Privacy Policy

Last updated: November 11, 2026

Elf Nights is an app for parents. You take a photo of your elf toy, and we turn it into a short "caught on camera" video of the elf's night mischief. Elf Nights is run by two companies that work together ("we", "us"): STORIES AR LLC, 30 N Gould St, Sheridan, WY 82801, USA, which publishes the app on the Apple App Store and runs the website elfnights.com, and A24Z LTD, 128 City Road, London EC1V 2NX, United Kingdom (company number 15153605), which publishes the app on Google Play. The company that published the app you installed is the controller of the data described below. Both follow this policy and use the same servers.

The short version

• No account. We never ask for your name, email or phone number.
• We receive the photo of your elf, turn it into a video with AI, and delete both from our servers after 14 days. Videos you send to a kids' device stay until February 1.
• Reaction videos of your kids never leave your phone.
• No third-party ads in the app and no selling of data.
• We count how the app is used (Google Analytics for Firebase) and receive crash reports (Sentry). Neither gets your photos, your videos or your child's name.
• We do not use your photos or videos to train AI models.

What we collect

Photos you send to make a video

To make a video you take or choose a photo of your elf toy. For some ideas the app also asks for a second photo of the same spot without the elf. The photos are uploaded to our server together with the idea you picked. If you ask for a redo, we also receive the reason you chose and the note you typed, if any.

A photo shows a part of your home and anything else that is in the frame. Please keep people out of the picture.

Videos we make for you

The finished video is stored on our server so that the app can download it, and so that it can be shown on a kids' device if you set one up.

Identifiers

• Installation ID. A random number the app creates on first launch. We use it to match your videos to your phone and to apply daily limits. It is not an account and disappears when the app is deleted. You can see it in Settings as "Support ID".
• Device identifier for the free video. Every phone gets one free video. To keep it at one, the app sends an identifier of the device: on iPhone a random ID stored in the Keychain, on Android the Android ID. Our server keeps only a one-way hash of it and uses it for nothing else.
• Apple DeviceCheck (iPhone). The app also sends a DeviceCheck token issued by Apple. With it Apple keeps a single flag for our developer account: "the free video was used on this device". Neither the token nor the flag tells us who you are.
• IP address. Like any online service, our servers see the IP address of each request. We use it to deliver the service and to stop abuse (request limits). We do not use it to identify or locate you.

Kids' device (Elf Cam)

If you link a tablet or a second phone as a kids' device, we store a random family ID tied to your installation ID, access keys in hashed form, the name of the linked device (for example "iPad"), the time it was last online, and the list of videos with the time each one may be shown. The kids' device only plays videos. Its camera is used once, to scan the pairing code from your phone (you can also type the code); nothing is recorded. We collect nothing about the child who watches.

Purchases

Purchases are processed by Apple (App Store) or Google (Google Play). We receive a confirmation of the purchase — the product, a transaction ID and, when the store provides them, the price, the currency and the country of your store account — so that the videos can be added to your balance. When a purchase is completed, our team gets an internal notification with these details and your installation ID (through Telegram). We never see your card details.

How the app is used (analytics)

The app uses Google Analytics for Firebase to count actions in the app: the app was opened, which setup screens were seen and whether setup was finished, a photo was taken and whether it passed the check, a video was started, was ready or failed (with the idea you picked), a video was opened, saved, shared or redone, whether notifications were allowed, the purchase screen was shown, a purchase was started, cancelled, failed or completed (the pack and its price). Each action is tied to your installation ID and to an app-instance ID created by Google, and comes with general device information: model, system version, language, app version and country.

The same steps are also kept on our own server, so that we can see where people get stuck: for each installation ID, which steps were reached and when each was reached for the first time, plus the system (iPhone or Android), the language and the app version.

Photos, videos, your elf's name, your child's name and the text of notes are never sent to analytics.

On iPhone the app does not read the advertising identifier (IDFA) and never asks for permission to track you. On Android, Google Analytics may collect the Android advertising ID; you can reset or delete it in your phone's settings (Settings → Google → Ads).

Crash reports

If the app crashes or hits an error, a report is sent to Sentry: what went wrong and where in the code, the device model, the system and app version, and your installation ID. A report contains no photos or videos.

Notifications

Evening reminders are scheduled on the phone itself. The "your video is ready" notification is sent by our server, so that it arrives when the app is closed. If you allow notifications, the app sends us a push address issued by Google (Firebase Cloud Messaging) together with your installation ID and the language of the app. The text of that notification, which includes your elf's name, is written by the app, passes through our server, Google and (on iPhone) Apple, and is not kept on our server after it is sent.

Where the installation came from

To see which of our own ads work, the app tells our server once how it was installed. On iPhone it sends a token from Apple's AdServices framework; our server exchanges it with Apple for the Apple Ads campaign, ad group and keyword that led to the install, if any. On Android it sends the Google Play install referrer — the tags of the link you came from. We store this next to your installation ID and compare it with purchases. It contains no name, no email and no advertising ID, and it needs no tracking permission.

Messages to support

If you write to us, we keep your email address and the conversation in order to answer.

