Privacy Policy
Deutsch · Français · 日本語 · 한국어 · Norsk bokmål · Português (Brasil) · 简体中文
Emberlane is a bedtime storybook app for families. We built it so that a story can be read at night without anyone being watched. This page explains, in plain words, what the app and this website do with information. The short version: there are no accounts, no ads and no tracking, and the app never asks for your name or your email. The only questions about your family are on the first open, where a grown-up can pick the book language, which ages are listening and what matters most at bedtime. The ages and what matters most stay on your device and are not sent to us; tapping Continue on the language screen, or Skip on any first-open screen, makes the app fetch the book list and the narration in the language shown there, which is the one your device prefers unless you pick another (below). The little that does reach us, mostly what any download needs, is listed below, with how long it is kept. If you write to us, phone us or visit our website, that is covered below too.
Who we are
Emberlane is made by Trollwick AS, a limited company (aksjeselskap) in Norway ("we", "us"). We decide how we use the information this page describes: the requests the app and this website make to our server, and what you send us. In data protection law that makes us the "controller" of it, and for children's information under the U.S. Children's Online Privacy Protection Act (COPPA), the "operator". Cloudflare decides for itself how it uses some of what it handles (below).
- Trollwick AS, registered in Enhetsregisteret (the Norwegian Central Coordinating Register for Legal Entities), organisation number 938 760 640. Not registered for VAT.
- Postal address: Nøttveitvegen 122, 5238 Rådal, Bergen, Norway
- Telephone (business): +47 459 23 313
- Email: hello@emberlane.app
We are a small studio and are not required to have a data protection officer; write to us directly about anything on this page. If the business ever moves to another company we own, we will say so on this page, and by email to anyone who has asked us to (see our Terms, "If we change or stop things"), at least 30 days before the move, and name the new publisher. Your rights under this page stay the same. A claim from before the move can still be made against Trollwick AS as well as the new company, as the Terms say ("If the business moves").
What we do not collect
- No accounts and no sign-in. The app never asks for a name, email address, photo or voice.
- No advertising. The app contains no analytics or tracking software from other companies, and this website runs none. Cloudflare, which delivers both, sees the requests that reach it (below).
- No location, contacts, camera, microphone or photos.
- We do not sell information or share it for advertising.
Children
Emberlane is made for children to enjoy with a grown-up. The app has nowhere to type anything that is sent to us, so a child cannot send us anything about themselves. What does reach us is the technical information every download needs (below), which includes the device's IP address. Under COPPA an IP address counts as personal information, so we treat it that way, although we cannot tell who is behind it. Purchases, the Settings screen and links that leave the app sit behind a grown-up check. The check is a speed bump for small hands, not a lock: an older child may solve it. For a real lock, use Screen Time and Ask to Buy on your device. A few things are not behind it: the language screen on the first open, the reader's own switches (read aloud, music, sounds, highlighted words and the book's language) and the one-time offer after the first book to set the bedtime reminder. None of them spends money. Other things reach our server without one. Opening the app to the library, and pulling the library down to refresh it, ask the server for the book list, and tapping Download on a book downloads it, with no grown-up check first. On the first open, tapping Continue on the language screen, or Skip on any first-open screen, writes the language shown (the one the device prefers, unless a grown-up picked another) and fetches the book list and the narration in that language for the books on the device, if it is not there yet; choosing a book language in the reader does the same for that book. Once the book list is in, the app may also start the update of a book already on the device. These are the requests described under "Downloading books". On the first open nothing asks a grown-up first, and the app uses whatever network the device has. The check asks a grown-up to solve a sum written out in words; the answer is checked on the spot and is not stored or sent anywhere. Nothing in the app relies on anyone's consent, a child's or a grown-up's. We designed the app with the rules for children's apps in mind, including COPPA, the EU General Data Protection Regulation (GDPR) and Apple's Kids category guidelines.
For parents: what we collect from children
This section is the notice COPPA asks for. It is linked from the first screen of the first open, from a "Privacy" link low on the Tonight screen (the screen the app opens to), from Settings, from the App Store page and from the foot of every page of this website; the first three open it as text inside the app. The name, address, telephone number and email address of the operator that answers parents' questions about this section, Trollwick AS, are under "Who we are". Cloudflare, whose network receives the same requests, is named and described under "Downloading books".
- What: the device's IP address, the name of the file it asks for, the app's name and version, the version of the device's system software and the languages the device prefers; for a book that needs a plan, also the receipt of your plan described under "Purchases". We collect no name, email address, photo, location or voice, and nothing a child types, because the app has nowhere to type anything that is sent to us (the answer to the grown-up check is checked on the device and goes nowhere).
