Privacy Policy

01 Who we are

The journal your child received, and the app that brings its pages to life, were created by the team at Joy & Wonder LLC, a Delaware limited liability company operating from California.

The project runs in partnership with the Starlight Children's Foundation. Starlight holds the relationship with your family: they take your request, they collect your consent, and they deliver the journal. We make the experience itself.

Starlight collects your consent on our behalf. Joy & Wonder remains responsible under the Children's Online Privacy Protection Rule for that consent and for everything in this policy. Starlight acts for us, not instead of us.

02 How your child joined

We describe this because it explains why we know so little about you.

You asked for a journal on Starlight's website and signed their consent form. You gave Starlight your details, your child's first name, and the name of your Child Life Specialist.

Starlight then sent us only your child's first name. At the moment our team entered that name, our system created a record for your child and issued two numbers: a box number, printed on the outside of the courier box, and a sequence ID, carried in the code inside the journal. We recorded your child's name in the opening video so the story greets them by name, told Starlight which box number was theirs, and Starlight delivered it to you.

We never received your name, your address, your email, your phone number, your child's last name, their age, their diagnosis, their hospital, or anything about their treatment. We do not receive that information and do not ask for it. Our agreement with Starlight prohibits them from sending it to us.

03 What we collect

This is the complete list.

We do not store IP addresses. Our servers see one momentarily while handling a request, and use it only to stop the same machine flooding us with traffic. It is never written down, never logged, and never attached to your child. We do not collect the make or model of your device.

Checking you received the right package

When you verify your package, and every time you sign in afterwards, you enter your child's first name and the box number. We already hold both and simply check they match. Each attempt is recorded, successful or not, as described in the table above.

How the story unlocks

The journal is divided into phases — some a single page, some several. When your child scans a page, a timer starts for the next phase. Depending on where they are in the story that might be a few minutes, a few hours, or a few days. The story unfolds in response to what your child does, at the pace they set.

This means there is never anything to catch up on. If your child cannot pick up the journal for a week or a month, nothing expires and nothing is missed — the next phase is simply waiting when they come back.

The schedule lives on the device, so it keeps running whether or not you have a signal.

04 What we never collect

There is no sign-up and no password. Your child's first name and the box number together are what signs you in, to both the app and the parent website. The website keeps you signed in for 90 days using a cookie on that browser; it holds no information beyond the fact that you signed in.

05 The camera

The journal works by pointing the camera at a page, so the app asks for camera access. This is worth being precise about:

If you decline camera access the journal's animations will not play, since there is no other way for the app to tell which page is open.

06 What we do with it

We use what we collect for three things, and nothing else:

• To run the story. Putting your child's name in the opening video, keeping their place in the journal, and letting them pick up where they left off if their device is replaced.
• To keep it working. Finding and fixing faults, helping when someone cannot sign in, and protecting the service from misuse.
• To see whether the programme helped. Looking at how the journals were used across the pilot, so Starlight and we can judge whether it is worth continuing.

We do not use any of it for advertising, for marketing, for training artificial intelligence systems, or to make decisions about your child.

07 Who else sees it

Our team, and only our team

Joy & Wonder staff can see, on an internal dashboard, each child's first name, box number and record of pages scanned. Access is limited to the people who need it to run the programme and support families. Nobody at Starlight has access to that dashboard, and nobody outside Joy & Wonder can see an individual child's record.

Starlight Children's Foundation

At the end of the pilot we send Starlight a report on how the journals were used across all the children taking part, so they can judge whether the programme is worth continuing.

That report contains group totals only, and we prepare it by hand. It says things like how many children opened their journal in the first week, how far the group got on average, and which adventures held attention longest. Where we show a spread, we group children into bands of at least five — for example, how many reached the first third of the story, the second, or the whole of it.

There are no rows for individual children, no names, no box numbers, no sequence IDs and no dates. Starlight cannot learn anything about your child in particular from it, and neither can anyone else who reads it.

Companies that help us operate

We use suppliers for server hosting and content delivery. They process data strictly on our instructions, and each has given us written assurances that they will protect it to the standard set out here and will not use it for any purpose of their own.

Nobody else

We do not sell, rent, trade or share your child's information with advertisers, data brokers, analytics companies, social networks or anyone else. There is no third-party analytics software and no advertising software in the app. If we are ever compelled by law to disclose something, we will tell Starlight so that affected families can be informed, unless we are legally forbidden from doing so.

08 How long we keep it

What "last used" means

The three-year clock starts at your child's most recent scan or sign-in, not at the day they received the journal. While your child is still reading, nothing is deleted — however long they take, and however long they put it down for. The clock only begins once they have stopped.

We keep this information so your child can pick up where they left off, and so you can restore their experience onto a new device if theirs is lost or replaced. We do not keep it for any other reason, and you can ask us to delete it sooner at any time.

Why the video is treated differently

The journal is your child's to keep. If their device is lost or replaced, you can reinstall the experience, including the opening video, which is why we hold on to that one file rather than deleting it with everything else. Be aware that the video contains your child's first name, spoken and shown — that is the point of it. Keeping the video means keeping their name.

09 Your rights as a parent

You are in charge of your child's information. At any time, and without giving a reason, you may:

• See what we hold. We will tell you everything we have that relates to your child. We look this up by hand, so allow us a few days.
• Have it deleted. We will erase your child's name, their box number and sequence ID, their progress and scan history, their sign-in records, and their personalised video.

Deleting your child's information does not take the journal away. The book is yours, and everything already downloaded to the device keeps working — the story continues to unlock on the device exactly as before, because that schedule is held there, not by us. What you lose is the ability to restore the experience onto a replacement device, since we will no longer hold the record needed to do it.

We act on requests within 30 days.

10 Keeping it safe

We maintain a written information security programme for children's information, and a named member of our team coordinates it. We assess the risks to your child's information at least once a year, encrypt it in transit and at rest, limit access to the staff who need it for their work, test our safeguards, and review and update the programme at least annually and after any significant change. Our suppliers have each given us written assurances that they will protect it to the same standard.

Your child's first name and box number together are what signs you in. Treat the box and the letter as you would a key: anyone holding them can reach your child's experience.

11 Children and the law

This programme is made for children, so the United States Children's Online Privacy Protection Act applies to it, along with the Federal Trade Commission's rules under that Act.

We collect information about a child only after a parent or guardian has given consent through Starlight, and we collect only what the experience needs in order to work. We do not require you to agree to anything unnecessary as a condition of your child receiving a journal, and withdrawing your consent does not cost your child the gift.

If you believe we hold information about a child without a parent's consent, tell us and we will delete it.

12 Changes to this policy

If we change how we handle your child's information in a way that matters, we will post the revised policy here with a new date. Our agreement with Starlight requires them to notify every family taking part, and we will not make the change until they have. Where the law requires fresh consent for a change, we will obtain it before the change takes effect rather than after.

13 Contact us