Early bird: 20% off everything, bundles too, until the end of 30 November.Use EARLYBIRD20 at checkout.
Magic ShopTap a gift. It plays.

Privacy

This is a family product, so we follow the UK GDPR and the ICO's Age Appropriate Design Code (the Children's Code): grown-ups hold the account, children's settings start at the most private option, and nothing a child does is used for advertising. There are no ads and no advertising or tracking partners.

Orders

We store your email, the gift you bought, the amount, the payment status, and whether you agreed to immediate digital delivery. Stripe processes the card. We do not store card numbers.

App Store purchases (iOS app)

In the iPhone and iPad app, purchases go through Apple. Apple takes the payment and holds your Apple ID details; we never see them or your card. When a purchase is made we receive Apple's signed record of it and keep the product, the dates, Apple's transaction number (so a restore or refund matches the right family) and whether it is active, refunded or revoked. To stop a purchase being claimed by another family, the app sends Apple a random-looking code derived from your family account; it does not contain your email or name. Refunds are handled by Apple, and Apple tells us so we can switch the gift off.

Personalised gifts

If you add names, messages, dates, or photos, we store them so the recipient page can render. The house gift takes up to five photos. Santa in Your Home takes one photo of the room. Each file is up to 2 MB, JPEG, PNG, or WebP, and is re-encoded on our server, which removes hidden location and camera details. We keep that personalisation for 18 months after you publish, then a maintenance job deletes the words and files. Ask support to delete them sooner.

Links

Order links and recipient links are long random tokens. Anyone with a link can open what that link allows. Do not post a recipient link publicly if the gift is private.

Analytics and email

Optional analytics are off until you allow them. They record a page name, not a dossier, and are deleted after 13 months. They never run in the Kids' space, the games and experiences, the iOS app, or on a child's linked device. The mailing list is separate and only stores an email when you tick the consent box. Receipts and sign-in emails are transactional and are sent through Resend, or saved on the server if email is not configured. Support messages are kept so we can answer them.

Family accounts (Grown-ups and the Kids' space)

A grown-up can sign in with their email. There is no password: we email a link and a 6-digit code that work once, for 15 minutes. We store your email, when you joined, and a scrambled (hashed) copy of each sign-in token, so the tokens themselves are never kept. Sign-ins last 30 days on a device; you can sign out at any time.

Only a parent or guardian may add a child, and you tick a box to confirm it. For each child (up to four) we store what you type: first name, age, wish, a kind thing they did, a pet, a friend, a favourite thing, a town, a short note from you, a colour and a made-up arcade nickname. Every field is cleaned and shortened so Santa can say it. If you add a photo, it is re-encoded on our server (which removes hidden location and camera details) and kept in a private folder. It is never public: it is only sent to your own signed-in devices.

Your children's details are only visible to you and to devices you link. Films you make are kept for 30 days, then deleted with their photos. Arcade progress is stored per child. The public leaderboards are off for every child until you turn them on; then a child appears only under their made-up nickname. Turning it off again removes their scores from the boards.

The Kids' space has no typing for children and no analytics. Leaving it needs your 4-number PIN (stored hashed) or a grown-up question, and while it is open the Grown-ups section stays locked on that device. A linked child's device can only open the Kids' space; you can remove it at any time.

In Grown-ups > Settings you can download all of this as a file (profiles, devices, gifts, orders, App Store and other purchases, your landing spot, leaderboard scores and support messages), delete one child's data, or delete your whole account. Deleting removes every profile, photo (including your house photo), film and AI film clip, arcade record and leaderboard score, linked device, sign-in and your landing spot. Order records stay with the shop because we must keep them for accounting, but they are no longer linked to an account. Expired sign-in tokens and sessions are deleted automatically.

Call Santa and Santa's voice

Call Santa listens with the microphone only while the call is on, and only after you allow it. The words are turned into text by your browser's own speech recognition, which may send the audio to the browser maker (Google for Chrome, Apple for Safari) under their privacy terms; we never receive the recording. The camera is off unless you turn it on. In the free call its self-view stays on the device and is never uploaded; for the personalised call, see “Santa can see you” below. When Santa says a child's name or wish in his own voice, our server reads one of our fixed sentences with those words filled in and keeps the sound file for at most 7 days.

Santa's Story film and AI video (xAI)

Parts of Santa's Story film are made by an AI video service run by xAI (Grok Imagine), so that Santa can talk on screen and your child and your house can appear in the story. Only when you tick the box agreeing to this, our server sends xAI: the child's photo, the photo of the front of your house (if you add one), the child's first name, age, whether they are a girl or boy, and the details you typed for the film (good things, family names, pet, friend, hobby, a special memory, favourite toy, what they want to be, and a town). We never send a surname, an address, an email address or the wish for their present. xAI uses them only to make the video clips for your film, under its API terms; the photos are re-saved without location data before they are sent. The finished clips are kept with the film for 30 days and may be reused when you remake a film for the same child within that time. A house photo you save in Grown-ups is kept privately until you delete it, delete your account, or 13 months pass. If the AI service is not available, the film is made by our own server instead and nothing is sent to xAI.

Santa in Your Home. To make Santa's camera video, and only when you tick the box agreeing to it, our server sends xAI both room photos (the before and after photos, re-saved first without location or camera data) and the children's first names, with what they left out for Santa, only to make that video. We never send a surname. The photos, the video and the names are kept for 30 days and then deleted (sooner if you delete your family account). Without your agreement, or if the AI service is not available, the classic version is made on our own server instead and nothing is sent to xAI.