- Why, and the limits on it: only to send the file, check the receipt and keep the service working and safe from abuse. We do not use it to contact anyone, to build a profile, for advertising or for anything else. We hold no name, email address or account to connect it to, and our own program does not write it down. Cloudflare, which receives the same request, has uses of its own, described under "Downloading books".
- Who else gets it: Cloudflare, Inc., which hosts our server, and the companies Cloudflare itself uses (below). We pass it to no one else. Authorities can order information from us or from Cloudflare where the law allows it; our program keeps nothing to hand over.
- Public posting: the app lets a child post nothing publicly.
- How long we keep it, and why: we have no reason to keep it once the file is sent, so our program keeps none: the request is answered and nothing about it is stored. Cloudflare's own records are described under "Downloading books"; its documents give no number of days, so we cannot give you one for them.
- Your rights as a parent: you can ask what we hold about your child, ask us to delete it, and ask us to stop collecting it. Because we cannot tell which requests came from a given child's device, there is usually nothing for us to find or delete; where we do hold something, we delete it except what the law requires us to keep ("How long we keep things"). To stop all further collection from a device, delete the app or keep the device offline. To stop the app fetching tonight's book by itself, turn off "Get tonight's book on Wi-Fi" in Settings; updates and language downloads then still run, on any network. To use these rights, write to or phone us (above).
What stays on your device
The app remembers a few things so it can work the way your family left it. These stay in the app's own storage on your device and are not sent to us:
- Your settings, such as the book language, read aloud, music and sounds, and the bedtime reminder time.
- Your reading, such as which books were opened or finished, where listening stopped, and how many hidden things were found.
- Your first-open answers (which ages are listening and what matters most at bedtime), which books this device has seen in the library and when, and small markers such as which tips were shown and when tonight's book last downloaded.
- The books you download, small preview pictures of the others, and a copy of the last list of books our server sent.
Removing a book from the device deletes its files and its language choice; the record that you opened or finished it, where listening stopped and the hidden things found stay on the device until you delete the app. Deleting the app removes everything above from the device. Your settings, reading record, first-open answers and the copy of the book list may be included in your device's own backup (on iPhone and iPad, iCloud or a computer backup), which you control; a backup you made earlier keeps its copy until you delete that backup. Downloaded books and preview pictures are left out of backups, because they can be downloaded again.
Downloading books
Books are delivered from our server at packs.emberlane.app, over an encrypted connection (HTTPS). The app asks it for the list of books (whenever the app opens to the library, and when the library is pulled down to refresh), for small preview pictures, and for the files of a book: its pages and one narration file for each language. A request contains the name of the file it wants; for a book that needs a plan it also carries the receipt of your plan (see Purchases). Like any internet request, it also reaches the server with your device's IP address and basic technical details: the app's name and version, the version of the device's system software and the languages the device prefers.
Some of this happens without a tap. When the book list shows that a book you already have has a newer version, the app downloads the update by itself. When you change the book language in Settings, the narration in that language is downloaded for the books you have. Tapping Continue on the first-open language screen, or Skip on any first-open screen, does the same for the language shown; Continue on the language screen does it before anything else is asked, and Skip on a later screen does it after the questions you have answered. Settings also has a switch called "Get tonight's book on Wi-Fi", which is on when you first install the app. While it is on, the app fetches tonight's book by itself, at most once a day, between 8:00 and 19:00 and only on Wi-Fi; iOS decides the moment, and the app may be closed. The run first fetches the book list, which can also start the update of a book you have, and then the book; it is the same request as above, with the receipt of your plan for a book that needs one.
The switch also sets the network for those other downloads. On, updates and language downloads wait for Wi-Fi. Off, the app does not fetch tonight's book by itself, but updates and language downloads still happen, on any network, mobile data included. What you start with a tap, such as downloading a book, choosing a language in the reader, or Continue or Skip on the first open, uses whatever network the device has.
We use this only to send the files, check a receipt and keep the service working and safe from abuse. We do not use it to contact anyone, to build a profile of anyone or for advertising. The program we run on Cloudflare writes no record of who downloaded what.
Our server runs on Cloudflare, Inc., a company based in the United States. Every request passes through Cloudflare's network, so Cloudflare sees it. Cloudflare's own documents say this about its role:
- Its Privacy Policy says Cloudflare is a controller for the personal information it collects, with exceptions: it is a processor for "Customer Logs", for administrator audit logs, for some account settings and for the content that its customers and their end users send through its services. So for a request to our server, some of what Cloudflare handles it handles for us, and some it handles for purposes of its own. Its Self-Serve Subscription Agreement adds that Cloudflare may use information derived from traffic on its network to provide, maintain, develop and improve its services.
- Where Cloudflare is a processor, its Data Processing Addendum limits it to providing its service on the customer's instructions and bars it from using the data for marketing or advertising (clauses 3.1(a) and (b)). The Self-Serve Subscription Agreement makes the Addendum part of the agreement when a customer's content includes personal data of people in Europe (clause 6.1).
