Updated October 18, 2026

Your family’s scenes stay private.

CatchMyElf is operated by Olilu LLC, based in California, United States. Contact catchmyelf@gmail.com about your information or account.

CatchMyElf is for parents and adult caregivers. Children do not need an account. For AI adventures, upload photographs of your toy elf and props without people, addresses or other identifying details. You may separately choose an optional child or family photo for the private keepsake card in both the welcome and flight-home videos after confirming you are a parent or guardian, or have permission to use it.

What you choose to save

Checkout saves your delivery email and the selected package before you verify an account. Email alone does not let anyone access an existing account. Signing in verifies your email address. Saving an elf profile or scene saves the details and selected photographs to your private account. Elf profiles can include children’s first names and ages to personalize the story and its audience. Saving does not start a paid video or grant permission to use your photos in public marketing.

Optional setup-guide emails

If you request our setup guide, we save your adult email address, the permission wording and version, confirmation time, broad signup source and unsubscribe status. We encrypt the saved signup address. We send a confirmation link first; setup tips and offers start only after you confirm. You can unsubscribe from any signup email. We check for a completed purchase before each promotional send and stop this welcome sequence after a purchase. Signup is optional and separate from account emails, visit measurement and advertising consent. We do not import checkout addresses into this list or upload it to advertising platforms. Unsubscribing removes the saved signup address while retaining a minimal suppression and consent record. Signup and unsubscribe links contain private tokens, carry no tracking tags, and do not load optional analytics.

Signing in

If you choose a password, we store a salted password hash rather than your password. Setting or resetting it requires fresh email verification. Where Google or Facebook sign-in is available, we save its account identifier and the verified email relationship needed to connect it to your parent account. Temporary verification records and essential cookies keep sign-in tied to the correct browser.

How your information is used

Your saved details support your elf profiles, purchases, requested videos and private delivery. When real creation is enabled and you request it, the selected toy and scene photographs and relevant scene instructions are sent to our video provider, Runware. Requested first names may be included for a name prop. The separate child or family photo is reserved for private welcome and flight-home template personalization and is never used as an AI video reference. Do not put a child’s likeness in an adventure setup, elf or prop reference.

When photo suggestions are enabled and you choose Generate for me, a resized setup photograph is sent to Google Gemini to suggest a playful action. You can edit the suggestion or write your own description. Requesting a suggestion does not generate a video or use an adventure credit. Keep people and identifying details out of setup photographs.

When elf photo matching is available, your selected elf character photo is processed by Cloudflare AI to suggest similar library appearances. Saved names and the separate child or family photo are excluded. Suggestions are cached privately to avoid repeated checks and costs. They require your comparison and do not create a video or use a video credit.

Cloudflare hosts the website and private storage. Stripe handles checkout and card details; our account stores the order and payment status, rather than your card number. Resend delivers sign-in and video-status emails. Essential cookies keep sign-in and checkout connected to the right account.

Anonymous website totals

We count successful public page loads and saved consent choices in aggregate to understand website use. These counters store a minute, broad page category, declared referral channel, referring registered domain, traffic-quality category and count. We discard referring paths, queries and subdomains. Browser-like navigation headers, named automation and available Cloudflare bot signals help separate likely browser loads, suspected automation, known tests and unknown requests; these classifications do not identify or prove unique human visitors. They do not store IP addresses, browser or session identifiers, full URLs, query strings, names or account details, and do not set cookies or access browser storage. Reloads can count again; totals do not identify unique people. The original filtered counter excludes common bots, link previews and signed-in team accounts where recognizable. The separate quality counter includes eligible bot and team/test HTML loads in labeled groups; prefetches and non-document probes are excluded. Fixed diagnostic counters also record the saved permission state at a public page load, public-page client initialization, notice rendering and measurement-request outcomes. They store only a minute, broad page category, diagnostic category, traffic-quality group and count, without linking to a visitor or journey. Do Not Track and Global Privacy Control suppress client diagnostic requests; no diagnostic request creates a cookie or enables optional measurement. Totals are removed after 90 days. A hashed consent-request retry key expires after ten minutes and is removed during cleanup to prevent counting the same saved choice twice; it is never joined to visitor or purchase records.

