Privacy Policy
The short version
TillieWorld collects nothing. It has no accounts, no adverts, no analytics and no tracking of any kind. Nothing is sent to us, and there is no server for it to be sent to. Everything your child makes stays in your home.
Who we are
TillieWorld is made by Adam Scott Rowe, an independent developer in the United Kingdom. For anything at all, including privacy questions, write to support@tillieworld.app.
Information we collect
None. We do not ask for a name, an email address, a date of birth, a photograph, a location or anything else. There is no sign-up, no login and no profile held by us. We have no way of knowing who you are or that you use the app.
What is stored on your device
TillieWorld saves your child's play — their shops, the items they've invented, their prices, the child profiles you create, the characters they make of themselves, their tidy-up jobs and the coins in their jars, and your app settings — in the app's own private storage on the device. It is never uploaded anywhere. We cannot see it, and neither can anyone else. The one case where anything is shared at all is Family Link, described below, and that goes directly to another iPad in your own home.
Deleting the app deletes all of it permanently.
Playing across two devices
TillieWorld has an optional Family Link mode, switched on by a grown-up in the settings. It lets two iPads in the same home play together: one running the shop while the other cooks in the kitchen, one shopping while the other works the checkout, or one taking orders while the other drives them out in the delivery van.
When it is on, the two devices talk directly to each other over Wi-Fi or Bluetooth. There is no server, no account and no code to type in, and nothing travels over the internet — it still works when the broadband is down.
What passes between the two iPads is the pretend play itself: the order being rung up, the tickets waiting in the kitchen, which item has been cooked, the pretend shopping in the basket, the orders waiting to be delivered, and which iPad has taken which job. Each device also announces the name of the player using it (the name typed in when that player was added, or “Guest”), with a short random tag added because two players in one family can have the same name. If that player has made a character of themselves, the choices they picked — hair, face, clothes, costume — go across too, so the other iPad can draw them; it is a drawing built from those choices, never a photograph. And each iPad says which add-ons it has bought, so the two can play with whatever either one owns.
The connection is encrypted, and a device will only pair with another copy of TillieWorld that also has Family Link switched on and is close enough to reach. iOS will ask your permission the first time, which is why you may see TillieWorld request to find devices on your local network.
With Family Link switched off, none of this runs at all.
Deliveries, signatures and the card machine
The delivery game takes place in towns that are illustrations, not real maps. TillieWorld does not use location services and never knows where you are.
When a pretend customer signs for a parcel, the signature is a squiggle drawn with a finger on the screen. It is shown for that moment only: it is not saved, not sent to the other iPad, and not sent anywhere else.
The card machine and bank card are pretend too. TillieWorld cannot read a real bank card and never asks for one.
No third parties
TillieWorld contains no third-party advertising, no third-party analytics and no third-party software development kits. Nothing about your child or your device is sent to any other company. We do not sell, share or disclose data, because we do not have any.
Speaking aloud
TillieWorld reads item names and prices aloud using the speech feature already built into iOS, with voices installed on your own device. This happens entirely on the device. TillieWorld does not use the microphone, does not listen, and does not record or transmit any audio.
Printing
If you print anything, such as a menu, shop sign or play money, it is sent directly from your device to your own printer using Apple's AirPrint. They do not pass through us.
Purchases
If TillieWorld offers optional one-off purchases, those are handled entirely by Apple through the App Store. Payment is made to Apple, and we never see or receive your card details, billing address or Apple Account information. Apple tells us only how many purchases were made in total, with no information about who made them. Apple's own handling of that transaction is covered by Apple's privacy policy.
Children's privacy
TillieWorld is designed for children, and it is built so that a child cannot give away information about themselves even by accident. It collects no personal information from anyone of any age, including children under 13. There is no chat, no messaging, no user accounts, no social features, and no photograph or video capture. A child cannot share anything beyond your own home: the only thing TillieWorld can connect to is another iPad in the same room running the same app.
This is intended to satisfy the United States Children's Online Privacy Protection Act (COPPA), the UK GDPR and the Age Appropriate Design Code, and the EU GDPR — by collecting nothing in the first place.
Any link that leaves the app, and any purchase, sits behind a grown-up gate that a young child is not expected to pass.
Your rights
Data protection law gives you the right to see, correct, export or delete personal data an organisation holds about you. We hold none, so there is nothing for us to show you or delete. Everything the app has created lives on your own device and is entirely under your control. If you would like to confirm this for yourself, please do write and ask.
Changes to this policy
If TillieWorld ever changes in a way that affects this policy, we will update this page and change the date at the top before that version is released. If a change were ever to be significant, we would say so clearly in the app as well.