- The Addendum (clause 3.1(g)) says that, where Cloudflare can verify that a person is associated with us and gets a request from that person to use data protection rights over data it processes for us, it tells us and does not answer without our consent, except to confirm that the request relates to us. For what Cloudflare holds as a controller of its own, you can write to Cloudflare through its Privacy Policy.
- Neither document gives a fixed number of days for network records. The Addendum says Cloudflare keeps data until our agreement ends or the processing is no longer needed for the service, and the Privacy Policy says it decides by purpose, risk and legal duties. So we cannot give you a number of days for them.
- Cloudflare says it primarily stores information in the United States and the European Economic Area, and may reach it from other countries where it operates. For transfers of personal data from the EEA, the UK and Switzerland to the United States, it says it relies on its certification under the EU-U.S. Data Privacy Framework and the UK and Swiss versions of it, and on the European Commission's standard contractual clauses if that certification lapses, which it also uses for other international transfers (Cloudflare's GDPR page).
- Cloudflare uses sub-processors, which it lists on its sub-processor page. We pass the request information to no one else.
Purchases
Plans are bought through Apple's App Store. Apple handles the payment and your Apple Account. The purchase record we receive (below) does not carry your card details, name or email address. Apple's handling of this is covered by Apple's Privacy Policy.
When you download a book that needs a plan, the app sends our server a signed record from Apple's purchase system (a "transaction"), in the request itself, so Cloudflare handles it with the rest of the request. It is the record of your current Library plan. As Apple documents it, such a record includes: transaction numbers, among them an original transaction number that stays the same through renewals; an identifier of the app download (appTransactionId); the product bought and our app's identifier; the dates of the purchase, of renewal or expiry and of signing; whether it is yours or shared through Family Sharing; whether it was cancelled or refunded; the price and currency; the App Store country; and other identifiers and details Apple adds. As Apple documents the record, it has no field for your name, email address or card details, and we do not ask Apple to add an account token to it. Our server checks Apple's signature on the record itself, without asking Apple, to confirm the purchase is real and current, then sends the book. The program on our server does not store or log the record. The app itself notes the product and transaction number of a purchase in its diagnostic log on your device; that log stays on your device and is not sent to us. Because the numbers identify a purchase, we treat them as personal information, and we use them only for that check.
The bedtime reminder
If you turn on the bedtime reminder, your device asks whether Emberlane may send notifications. The reminder is scheduled on your device at the time you choose. Nothing about it is sent to us. You can turn it off in the app's Settings or in your device's Settings.
Information Apple may share with us
If you have chosen to share analytics with app developers in your device's settings, Apple may give us crash reports and overall usage figures, such as how many people opened the app. Apple provides these without identifying you. You can turn this off in your device's Settings under Privacy & Security, Analytics & Improvements.
Visiting this website
This website, emberlane.app, is also served by Cloudflare. When you open a page, Cloudflare receives the usual request information, such as your IP address, the page you asked for and details your browser sends (its type and language), so that the page reaches you and the site stays safe. Cloudflare handles that as described above. The pages we publish contain no cookies, analytics tools or code from other companies. Cloudflare's dashboard can show us overall figures, such as the number of requests; we do not use them to identify anyone. Cloudflare also adds a technical header that asks your browser to tell Cloudflare when it fails to reach the site; that is part of Cloudflare's service. Links in the app, such as the one to this page, open in your browser, where this section applies. We keep nothing about visitors ourselves; Cloudflare's own records are as described above.
If you email or phone us
If you write to us, we receive your email address, whatever you choose to tell us, and the usual details a message carries, such as the time. Mail to hello@emberlane.app is hosted by Infomaniak Network SA, a Swiss provider, in its own data centres in Switzerland. Its data processing agreement binds it to handle our mail only on our instructions and not to move it outside the EU and the EEA without our written consent. If you phone the number above, we do not record the call; we may note your name, number and the reason you called, to answer you. We use all of this only to answer you. Tell us only what we need to help you, such as that a child made a purchase; please do not send us a child's name, photo or other details about a child that we do not need.
If you write to cancel a plan, to complain, or to be repaid, we also keep what we need to deal with it and to show later what was done: your message and our reply, the order or transaction number you give us (we check it with Apple, who issued it), the amount and date, and, for a repayment we make ourselves, the details needed to pay you (such as a bank account or Vipps number). A repayment we make passes through our bank, or through the payment service we agree with you (Vipps, if you ask for that). We use this to carry out your cancellation or repayment and to answer your complaint (GDPR Article 6(1)(b)), and, for payments we make, to meet our duty to keep accounting records (Article 6(1)(c); the Norwegian Bookkeeping Act, bokføringsloven, section 13). How long we keep it is under "How long we keep things".
