Privacy Policy

The Burrow is a journaling app from Plushie Dreadfuls. The App is owned by Mysterious LLC, the company behind Plushie Dreadfuls, and is published, developed, and operated by Ensonova LLC under a development and publishing agreement with Mysterious LLC. This Privacy Policy explains what information the App collects, what it does not collect, who handles it, and the choices you have. It applies to the iOS and Android versions of the App and to no other product or website. Where a section applies to only one platform, it says so.

For the purposes of applicable data protection law, Ensonova LLC is the data controller of any personal information processed in connection with the App. Mysterious LLC owns the App and the underlying Plushie Dreadfuls intellectual property but does not receive or process user data from the App.

1. The short version

• Your journal entries stay on your device. We do not see them, store them on a server, or back them up to a cloud.
• We collect a small set of anonymous app analytics so we can fix bugs and improve the app.
• We do not show ads inside the app, and we do not sell your information or share it with data brokers. On Android, the app shares install and purchase attribution data with TikTok so we can measure our own advertising. See section 3.4.
• We do not require an account, and we do not ask for your name, email, or any contact information inside the app.

2. Information stored only on your device

Everything you write in the app, the moods you mark, the stickers you place, the rabbit you pick, your notification preferences, and the time windows you set are stored on your device using its local storage. None of that content is transmitted to us, to Plushie Dreadfuls, to Ensonova, or to any third party. If you delete the app or wipe your device, that content is gone.

If you choose to export your journal as a Markdown file, the export is created on your device. Whether you share that file afterward, where you save it, and who reads it, is entirely your choice.

3. Information we collect through analytics

The Burrow uses Mixpanel, an analytics service provided by Mixpanel, Inc., to understand how the app is used in aggregate. Mixpanel data is received and processed by Ensonova LLC. The information collected is product analytics, not personal communications, and does not include the text of anything you write in the app.

3.1 What Mixpanel receives

• App lifecycle events: app opens, session starts and ends.
• Screen views: the name of the screen you are on, such as the writer, the pages list, or settings.
• Onboarding events: that onboarding started and that it completed, plus an identifier for the rabbit you chose.
• Journal activity, in metadata form only: that a writer session opened, that typing began, that an entry was saved, deleted, or viewed, and the number of characters in a saved entry. The words of your entry are never sent.
• Sticker activity: which sticker pack was opened and which sticker was placed, by reference to the pack and asset name only.
• Plushie activity: when you change rabbits, and interactions with your rabbit on the home screen, such as tap, long press, or scratch.
• Notification settings: that you toggled notifications on or off, your selected frequency and time window, that a notification was scheduled, and that a notification was tapped.
• External link taps: when you tap a link to the Plushie Dreadfuls shop, the rate the app option, or the Ensonova link in settings.
• Crash and diagnostic information that Mixpanel collects automatically for the purpose of measuring stability.
• Standard device context that Mixpanel attaches by default, such as operating system, app version, app build number, device model, country derived from IP, and a Mixpanel session identifier.

3.2 The identifier we use

The first time the app runs, it generates a random version four universally unique identifier and stores it on your device. That identifier is sent with each analytics event as the Mixpanel distinct ID. It is not your name, your email, your Apple ID, your Google ID, your advertising ID, or any other identifier issued by your phone vendor. It is a random string created locally for the sole purpose of letting analytics events from the same install be grouped together. The Android advertising identifier described in section 3.4 is a separate thing, used only for advertising attribution and never sent to Mixpanel.

If you reinstall the app, a new identifier is generated and previous activity is not linked to it.

3.3 What Mixpanel does not receive

• The text of any journal entry.
• Your name, your email address, your phone number, your real world address, or any contact details.
• Your photo library, your camera, your contacts, your microphone, your calendar, or your location.
• Health, fitness, or biometric data of any kind.
• Payment information.

3.4 Attribution on Android (TikTok)

On Android only, The Burrow includes the TikTok Business SDK from TikTok Pte. Ltd., so we can measure whether our own advertising on TikTok leads to installs and purchases. It is not present in the iOS version, and it does not show ads inside the app.

What TikTok receives: your device's Google advertising identifier, which is a resettable identifier your phone provides for advertising measurement; the Google Play install referrer, which records which ad or link brought you to the store page; standard device and app context such as device model, operating system version, app version, IP address, and an install identifier that TikTok generates; and two app events, namely that you finished onboarding and that you completed a purchase. The purchase event includes the product identifier, the product name, the price, and the currency.

What TikTok does not receive: the text of anything you write, the moods you mark, the stickers you place, your notification settings, your Mixpanel identifier, or any name, email address, or phone number. We deliberately do not send TikTok's identify call, which is the mechanism that would attach a name, email, or phone number to your activity, and we do not report which screens you view.

TikTok processes what it receives as an independent controller under its own privacy policy, which you can read at https://www.tiktok.com/legal/privacy-policy.

To limit this, see section 8.4.

