The short version
- The free keyboard playground sends us a count of how many keys were pressed — nothing else. Which keys your child hit never leaves the browser, and there is no recording of what was typed.
- We collect aggregate analytics (page views, anonymous Web Vitals) via Google Analytics 4, Google Tag Manager and Microsoft Clarity. These load on every page of the site, including game pages. They are configured without advertising signals: no ad personalisation, no ad profiles, and nothing that identifies a child.
- We show advertising (Google AdSense) to keep the free games free. On every page a child can use, ads are flagged child-directed: contextual only, chosen from the page they sit on — never personalised, never based on a profile of your child, and never used for remarketing. Ads appear below the play area, never on top of a game.
- If a parent signs up for the paid tier, we collect: parent email and PayPal subscription state. That’s it.
- Child profiles are nicknames only — no names, no birth dates, no photos, no PII. They live under your parent account.
- We are COPPA-compliant by design: we don’t collect personal information from children.
What lives where
In your browser only
smash:totalinlocalStorage— your running personal keystroke count for the on-splash counter. Never sent anywhere.
On our servers (only if you sign up)
- Parent email + hashed authentication credentials.
- The IP address and browser of each sign-in, kept with that login session so the account owner and we can see where an account has been used. It is removed when the session expires or is signed out, which is at most 30 days.
- A short-lived live presence row while a device is on the site: a random device id, the page it is on, its browser, its IP address, and the approximate city, region and country our host derives from that IP. We use it to see current activity and to spot abuse. It is deleted automatically 5 minutes after the device stops, it is never combined with a child profile, and it is never used for advertising. Pages that could identify a child — a player page, a password-reset link — are recorded only as the section, never the full address.
- PayPal subscription ID + status.
- Child profile nicknames and aggregate progress (time played, milestones hit, accuracy curve). No identifying data.
Third parties we use
- Vercel — hosting. Standard request logs.
- Google Analytics 4 + Tag Manager — page-level usage. No PII passed.
- Microsoft Clarity — session replay on marketing pages, with input masking enabled.
- Google AdSense — advertising that funds the free games. On every page a child can use, requests are flagged child-directed: contextual only, non-personalised, and never used to build a profile. Google receives the standard request data (IP, page URL, user agent). No PII is passed, ever.
- PayPal — payment processing for paid tiers. Card details never touch our servers.
- Turso (LibSQL) — database for parent accounts, child profiles, and subscription state. Hosted in the US.
What we will never do
- Show personalised or behaviourally-targeted ads to a child. Ads on kid-facing pages are contextual only, with Google’s child-directed flag set on every request.
- Show ads inside a game, or over the play area.
- Sell or share your data with third-party advertisers.
- Track children with personalized identifiers.
- Add behavioral tracking inside game sessions. Once the splash is tapped, no analytics fire from inside the game itself.
- Keep your data after you ask us to delete it.
Your rights (and how to use them)
You can ask us to export or delete your account and any data associated with it at any time. Email info@tottype.com and we’ll do it within 30 days.
TotType is operated by Equal Technology Solutions, in the United States. The canonical URL of this policy is https://tottype.com/privacy.