Santa's live chat and the “Help me” ideas (xAI)

In the personalised Santa call, your child can chat with Santa for about a minute. What your child says (as text from the browser's speech recognition, or typed), together with the first name and details you gave Santa, is sent by our server to xAI's Grok text service so Santa can reply. Before anything is sent, we remove email addresses and long numbers, and anything that sounds worrying, rude or like a home or school address gets a fixed kind reply instead and is not sent. Nothing your child says is stored or logged by us; Santa's spoken reply is made on our own server and deleted straight away. The “Help me” buttons in the grown-ups' forms send the details typed so far (never a photo) to the same service to suggest ideas; nothing is saved until you press save. When a grown-up taps “Make the avatar from this photo”, a small copy of that child's photo (with no name or other details) is sent to xAI once, only to choose cartoon features for their avatar; we don't keep that copy or xAI's answer, and xAI handles it under its API terms. If xAI is not available, these run on our own server instead. If you use “Talk me through it” in the setup wizard, your spoken answers are turned into text on our own server and the recording is deleted straight away (never stored or logged); the words are then tidied like the “Help me” ideas, and Pepper never asks for your PIN or address out loud.

Santa can see you. In the personalised call, the camera stays off unless a grown-up turns it on. When it is on, a small, low-resolution picture from it (about one every 15 seconds) is analysed only on our own server, by our own AI model, so Santa can say something nice about what he sees, such as a jumper, a Christmas tree, a toy or a smile. The pictures themselves are never sent to xAI or any other company (only a few cleaned words, like “a red jumper”, may go into Santa's chat), and they are never stored, recorded or logged: each one is kept in memory just long enough to be looked at, then thrown away.

Santa's stop: your home (Santa Tracker and Sleigh Ride Home)

A grown-up can set where Santa stops. You type an address or postcode; our server looks it up and you pick the spot on a small map. We store only that point, rounded to about 10 metres, never the address you typed, and you can remove it at any time. The look-up goes from our server to OpenStreetMap's Nominatim service (or Google's geocoding service if we have switched it on); the map tiles and the street and building outlines around the spot (OpenStreetMap / Overpass) are also fetched by our server, never by a child's device, and the outlines are cached for up to 30 days under a scrambled name. If Google's photorealistic 3D view is switched on, the device playing the game loads Google's 3D map of the area around the spot directly from Google, so Google sees that device's internet address and the area being viewed. We never use the device's own location.

The same spot is used by the Santa Tracker, but only on your own family's devices (a signed-in grown-up, or a device you linked to your Kids' space): it shows a street map around your home, a glowing house marker with your child's first name, and the time Santa reaches your street (worked out from the rounded spot, so it is the same on every device). The child's device asks our server for the map tiles, never the map company: our server only hands out tiles within about 2 km of your saved spot, fetches them from the map provider (OpenStreetMap, or the map provider named on the map), and caches them for up to 14 days under a scrambled name. The tile requests do not include your address, and the spot is never shown to anyone outside your family. Sleigh Ride Home is part of Christmas Pro; the tracker's street view is not.

On devices that can draw it, the street view is a 3D vector map: its map data (OpenStreetMap, packaged as OpenMapTiles and served by OpenFreeMap) and its label fonts are also fetched by our server only, within about 2.5 km of your saved spot, and the tile requests carry only map-square numbers in the request body, never your address; we cache the map data for up to 30 days under scrambled names. For Santa's fly-in, our server also hands out zoomed-out overview tiles (coastline, towns and main roads, each covering about 20 km or more) within about 1,000 km of the spot, so the descent shows the country and then the town; these are fetched and cached the same way, are shared between families in the same region, and reveal only the general area, never the street. Map credits: OpenFreeMap © OpenMapTiles © OpenStreetMap contributors.

If we have switched on Apple Maps, the Santa drop on Christmas Eve (and its practice run) is shown over Apple Maps satellite imagery and, where Apple has it, Apple's Look Around street-level imagery. In that case the device playing loads the map directly from Apple (MapKit JS), so Apple receives that device's internet address and the area being viewed, and handles it under the Apple Maps privacy notice. Our server only signs a short-lived permission for the map; it does not send Apple your address or your child's details. A grown-up can also set an exact pin on their own house for the Santa drop: that exact pin is saved only on that device (in the browser's storage), never on our server, and can be removed in Grown-ups at any time. If a grown-up looks up their house with Apple Maps for this, the house number and postcode they type go from the browser to Apple and are not saved by us. Without Apple Maps, the drop uses our own street map described above.

Santa Tracker

The tracker counts how many families watch from each town. It works out the town from the device's time zone (or the area our hosting provider reports), and stores only the town, country, a rough position and a count, never an internet address. Towns not seen for 60 days are removed.

Who else handles data

How long we keep things

Cookies

The shop itself does not need a cookie to buy. An admin session cookie is used only on the private admin. If you sign in to the Grown-ups section, a sign-in cookie keeps you signed in, and a linked child's device keeps a cookie that opens the Kids' space. A Kids' space cookie keeps Grown-ups locked while the Kids' space is open. An analytics choice cookie is set if you accept or reject the banner. None of these are used for advertising.

To make the Kids' space open quickly and keep working when the internet drops, the browser on your device keeps copies of what it has already loaded: pictures, music and sound effects, the narrator's recorded lines, the game files, and the last copy of your child's own pages (their portal, movies, books, avatar and coins pages, which show their first name). The narrator's greetings with your child's first name (“Well done, Isla!”) are made by our server the first time and then kept only in that browser, so they are not made again; our server does not keep those recordings. These copies stay on that device, in that browser's own storage (no one else can read them), and are removed when you sign out of Grown-ups on that device or clear the site's data in the browser settings. They are never used for advertising or analytics.