profile card. Deleting the profile or account, or clearing browser data, removes it too.

What we hold is a short list of choices: which house, which colour, which view. Each one is a pick from a fixed list, so there's nowhere in it to type anything. No dates, no counters, nothing about how long or how often your child played. The stardust jars on the cabinet aren't in it. They come from the storybooks and from the memory games that go with our videos, and they stay on the device with the stardust itself, which is the section further up.

When the same room has been open in two places, the newest choice wins: which house, which colour, which view. A child who repaints their room means it. The pictures aren't part of that. They're a separate list, and nothing about syncing can remove one.

Pictures saved in your child's room

When your child is signed in, the pictures they make can be saved to their room, so they'll find them again next time. That is the whole reason they're saved. Three games save one today. My Sticker Book saves the painted version of what your child built. The painting starts only when your child taps "Let the forest paint it", and it saves on its own as soon as it comes back. My Drawing saves the picture your child drew, together with its painted version, only when they tap "Save in My Room". The Coloring Workshop saves the page your child coloured in only when they tap "Put it in my room". There is one exception: when your child presses "Let the forest paint my picture" in the Coloring Workshop, the painted version saves on its own as soon as it comes back, the way My Sticker Book does.

Each picture belongs to the child who made it. It shows up in that child's room and nowhere else, so two children on one family account never see each other's drawings. You can see a child's pictures yourself by opening that child's room, and the data download on the family page lists every picture the account holds.

Painted pictures are kept as a pair. In My Sticker Book, My Drawing and the Coloring Workshop, what your child made is saved beside the painted version of it, and the two count as one picture: they open together and they come down together. A coloured page kept without the painting is a single picture, because the blank drawing underneath it is ours, not your child's, so there is no second frame worth keeping.

When nobody is signed in, nothing is saved. The picture appears on the screen, it can be downloaded, and it's gone when the page closes. Painting works the same either way. In the three games that can end in a painted picture, the painting itself still happens outside our site, signed in or not, and the section below walks through that.

A saved picture is your child's own artwork: shapes they placed, a page they coloured, or lines they drew. It is never a photograph, because none of these games has a camera. We write nothing on a picture ourselves. What is on it is whatever your child made, and a child drawing on a blank page can draw letters, or their own name, and that is kept with the rest of the picture. In the room, each picture opens, downloads and can be removed on its own, and they stay until somebody removes them. A picture kept as a pair comes down as one, so removing it removes both. Deleting the account removes all of them at once.

AI and the painted pictures

Three games can end in a painted picture. In My Sticker Book your child builds one out of shapes. In My Drawing they draw one freehand on a blank page. In the Coloring Workshop they colour in one of our line drawings. All three work the same way: one button turns what they made into a painted version, and here is exactly how that happens. In the Coloring Workshop that button says "Let the forest paint my picture", and if nobody presses it, the colouring never goes to Google.

The game flattens what your child made into one plain picture, our own server sends that picture to Google's Gemini model, and the painted version comes back. Our server makes that call, not your browser, and the key that lets us make it never leaves our server.

That picture is the only thing that travels. We attach nothing to it: no name, no email address, no account details, nothing about your device, and never a photograph of a person, because none of our games has a camera. What is inside the picture is whatever your child made, and on the drawing page that can include letters or a name, because a child holding a pencil can write one. We have no way to tell a name from any other line they drew. Google's own privacy policy applies to what reaches them.

This happens whether or not anybody is signed in, because the painting is done outside our site either way. Signed out, we keep no copy of it at all: the painted picture comes back to the screen, you can download it, and it's gone when the page closes. Signed in, the painted picture is kept in your child's room on its own in My Sticker Book and the Coloring Workshop, and in My Drawing only when your child taps "Save in My Room". Whenever it is kept, what your child made is kept beside it, which is the section just above.

Our puzzles on other websites

Anyone may place one of our jigsaw puzzles on their own website. When our puzzle runs there, it loads from our servers, so, like any web page, our servers briefly see the visitor's IP address and browser as the request arrives. OpenAI's measurement code runs inside the embedded puzzle too. It's the same code as on our own pages, and the OpenAI part of the measuring section above explains what it does. We add nothing else: no Google Analytics, and no cookies or counting of our own. The photo picker and the sharing buttons are switched off in that embedded view.

Players and puzzles from other companies

Some pages include content that comes from other companies. When it loads, that company's servers are contacted and their own privacy policy applies:

• YouTube: our videos use YouTube's privacy-enhanced mode (youtube-nocookie.com).
• Spotify: music players on our listening pages.

How long we keep things

A newsletter address, for as long as you're subscribed. Every newsletter will carry a link to leave, or you can write to kids@kittelfdora.com at any time. Either way, your address is deleted from our list. If a confirmation link is never clicked, it stops working after three days, and the unconfirmed address is then deleted.

With Google Analytics, the visit-by-visit detail, each page opening and everything that came with it, is deleted after two months. The totals in its standard reports, such as how many times a page was opened or how many visits came from a certain site or one of our links, are kept, and the two-month setting doesn't remove them. They're counts, with no ID for any visitor in them.

OpenAI's measurement code sets two cookies on our site: __obref lasts 365 days and __oppref lasts 30 days, and clearing your cookies removes both sooner. We haven't found a clear answer in OpenAI's published information about how long OpenAI keeps what reaches it from our pages. OpenAI's own privacy policy applies: OpenAI's privacy policy.

Everything in a family account stays until you delete it. We don't delete accounts for going quiet, and we don't email anyone to pull them back. If an account is closed from the link in that email, it stays as well. Closing locks it rather than erasing it, and from then on kids@kittelfdora.com is the way to see what's in it, get a copy, or have it removed. Two things expire on their own. The code and the link in a sign-in email stop working fifteen minutes after we send them, or the moment you use one of them, whichever comes first. The record that keeps you signed in expires thirty days after your last visit, and in any case six months after it was made.

Children's data

We never ask a child for personal information. Nothing on this site asks a child to type in who they are, and every game works without an account of any kind.

When a parent opens a family account, four things linked to their child sit on our side: the nickname the parent chose, the room the child arranged, the pictures they saved in it, and which of those pictures they pinned up on the board. The parent can see, download and delete all four. We don't ask for a birthday, a surname, a photo or a home address, and there is no box anywhere on the site to type one into. The one way a child can put words into anything we keep is by drawing them.

Measuring still runs when a child visits, with nothing typed. Google Analytics, Cloudflare and OpenAI's code each see what the measuring section above describes. OpenAI's is the one connected to advertising, and our site has no switch for it.

Questions

Write to us at kids@kittelfdora.com. A real person reads it.

Last updated: 9 November 2026.