Reporting-team members can explicitly enable a two-hour test-only cookie in their browser, including for signed-out QA. Its temporary hash is stored separately without an account, visitor or session relation; it grants no account access. Marked tests are excluded from optional visitor events and saved-choice totals. Public visitors receive no new traffic-quality cookie.

Optional visit and campaign measurement

You can choose whether to allow visit measurement, and change that choice using Privacy choices in the footer. Optional browser and campaign measurement stays off before you allow it and when your browser sends Do Not Track or Global Privacy Control. It uses first-party browser and session cookies to count visits and understand campaign links. It does not record your photographs, names, email address or scene-form contents in visit events. Sign-in and purchases still work with measurement off.

Campaign tags and measured signup/checkout steps help us understand which campaigns lead to purchases. If you allow measurement, we also count play, video-end and download-request actions on your owned ready videos, using the original purchase’s saved campaign where available. These counts do not show whether a file was saved or shared. Confirmed purchases are counted from payment records, including purchases without visit tracking; those purchases can remain unattributed. When Google Analytics is configured, the same optional choice also controls Google Analytics. Its tag loads only after you allow measurement and our exclusions permit an event. We send allowlisted public-page and interaction categories with broad source labels, rather than private form contents, names, photos, email addresses, full referring URLs or page query strings. Google may receive browser/device and network information when its tag loads. Read how Google uses information from sites that use its services. Advertising signals, personalization and automatic form/search tracking are disabled. Choosing Keep it off stops Google measurement and removes its site cookies. Essential purchases still work. No Google tags load before permission, and measurement-off visits are not sent as cookieless Google pings. Our own visit events are kept for 90 days; Google event retention is configured separately in the property. Advertising measurement has a separate optional choice, described below. Visit events are removed after 90 days, and anonymous browser records after 90 days without activity. Short-lived hashed network counters help limit abuse of the measurement endpoint.

Optional advertising measurement

When advertising measurement is available, a separate unchecked option lets you allow Meta advertising measurement along with visit measurement. Previous visit-measurement permission does not enable Meta. You can decline or withdraw through Privacy choices; purchases and requested videos still work. Advertising measurement stays off before permission and for recognized team/testing traffic, Do Not Track or Global Privacy Control signals.

With this permission, Meta can receive broad public-page categories, advertising click/browser identifiers, browser and network information, and confirmed checkout or purchase details such as the package, discounted amount and currency. We use these to understand and improve advertising. We do not send family photographs, children’s names or ages, email addresses, private form contents, scene descriptions, or private access links. Automatic advanced matching and automatic form capture are disabled. Meta browser code runs in an isolated frame on approved public pages and is removed on private routes or withdrawal. Server purchase measurement is based on the original settled order rather than a visit to a success page. Read Meta’s privacy policy.

Advertising permission lasts up to 90 days. Advertising attribution and pending delivery data are kept for up to seven days; network/browser dispatch data is removed from sent event records. Limited delivery receipts are retained for up to 90 days. Withdrawal stops future dispatches and cancels pending events; it cannot recall events already delivered to Meta. Payment and fulfillment records have separate essential purposes.

Keeping and removing your data

You can delete saved scenes and photographs from your account. A photograph still used by an elf profile, unfinished video or intro/outro package must be kept until you replace it in the profile and the remaining work is completed or resolved. Changing a profile does not rewrite a purchased or submitted version.

You can request account deletion from Account controls after a recent sign-in. New creation and downloads pause while pending videos, purchases and unused credits are reconciled. Eligible deletion removes saved family details, private media, password hashes and linked sign-in identities; we retain a minimal order and credit audit. Cloudflare backups have a separate recovery period, so active deletion does not immediately remove every backup. Contact catchmyelf@gmail.com for help with a request or a photograph that remains in use. We will explain any purchase or processing record that needs to be retained.