Privacy policy

Last updated 22 September 2026. Draft pending legal review.

Who we are

Malilu World is made by an independent developer based in Ontario, Canada. For privacy questions, and as the person responsible for the protection of personal information, contact [email protected].

What the app collects

Nothing, unless a grown-up chooses to sign in. The app contains no analytics, advertising or third-party software, and on its own it makes no network connections.

The one exception is optional. If you bought a membership on malilu.app, a grown-up can sign in to it from behind the parent gate. The app then sends your email address to malilu.app to receive a one-time code, sends the code back, and afterwards asks malilu.app whether the membership is active. It keeps a sign-in token in the device's Keychain. Nothing about your child is sent. Signing out, from the same screen, removes the token from the device and ends the sign-in on our side.

When a grown-up sets up the app they choose a nickname and an age band for each child. These are saved in a file inside the app on your device. They are never transmitted, and we have no way to read them. Deleting the app deletes them, and the grown-ups area has a button that deletes them without uninstalling.

The app keeps a record of trails walked, activities completed, and whether each was done independently or with a hint, so it can show you a weekly summary. That record lives in the same on-device file and is subject to the same rules: never transmitted, never readable by us.

Children

Malilu World is designed for children aged one to six and is offered in Apple's Kids Category. Because the app collects no personal information from anyone, it does not collect any from children. There is no chat, no user-generated content, no camera or microphone use, and no way for a child to contact anyone through the app. Every purchase and every link out of the app sits behind a parental gate that a young child cannot pass.

If you believe a child has somehow provided us with personal information, email [email protected] and we will delete it.

Purchases

Malilu World membership is bought through Apple's App Store. Apple processes the payment and holds your payment details; we never see them. Apple acts as our agent for these sales. Apple's own privacy policy governs what Apple collects. We receive from Apple only aggregated sales reports that do not identify individual customers.

The website

The plan builder at malilu.app/start keeps your answers, including your child's nickname, in your own browser's storage so a refresh or a closed tab does not lose them. Nothing you type there is sent to us while you build and read the plan. The website runs no analytics, advertising or tracking software, and sets no cookies until you sign in.

Buying on the website

Not yet open. When it opens, this is exactly what it involves, and nothing more:

• Payment is taken by Stripe on its own page. Stripe holds your card details; we never see them. Stripe's privacy policy governs what Stripe collects.
• Your email address, for the receipt and so you can sign in. Occasional news only if you tick the separate box, which starts unticked.
• About your child: the starting settings your answers produced (age, the buddy they chose, goals, interests, starting levels, calm mode, tap or drag, trail length, and your answers about devices, languages, homeschooling and how many children will play), so the app can begin in the right place. Never their name. The name stays in your browser and is typed again in the app, where it stays on the device.
• The plan's answers and, if you arrived from a link that carried them, the campaign tags on that link (for example which newsletter it was in). Nothing that identifies you is added to them.
• Your membership: which plan, when it started and when it ends, so the app and the website can both unlock it.
• A sign-in cookie for this website, which lasts 30 days and does nothing else.

A checkout you start but do not finish is deleted after 30 days. You can ask us to delete your account and everything above at any time by writing to [email protected]. This information is stored with Cloudflare, which hosts the website, and is shared with no one else.

What we hold outside the app

If you email us, we hold your email address and what you wrote, for as long as needed to help you and to keep a record of the conversation. We do not add you to any mailing list and we do not share support correspondence with anyone. You can ask us to delete it at any time.

Sharing

We share no personal information with anyone, other than Stripe processing a web payment you chose to make and Cloudflare storing the records described above on our behalf.

Your rights

Because the app holds your data only on your device, you already control it completely. For support correspondence, you may ask to see what we hold, correct it, or have it deleted, by writing to the address above. We will respond within thirty days. Residents of Canada may contact the Office of the Privacy Commissioner of Canada, and residents of Quebec the Commission d'accès à l'information, if they are not satisfied with our response.

Security incidents

Because the app stores nothing with us, an incident affecting the app's data is not possible on our side. We keep a register of confidentiality incidents for the small amount of support correspondence we hold; it is currently empty.

Changes

If this policy changes we will update the date at the top and, where the change is material, note it inside the app's grown-ups area. Unless you sign in to a web membership, the app makes no network connections, so it cannot notify you on its own.

Malilu World · Ontario, Canada · [email protected]