Wandwork privacy policy

Last updated: 17 October 2026

Wandwork is an Android app made by Hillmade that lets a child cast spells at their phone: say a spell word, flick the phone, and something happens (the torch comes on, the volume goes down, an app opens). This is what it does with your data, in plain English.

Hillmade collects nothing. Wandwork sends nothing to Hillmade. It has no account, no analytics, no crash reporting, no advertising and no tracking of any kind.

Listening

The wand listens only after it is tapped (the floating wand, the Quick Settings tile or the home-screen widget), and only until the spell has been said: at most seven seconds. Two spells listen once more straight after: the app-opening spell, if no app was named (“…what?”), and the calling spell, which listens during its three-second countdown so it can be stopped. It never listens in the background.

What happens to the spoken words depends on one choice a parent makes in the Parent Lock:

• Without an OpenRouter key (the default). The phone’s own speech recognition writes down what was said. On phones that recognise speech on the phone itself (most recent Pixels, and other phones on Android 12 or later with the speech pack), the sound never leaves the phone. On other phones, Android’s speech service is used, which on most phones is Google’s and may send the sound to Google to be written down, under Google’s own privacy policy.
• With an OpenRouter key (optional “sharper ears”). The recording of the spell is sent to OpenRouter (openrouter.ai), which passes it to a speech recognition model to be written down. When the words are unclear, the written words (not the sound) may also be sent through OpenRouter to a language model, to ask which spell they sound like. This is paid for from the parent’s own OpenRouter account and covered by OpenRouter’s privacy policy and the policies of the models it uses. Wandwork does not keep the recordings.

Either way, the words are only matched against the spell list. Wandwork keeps no recordings and no record of what was said, and the released app writes nothing that was said to the phone’s logs.

To help the recogniser, Wandwork passes it the spell words, and, when it is listening for an app’s name, the names of the apps on the phone. If the phone’s recogniser is Google’s online service, those words go to Google with the sound.

With a key, each spell and each practice go uses a little of the parent’s OpenRouter credit. Setting a credit limit on the key at openrouter.ai keeps that in check.

What stays on the phone

Wandwork keeps these on the phone only, and deletes them all when it is uninstalled:

• the Wizard Name, wand colour, chosen voice, how theatrical the spells are, the flick settings, the optional birthday (day and month only) and which Secret Spells have been found;
• the parent’s choices: which spells and apps are sealed, and the contact the calling spell rings (the name and phone number picked from the contacts, nothing else from the address book);
• the Parent Lock PIN and the optional OpenRouter key, encrypted with the phone’s keystore.

None of this is included in cloud backups or copied when moving to a new phone.

Permissions, and why

• Microphone: to hear spells, only after the wand is tapped.
• Display over other apps: for the floating wand and its shows.
• Notifications: Android shows a small notice while the wand is awake.
• Phone calls (optional): so the calling spell can ring the parent’s chosen contact after a three-second countdown that can be stopped.
• Do Not Disturb access (optional): for the quieting spell.
• Notification access (optional): for the spell that clears notifications. It only ever dismisses them; it never reads them.
• Accessibility (optional): Android only lets an app lock the screen through an accessibility service. Wandwork’s does that one thing: it does not read the screen, watch what is tapped or collect anything.
• The list of installed apps: so the app-opening spell can open an app by name. The list itself stays on the phone (see Listening for the names given to the recogniser).

Each optional permission can be skipped; the spell that needs it then explains what is missing.

Children

Wandwork is designed to be set up by a parent for a child. It collects no personal information from children and sends nothing to Hillmade. Without an OpenRouter key, nothing a child says leaves phones that recognise speech on the phone itself.

Changes

If this policy changes, the new version will be on this page, with a new date at the top.

Contact

Jonathan Hill, Hillmade: [email protected]