TypePup Privacy Policy

1. Who We Are

TypePup is a children's educational typing application developed and operated by an individual developer.

This Privacy Policy explains how we handle information when you use TypePup. We are committed to protecting the privacy of all users, especially children.

What This Policy Covers

• The TypePup web application at typepup.com
• Any installed PWA version of TypePup
• Interactions with our support via email
• Purchases made through Ko-fi for TypePup products

Our Commitment to Plain Language

We believe privacy policies should be readable by regular people, not just lawyers. We've written this policy to be as clear as possible. If anything is confusing, please contact us.

2. Information We Collect

From Children (App Users) - Stored LOCALLY ONLY

The following information is stored only on your device using your browser's localStorage. This data never leaves your device and is never sent to us:

What We Do NOT Collect from Children

• Real names, addresses, or contact information
• Photos, videos, or audio recordings
• Location data or GPS coordinates
• Device identifiers or advertising IDs
• Behavioral data or usage analytics
• Any data that could identify a specific child

From Adults (Supporters & Purchasers)

When adults make purchases or donations through Ko-fi, we receive limited information:

From All Users - Technical Data

Our hosting provider (Cloudflare) automatically logs basic web traffic data:

• IP address (anonymized in analytics)
• General browser type and version
• Date and time of access
• Pages requested

This data is used for security and performance purposes only, not for tracking individuals. See Section 5 (Cloudflare) for details.

3. How We Use Information

Local Data (On Your Device)

The data stored on your device is used solely to:

• Provide the educational typing experience
• Track and display your child's progress
• Award badges and achievements
• Remember settings and preferences
• Remember which premium features are unlocked

We cannot access this data. It exists only on your device.

Supporter/Purchase Data

The limited information we receive from Ko-fi is used to:

• Process refund requests
• Maintain transaction records for tax purposes
• Respond if you contact us about your purchase

Data Minimization

We follow the principle of data minimization: we only collect what's necessary for a specific purpose. Since TypePup's core function works entirely on your device, we don't need to collect children's data at all.

4. Information Sharing & Disclosure

We Do NOT Share Data With

• Advertisers or ad networks
• Data brokers
• Marketing companies
• Social media platforms
• Analytics companies (we don't use analytics)

Limited Sharing (Service Providers Only)

We work with the following service providers who may process limited data as part of their services:

• Cloudflare - Hosts our website (see Section 5)
• Ko-fi/Stripe - Processes payments (see Section 5)
• Browser speech services - Provides voice pronunciation (see Section 5)

Legal Requirements

We may disclose information if required by law, such as:

• To comply with a valid legal process (subpoena, court order)
• To protect the safety of users or the public
• To protect our legal rights

Note: Since we don't collect children's data, we have nothing to disclose about children.

5. Third-Party Services

Ko-fi (Payment Platform)

• Ko-fi processes all payments on their secure platform
• TypePup never sees or stores your payment card details
• Ko-fi is governed by their own Privacy Policy
• Ko-fi is PCI DSS compliant for payment security

Stripe (Payment Processor)

• Stripe handles the actual credit card processing
• Your card details go directly to Stripe, never to TypePup
• Stripe is governed by their own Privacy Policy
• Stripe is PCI DSS Level 1 certified (highest level)

Cloudflare (Hosting Provider)

• Cloudflare hosts and delivers TypePup to your browser
• Provides security protection (DDoS, bot filtering)
• Collects basic aggregate analytics (not individual tracking)
• Governed by Cloudflare's Privacy Policy
• Cloudflare does NOT track individual users for advertising

Browser Speech Services (Text-to-Speech)

How it works:

• Mobile devices (iPhone, iPad, Android): Speech is typically processed entirely on your device using built-in voices. No data is sent externally.
• Desktop browsers (Chrome, Edge): Your browser may use cloud-based voices from Google or Microsoft. When this happens, the text being spoken (individual letters like "A" or words like "apple") may be sent to these services.

What is sent:

• Only the text being spoken (single letters or simple words)
• No personal information
• No user identifiers
• No profile data

For maximum privacy:

• Use TypePup on a mobile device, OR
• Use the app while offline (forces local voices), OR
• In your device settings, select a local/offline voice

6. COPPA Compliance (United States)

Our COPPA Compliance Approach

TypePup is designed for children ages 3-7. We comply with COPPA by not collecting personal information from children in the first place.