What stays only on your phone

• Your elf's name (except inside the "video is ready" notification, see above), your reminder time and your calendar of ideas.
• The child's name and the text you type for an elf note. Notes are made on the device.
• Reaction videos. When you record your kids watching the video, the camera and microphone recording is saved only on your phone. It is never uploaded to us. It leaves the phone only if you share it yourself.
• Evening reminders. They are scheduled on the device, not sent from a server.
• The quick photo check before upload (is the elf visible, is the photo sharp). It runs on the device with Apple Vision on iPhone and Google ML Kit on Android; the photo is not sent to Apple or Google for this.

What we do not collect

We do not collect your name, email, phone number, precise location or contacts. On iPhone we do not collect the advertising identifier. The app shows no third-party ads and contains no advertising SDKs. The website elfnights.com sets no cookies and loads nothing from third parties.

How we use the data

• To make your videos and deliver them to your phone and to a linked kids' device.
• To give one free video per device and to keep daily limits.
• To keep the service working: find and fix failed videos, check the quality of generation, answer support requests. For this a small team may view photos and videos.
• To understand how the app is used, fix crashes and see which of our own ads bring people to the app.
• To tell you that a video is ready.
• To meet legal obligations.

We do not use your photos or videos for advertising, we do not publish them, and we do not use them to train AI models. We do not build advertising profiles and do not show you ads from other companies.

Who receives the data

We share data only with companies that help us run the service:

• fal.ai (USA) — AI image and video generation. Your photo and the technical description of the scene are sent to fal.ai and to the AI model providers it runs for us (at the moment models by Google).
• OVHcloud — our server (located in Oregon, USA).
• Cloudflare — delivery of the idea catalog and example videos.
• Apple — DeviceCheck, App Store purchases, delivery of notifications to iPhone, and Apple Ads attribution. Google — Google Play purchases.
• Google (Firebase) — analytics and delivery of notifications. If we advertise with Google Ads, analytics events such as "first open" and "purchase" are used to measure those ads.
• Sentry (Functional Software, Inc., USA) — crash reports.
• Telegram — internal notifications to our team about purchases (the pack, the price, the store country and the installation ID).

We may also disclose data if the law requires it, or to a successor if our business is sold or merged. We do not sell personal data and do not share it for targeted advertising.

How long we keep it

• Photos and finished videos: 14 days on our server, then deleted automatically. The copy on your phone stays until you delete the video or the app.
• Videos for a kids' device: until February 1 after they were made, so the whole season keeps playing; then deleted. A video you remove on your phone disappears from the kids' device as well.
• Family link: deleted after the season when it has no videos and no active devices.
• Free-video marker: the hash of the device identifier is kept for as long as we offer the free video. Nothing else is attached to it.
• Analytics: Google keeps events for up to 14 months. The steps on our own server are kept for up to 14 months as well.
• Crash reports: up to 90 days.
• Push address: until you turn notifications off or delete the app; an address that stops working is removed.
• Installation source: kept next to the installation ID for as long as we need it to measure our ads.
• Support emails: up to 24 months.

Our AI providers may keep the files they process for a limited time under their own policies.

Children

Elf Nights is made for adults — parents and guardians. It is not directed to children, and we do not knowingly collect personal information from children. The kids' device mode only plays videos: no account, no purchases, no third-party ads, nothing collected from the child. Analytics and server notifications are switched off on a kids' device; only technical crash reports are sent.

If a child happens to be in a photo you send, the photo is handled like any other and deleted after 14 days. Write to us and we will delete it sooner. Parents and guardians can ask us at any time what we hold and have it deleted.

Your choices and rights

• Delete everything on the phone: delete the app.
• Delete what is on our server before the automatic deletion: email us at info@santaai.site with your Support ID (Settings, bottom of the screen). We delete the photos, videos, the family link, the push address, the installation source and the steps reached in the app within 30 days. The free-video marker is kept to prevent abuse.
• Permissions: camera, microphone, photos and notifications can be turned off in your phone's settings at any time.
• Advertising ID (Android): reset or delete it in Settings → Google → Ads.

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your data, and to object to or restrict its use. To use any of these rights, write to us. We will not treat you differently for doing so.

EEA, UK and Switzerland. We process data to perform our contract with you (making and delivering videos), for our legitimate interests (preventing abuse, the one-free-video rule, keeping the service working, understanding how the app is used and measuring our own ads) and to comply with the law. You may complain to your local data protection authority.

California. We do not sell or share personal information as these terms are defined in the CCPA. You have the right to know, delete and correct your personal information and the right not to be discriminated against.

Security

Data travels over encrypted connections. Videos and photos are stored under random, unguessable names, and access to the server is limited to our team. No system is perfectly secure, but we work to protect what you send us.

International transfers

Our servers and providers are in the United States. If you use the app from another country, your data is transferred to and processed in the United States.

Changes

If we change this policy, we will post the new version here and update the date at the top. If the change is significant, we will also tell you in the app.

Contact

STORIES AR LLC (App Store and website)
30 N Gould St, Sheridan, WY 82801, USA

A24Z LTD (Google Play)
128 City Road, London EC1V 2NX, United Kingdom · company number 15153605

Email: info@santaai.site