If you ask to get notices by email (see our Terms, "If we change or stop things"), we keep your email address and the date you asked. We use them only to send you the notices our Terms promise: changes to the Terms or to a plan, and the end of the service. The basis is GDPR Article 6(1)(b) if you have a plan with us, and otherwise Article 6(1)(f), our interest in giving the notices our Terms promise to the people who asked for them. We keep your address until you ask us to stop, or until we have sent the last notice if Emberlane ends, and then delete it, except what the law requires us to keep. To stop, write to us.
How long we keep things
- Download requests and purchase receipts, including children's: our program keeps none; they are gone when the request ends.
- Cloudflare's network records (the app and this website): Cloudflare sets that period, as described under "Downloading books". Its documents give no number of days, so we cannot give you one.
- Email you send us and notes of calls: 12 months after our last message or call in the conversation, or sooner if you ask, and then deleted, except what the law requires us to keep. This does not cover cancellation, complaint and repayment mail, which the next item covers.
- Cancellation, complaint and repayment mail and records: three years after the matter is closed, which is the general limitation period for claims in Norway (foreldelsesloven section 2). The record of a payment we made to you, and the bookkeeping that shows it, five years after the end of the accounting year; a message that gives essential extra information about a booked payment, three years and six months after the end of the accounting year (bokføringsloven section 13: first paragraph numbers 3 and 6, second paragraph). After that we delete it, except what the law requires us to keep.
- Your address on the notice list: until you ask us to stop, or until we have sent the last notice if Emberlane ends, and then deleted, except what the law requires us to keep.
- Purchase records at Apple: Apple keeps them under its own policy.
- On your device: a book's files until you remove the book or the app; settings, reading record and first-open answers until you delete the app. A backup you made keeps its copy until you delete the backup.
- If you ask us to delete something we hold: we do it within one month of your request, except what the law requires us to keep (the records in the item about cancellation, complaint and repayment mail), and we tell you what we kept and why. One month is the time we have to answer any request on this page (the extension for hard cases is described under "Your choices and rights").
Why we use it, in short
- Download requests and purchase receipts: to give you the books you asked for, and for a book that needs a plan, to check that you have one (providing the service you asked for, GDPR Article 6(1)(b)), and to keep the service safe from abuse (our legitimate interest in a secure service, Article 6(1)(f)). Where the person downloading is not the one who accepted the App Store terms, such as a child using a grown-up's device, the basis for the request is our legitimate interest in delivering the books the family chose (Article 6(1)(f)); we weighed it against the child's interests, which count for a lot: the request carries only what a download needs and our program writes none of it down. Without your device's IP address a download cannot reach you, and a book that needs a plan also needs the receipt of your plan; nothing else is needed.
- Website visits: to deliver and protect the pages (our legitimate interest in a working, secure website, Article 6(1)(f)).
- Email and calls: to answer you (our legitimate interest in replying, Article 6(1)(f)). Writing or calling is always your choice.
- Cancellation, complaint and repayment mail and records: to carry out what you ask for under your purchase (Article 6(1)(b)) and, for payments we make, to keep the accounting records the law requires (Article 6(1)(c)).
- The notice list: to send you the notices you asked for (Article 6(1)(b) if you have a plan with us, otherwise Article 6(1)(f)).
- The one automatic decision is the receipt check: if Apple's signed record is not genuine, current and for this app, the server does not send the book that needs a plan. Nothing is judged about the person, and nothing else is decided by a program. We do not use information for any other purpose than those above.
Your choices and rights
You have the right to ask us for a copy of information about you, to have it corrected or deleted (except what the law requires us to keep), to limit how we use it, to receive it in a portable form, and to object at any time to the uses we base on our legitimate interests. Because our program keeps no record of downloads, we usually cannot connect anything to you, so there is often nothing for us to show, correct or delete; if you give us details that let us find something, we will (GDPR Article 11). If you have written to or phoned us, we can show you what we hold and delete it, except what the law requires us to keep ("How long we keep things"). Everything the app keeps is on your device and goes away when you delete the app. Your purchase history is held by Apple; you can see it, and request a copy or deletion of your Apple data, through Apple. For Cloudflare's own records, you can also write to Cloudflare through its Privacy Policy.
To use any of these rights, write to hello@emberlane.app or phone the number above. We answer within one month of receiving your request. Where a request is complex or we get many, the law (GDPR Article 12(3)) lets us take up to two further months; we would tell you within the first month and say why. If you are unhappy with how we handle information, you can complain to Datatilsynet, the Norwegian Data Protection Authority (datatilsynet.no, Postboks 458 Sentrum, 0105 Oslo), or to the data protection authority where you live.
Changes to this policy
If the app or the website starts to handle information differently, or we change who hosts or handles it, we will update this page before that version of the app is released or the change is made. The date at the top changes whenever the text does.