Why Parental Consent Is Not Required

Under COPPA, parental consent is required before collecting personal information from children under 13. Because TypePup:

• Does NOT collect personal information from children
• Does NOT transmit children's data off the device
• Does NOT create user accounts or require registration
• Does NOT use persistent identifiers for behavioral advertising
• Does NOT enable children to make personal information publicly available

...parental consent is not required because there is no collection to consent to.

Parent Gate for Financial Transactions

Although not required by COPPA (since children cannot make purchases anyway), we implement a "parent gate" (simple math problem) before showing purchase options. This helps ensure an adult is involved in any purchase decisions.

If We Discovered Child Data

If we ever inadvertently received personal information from a child (for example, if a child used a parent's email to contact us), we would:

• Delete the information promptly
• Notify the parent if we have their contact information
• Take steps to prevent recurrence

Parental Rights Under COPPA

Parents have the right to:

• Review any personal information collected from their child - In TypePup's case, all data is on your device; you can review it directly in the app
• Delete their child's information - Delete profiles in-app or clear browser data
• Refuse further collection - Simply stop using the app

FTC Complaints

If you believe we are not complying with COPPA, you may file a complaint with the Federal Trade Commission:

• Online: reportfraud.ftc.gov
• Phone: 1-877-FTC-HELP (1-877-382-4357)

We welcome any questions about our COPPA compliance at [email protected].

7. GDPR Compliance (European Union)

Legal Basis for Processing

For the limited data processing that occurs:

Children's Data Under GDPR

Article 8 of GDPR provides special protection for children's data. TypePup's approach exceeds these requirements: we don't process children's personal data at all. All educational data remains on the child's device under parental control.

Your GDPR Rights

As an EU/EEA resident, you have the following rights:

• Right of Access (Article 15): Request a copy of your data. For local app data: view it directly on your device. For purchase data: email us.
• Right to Rectification (Article 16): Correct inaccurate data. For local data: edit it in the app. For purchase records: contact us.
• Right to Erasure (Article 17): Delete your data. For local data: delete profiles or clear browser data. For purchase records: contact us.
• Right to Restriction (Article 18): Limit how we process your data. Contact us with your request.
• Right to Data Portability (Article 20): Receive your data in a structured format. Your local data is in localStorage; we can provide purchase records upon request.
• Right to Object (Article 21): Object to processing based on legitimate interests. Contact us.
• Right Related to Automated Decisions (Article 22): Not applicable - we don't make automated decisions affecting you.

How to Exercise Your Rights

Email [email protected] with:

• The specific right you want to exercise
• Information to verify your identity (for purchase data)
• Your email address for our response

We will respond within 30 days.

Data Protection Authority Complaints

You have the right to lodge a complaint with your local Data Protection Authority. A list is available at: European Data Protection Board - Members

8. Children's Privacy Protections

Privacy-by-Design Principles

• Local-first architecture: All learning data stays on the family's device
• No accounts: No registration, login, email, or password required
• No tracking: No cookies, analytics, or behavioral monitoring
• No advertising: No ads, no ad networks, no tracking pixels
• No social features: No chat, messaging, or user-generated content
• No external links for children: Purchase links require adult verification

What We DON'T Do

• Collect persistent identifiers for advertising
• Enable behavioral advertising targeted at children
• Allow children to make purchases
• Enable public sharing of children's information
• Allow children to contact unknown adults
• Use gamification designed to exploit children

Parent Gate Implementation

Before accessing the shop or external purchase links, users must solve a simple math problem (e.g., "What is 7 + 5?"). This is designed to:

• Verify an adult is present for purchase decisions
• Prevent accidental purchases by young children
• Create a pause point for parental consideration

Important: Parent gates are not foolproof. Some older children may solve these problems. Parental supervision remains important.

9. Data Security

How We Protect TypePup

• HTTPS Only: All connections use encrypted HTTPS (TLS 1.3)
• HSTS Enabled: Browsers are forced to use secure connections
• Strict Content Security Policy: Prevents code injection attacks
• Local Encryption: Sensitive local data uses AES-GCM encryption
• No Third-Party Scripts: No external JavaScript that could compromise security
• Permissions-Policy: Explicitly disables payment, geolocation, camera, and microphone access

Your Device Security

Since data is stored on your device, your device's security matters:

• Use device passcodes/passwords
• Keep your browser updated
• Supervise young children's device use
• Be aware that clearing browser data removes TypePup progress

Incident Response

If we ever discovered a security issue that could affect users, we would:

• Fix the issue immediately
• Post a notice on typepup.com if user action is needed
• Notify relevant authorities if legally required

10. Data Retention

Local Data (Your Device)

Data stored in your browser's localStorage remains until:

• You delete a profile in TypePup
• You clear your browser data
• Your browser automatically clears it (rare, but possible with strict privacy settings)

We have no control over this data and cannot delete it remotely.