4. Purchases

The Burrow is free to download. Optional in app purchases for additional sticker packs are processed by Apple on the App Store or by Google on Google Play. Those companies are the data controllers of the payment information you provide to them. We receive a sales report from Apple and Google that tells us, in aggregate, that purchases happened. We do not receive your card number, your billing address, your Apple ID, your Google account, or any other identifier that would let us reach you. Their privacy practices are governed by their own policies, which you can read in the App Store and Google Play.

5. How long we keep information

Mixpanel analytics events are retained for up to twenty four months and then deleted on a rolling basis. Aggregate, fully anonymized statistics derived from those events, such as monthly active install counts, may be retained for longer for product planning. Data received by TikTok is retained under TikTok's own policy, which we do not control. Content that stays on your device is kept by your device until you delete the app or clear its data.

6. Sharing

We share product analytics with Mixpanel, which acts as a sub processor under contract. On Android we also share the attribution data described in section 3.4 with TikTok, which acts as an independent controller for advertising measurement. We do not share information with data brokers. We do not sell information for money. Some privacy laws, including the California Consumer Privacy Act, define "sale" and "sharing" broadly enough to cover passing an advertising identifier to an ad network. If you are covered by one of those laws, treat the TikTok sharing described in section 3.4 as sharing for cross context behavioral advertising, and see section 8.4. If we are required by law, by valid legal process, or to protect our rights or the safety of users, we may disclose information to the extent required. We will, where lawful, try to give notice before doing so.

7. Children

The Burrow is rated 4+ on the Apple App Store. On Google Play its target audience is set to thirteen and older. The App is not directed to children under thirteen. The App does not require an account, does not ask for a name or email or any other personal information, and does not knowingly collect personal information from children under thirteen within the meaning of the Children's Online Privacy Protection Act ("COPPA") or comparable laws in other countries. The analytics events described above are limited to anonymous app interactions tagged with a random per install identifier; they do not include any name, email, address, photo, voice recording, location, or other information that identifies a specific person. If you are a parent or legal guardian and believe a child under thirteen has provided personal information that we should remove, please write to us at support@ensonova.com and we will act promptly.

8. Your choices

8.1 Stop sending analytics

To stop sending analytics to us, you can delete the app. Deleting the app removes the locally stored identifier and stops all analytics. Deleting the app also stops the Android attribution described in section 3.4. For a way to limit that attribution without deleting the app, see section 8.4. We do not currently offer an in app analytics opt out. We are considering adding one and will update this policy if we do.

8.2 Your privacy rights

Depending on where you live, you may have rights under data protection laws such as the General Data Protection Regulation in the European Economic Area, the United Kingdom GDPR, the California Consumer Privacy Act as amended by the California Privacy Rights Act, and similar laws in other US states. Those rights may include the right to access information about you, to correct it, to delete it, to restrict or object to processing, to data portability, and to not be subject to discrimination for exercising your rights. Because the only information we hold that could relate to you is an anonymous random identifier with no name attached to it, the practical scope of those rights is limited. You can still send any privacy request to support@ensonova.com and we will respond within the timeframes that apply in your jurisdiction.

8.3 California "Shine the Light"

California Civil Code Section 1798.83 permits California residents to request information about disclosures of personal information to third parties for direct marketing purposes. We do not share personal information with third parties for their own direct marketing purposes. The advertising attribution described in section 3.4 is measurement of our own advertising rather than a disclosure for another company's direct marketing.

8.4 Limiting advertising attribution on Android

On Android you can limit the attribution described in section 3.4 from your device settings. Open Settings, then Privacy, then Ads, and either delete your advertising identifier or turn on the option to opt out of ads personalization. With the identifier deleted, TikTok no longer receives one from your device. Because The Burrow has no accounts and we hold no profile that could identify you, this device level control is the effective opt out and we cannot apply one on your behalf. This section does not apply to the iOS version, which contains no attribution software.

9. International transfers

Ensonova LLC and Mysterious LLC are both based in the United States. Mixpanel processes data in the United States and other countries where it operates. TikTok Pte. Ltd. is based in Singapore and processes data in Singapore, the United States, and other countries where it operates. If you use the app from outside the United States, the information described above will be transferred to and processed in the United States. Where required by law, we rely on appropriate transfer mechanisms such as the European Commission's Standard Contractual Clauses.

10. Security

Analytics data is sent to Mixpanel over encrypted HTTPS connections, and the attribution data described in section 3.4 is sent to TikTok over encrypted HTTPS connections. Ensonova LLC and Mysterious LLC use commercially reasonable safeguards to protect information against unauthorized access, alteration, disclosure, and destruction. No method of transmission over the internet and no method of electronic storage is one hundred percent secure, and we cannot guarantee absolute security.

11. Not a medical service

12. Changes to this policy

If we change this policy, we will update the "last updated" date at the top and post the new version at this URL. Material changes will be highlighted at the top of this page for at least thirty days. Continued use of the app after a change takes effect means you accept the updated policy.

13. How to contact us

For privacy questions and requests, write to Ensonova LLC, the data controller, at support@ensonova.com, with the subject line "The Burrow privacy".

For questions about ownership of the App or the Plushie Dreadfuls intellectual property, write to Mysterious LLC at mysterious.emailbox@gmail.com.