PuffinCall
Privacy Policy
Last updated: 7 September 2026
PuffinCall lets a young child video call a small number of people their parent has approved. Because the app is used by children, we collect as little as we can and we are specific about what that is.
We never record, store, or listen to calls. Video and audio travel directly between the two phones. They do not pass through our servers, and no copy is kept anywhere.
We show no advertising and we do not use analytics or tracking. The app contains no advertising SDK, no analytics SDK, and no third-party tracker of any kind. We do not build profiles, and we do not sell or share data for advertising.
Who we are
PuffinCall is operated by Evma Pte. Ltd. (UEN 202619401E), a company registered in Singapore.
For any privacy question, or to have data deleted, contact [email protected]. We answer within 30 days.
What we collect
From the parent
| Data | Why | Kept |
|---|---|---|
| Email address | To sign in and to recover the account | Until the account is deleted |
| A record of parental consent — the exact wording shown, the date, and the account | Required by law and by Google Play before a child uses the app | Until the account is deleted |
| A PIN, stored as a salted hash | To keep settings and payments away from the child | On the device only — never sent to our servers |
| Time zone | So "no calls after 8pm" means 8pm where you are | Until the account is deleted |
About each child
We deliberately collect no more than the app needs to work:
| Data | Why | Kept |
|---|---|---|
| First name only | It appears on the phones of the people they call | Until the account is deleted |
| A photo, if the parent adds one | So a pre-reading child can recognise who they are calling | Until the parent removes it or deletes the account |
We do not collect a child's surname, date of birth, address, phone number, email, location, contacts, or any device identifier tied to them.
About the people the child calls
| Data | Why | Kept |
|---|---|---|
| The name the parent gives them, and a photo if added | So the child can recognise them | Until removed or the account is deleted |
| A notification token for their device | So their phone can ring | Until they unpair or the account is deleted |
About calls
| Data | Why | Kept |
|---|---|---|
| Who called whom, when, how long, and whether it was answered | To count minutes against the plan, and to show the parent | 12 months, then deleted |
The content of a call is never recorded or stored. We keep only the fact that a call happened and how long it lasted.
If you subscribe
| Data | Why | Kept |
|---|---|---|
| A Google Play purchase token, the product bought, and the price | To confirm the purchase is genuine and to grant minutes | 7 years, as tax law requires |
We never see or store card numbers. Payment is handled entirely by Google Play.
Permissions, and why
| Permission | Why we ask |
|---|---|
| Camera and Microphone | Video calls. Used only during a call, and never recorded. |
| Notifications | So an incoming call can ring. Without this, calls do not arrive. |
| Full-screen notifications | So a call appears over the lock screen like a normal phone call, rather than a banner that gets missed. |
| Ignore battery optimisation | Android otherwise stops the app in the background, and calls silently never arrive. This is the app's core function, not a convenience. |
| Start on boot | So the child's phone returns to the calling screen after restarting. |
| Photos | Only when a parent chooses a photo. We access the one image chosen and nothing else. |
Who else receives data
These are every third party the app sends data to. Each does one job, none of them advertising. The app contains no advertising SDK, no analytics SDK, and no third-party tracker of any kind.
| Who | What they receive, and why | Their policy |
|---|---|---|
| Supabase | Stores accounts, contacts, settings, photos and call records. Hosted in Singapore. | supabase.com/privacy |
| Daily.co | Connects the call. Video and audio go directly between the two phones; Daily helps them find each other and, on some networks, relays the stream without storing it. Recording is disabled at the server level, not just in the app. | daily.co/legal/privacy |
| Google — Firebase Cloud Messaging | Delivers the signal that makes a phone ring. Carries who is calling and a short-lived call token — no call content. | firebase.google.com/support/privacy |
| Google Play | Handles payment and confirms whether a purchase is genuine. We never see card details. | policies.google.com/privacy |
We do not sell data. We do not share it for advertising. We do not use it to build profiles, and we do not transfer it to data brokers.
Children's privacy
PuffinCall is intended for children under 13, used together with a parent or guardian. The app is designed for young children and follows Google Play's Families policy, the US Children's Online Privacy Protection Act (COPPA), the UK and EU General Data Protection Regulation including its provisions on children's data (GDPR and GDPR-K), and Singapore's Personal Data Protection Act (PDPA).
A parent or guardian must create the account before any part of the app a child uses will work. During setup we show the wording of the consent, and we record that wording, the date, and the account it belongs to. We do not knowingly collect data from a child without that consent in place.
You can withdraw consent at any time by deleting the account, from Settings → Account → Delete account and all data, or by emailing [email protected]. Withdrawing consent deletes the child's name and photo and everything else listed under "Your rights" below, and stops all further collection.
- A parent creates the account and confirms they are the guardian before any child feature works. We keep a record of that consent.
- A child cannot contact anyone the parent has not approved. There is no dialler, no contact search, and no way for an unknown number to reach the device.
- A child cannot reach a payment screen. Purchases sit behind a parent PIN.
- The app never answers a call by itself. Someone has to press accept, on both sides, every time — a camera never opens without a person choosing it.
- There is no advertising, no analytics, and no tracking.
- For each child we collect a first name and, optionally, a photo. Nothing else.
Your rights
A parent may at any time:
- See everything held about their family, from the app's settings.
- Correct any name or photo.
- Delete a contact, which deletes that person's photo too.
- Delete the account, which permanently removes the family, the child's name and photo, all contacts, and all call records. Purchase records are kept where tax law requires it, with the family details removed.
Email [email protected] to request deletion if you cannot access the app.
How long we keep things
| What | How long |
|---|---|
| Account, child's name, photos, contacts | Until the account is deleted |
| Call records — who, when, how long | 12 months |
| Purchase records | 7 years, as tax law requires |
| Pairing codes | 24 hours, then deleted |
Deletion is permanent. We do not keep backups of deleted accounts beyond 30 days.
Security
- All data in transit is encrypted (TLS).
- Photos are stored in private storage and are readable only by the family they belong to, through short-lived links.
- Each family's data is isolated at the database level — one family's account cannot read another's, by construction rather than by convention.
- The parent's PIN never leaves the device.
- Photos are re-encoded on the device before upload, which removes the location data that phone cameras attach to pictures.
Where data is held
Singapore. Some processing may occur in other countries where our providers operate; the same protections apply wherever it is held.
Changes
If we change this policy in a way that affects what we collect or who receives it, we will tell you in the app before the change takes effect.
Contact
[email protected]
Evma Pte. Ltd. (UEN 202619401E), Singapore