Purchase Records

Ko-fi purchase information (display name, amount, date) is retained:

• For tax compliance purposes: 7 years
• For refund processing: 180 days (our refund window)

Contact/Support Records

If you email us, we retain correspondence for:

• As long as necessary to resolve your inquiry
• Up to 2 years for reference if related issues arise
• Deleted upon your request

11. Your Rights & Choices

For Parents/Guardians

• Review data: Open TypePup and tap any profile to see all stored information
• Edit data: Change profile names, avatars, and settings directly in the app
• Delete profiles: Tap profile → "Delete Profile" to remove individual profiles
• Delete everything: Clear your browser's data for typepup.com
• Refuse collection: Stop using the app (no other collection occurs)
• Ask questions: Email us at [email protected]

For Supporters/Purchasers

• Transaction records: Request a summary of your purchases via email
• Refunds: Request within 180 days - no questions asked
• Delete records: Request deletion of your support history (except as required for tax compliance)

Voice Feature Control

• Disable voice in TypePup settings
• Use offline mode for guaranteed local-only speech
• Choose a local/offline voice in your device settings

12. International Users

Where Data Is Processed

• Local data: Stays on your device, wherever you are
• Website hosting: Cloudflare's global CDN (data may be cached in multiple countries)
• Payments: Ko-fi and Stripe process payments in accordance with their policies
• Speech services: Depends on your browser and device (typically your region)

No Cross-Border Personal Data Transfers

Because we don't collect children's personal data, there are no cross-border transfers of children's data to worry about. The only potential cross-border data flow involves:

• Adult purchase records (handled by Ko-fi/Stripe)
• Speech synthesis (letters sent to browser's speech service)

Region-Specific Rights

• United States: COPPA protections (see Section 6)
• European Union: GDPR rights (see Section 7)
• United Kingdom: UK GDPR and Age Appropriate Design Code principles
• Brazil: LGPD rights similar to GDPR
• Other regions: We apply our privacy standards globally

13. Browser-Specific Information

What's Stored in Your Browser

TypePup uses the following browser technologies:

• localStorage: Stores profiles, progress, and settings
• Service Worker: Enables offline functionality
• Cache Storage: Stores app files for fast loading

We do NOT use cookies, sessionStorage for tracking, or any fingerprinting techniques.

How to Clear TypePup Data

Chrome:

1. Go to Settings → Privacy and Security → Site Settings
2. Find typepup.com and click it
3. Click "Clear data"

Safari:

1. Go to Settings → Safari → Advanced → Website Data
2. Search for "typepup"
3. Swipe left and tap Delete

Firefox:

1. Go to Settings → Privacy & Security
2. Under Cookies and Site Data, click "Manage Data"
3. Search for "typepup" and click "Remove Selected"

Edge:

1. Go to Settings → Cookies and site permissions
2. Click "Manage and delete cookies and site data"
3. Find typepup.com and remove it

14. Policy Changes

How We Update This Policy

• We may update this Privacy Policy from time to time
• The "Last Updated" date at the top always shows the current version
• Material changes will be posted at least 30 days before taking effect
• The current version is always available at typepup.com/privacy

Notification of Changes

Since we don't collect email addresses, we cannot notify you directly of changes. We recommend:

• Bookmarking this page
• Checking periodically if you have concerns
• Contacting us with questions anytime

Changes Affecting Children

If we ever make changes that would result in collecting personal information from children, we would:

• Provide prominent notice
• Obtain verifiable parental consent before collection
• Comply with all COPPA requirements

15. Contact Information

What to Include in Your Message

• Your email address for our response
• A clear description of your question or concern
• If asking about child data: confirm you are the parent/guardian
• For purchase/refund issues: Ko-fi email, date, and amount

We Welcome Your Feedback

Privacy is important to us, and so is your input. If you have suggestions for improving our privacy practices or this policy, please let us know.