Privacy policy

Typcoon is a typing game for children. We collect as little as possible: without an account, progress stays on your own device. Below is exactly what we do keep, why, for how long and with whom.

In short, for kids

• You can play without giving us your name or email address.
• Your city is saved on this computer.
• If your parent makes an account, we keep your progress so you can continue on another computer.
• We never show ads and never tell anyone anything about you.
• Questions? Ask your parent to email us.

Who we are

Typcoon is responsible for the data. You can reach us at contact@typcoon.com.

Playing without an account

Progress (the city, the letters, settings, and a name if you type one in the game) is stored only in the browser on your own device. Typcoon uses no cookies. If you clear the browser data, the progress is gone.

Measuring how Typcoon is used

To make the game better, we count how it is used, without knowing who you are:

• which page, and what happened (for example: game started, mission finished, number of letters);
• the country (our host derives it from the IP address; we do not store the IP address itself);
• the kind of screen (phone, narrow screen, touch screen);
• whether someone plays for the first time or again (the device counts that itself);
• a random number per browser tab, so one visit is not counted twice;
• in the game: a random code per game on this device (for example K7M2X), so we can see whether a player comes back. The code is stored with the progress in the browser and disappears when the progress is deleted.

We do not link this to a name, email address or account, not even when there is a parent account. Legal basis: our legitimate interest in improving the game. We keep it for 13 months. The button below stops measuring on this device, including the code. At school we measure nothing.

Do not measure on this device

With a parent account

A parent can make an account to save progress and, if they want, get a weekly email and a reminder. We then keep:

• the parent's email address;
• per child: a random key, the name the child uses in the game (if they typed one), and the progress: letters, accuracy and speed per key, practice time per day, missions and diplomas;
• the browser's time zone, so emails arrive at a good moment;
• the email preferences and when the parent gave consent.

What for: signing in with a code by email, continuing on another computer (the agreement with the parent), and the weekly email and reminder when they are on (consent; every email has a link to turn them off).

How long: until the parent deletes the account, and at most until 24 months without activity (no playing and no signing in). Then we delete the account and the progress automatically, with an email to the parent a month in advance. You can delete it yourself in the game under For parents → Delete account, or by emailing us. Sign-in codes are deleted within a day after they expire; a sign-in expires after 90 days without use.

Glitch codes

With a glitch code a child puts something in the sky above their city. We store the code itself, which of the sharer's two codes it is, and when it was made and used. No name, email address or account is attached to it. The game remembers on the device (and, with a parent account, with us too) which codes the child has and what they got for them. To stop codes being guessed we count wrong attempts per IP address, made unrecognisable, and delete those counters after 2 days.

At school

If a child plays through school, the school is responsible for the data and we work on the school's behalf. What is kept then is in the privacy terms for schools.

Emailing the link

If you ask on a phone for the link by email, we use the address only to send that one email. We do not store it. To prevent abuse we keep an unrecognisable version for at most 2 days.

Who helps us

• Vercel (US): the server functions run in Frankfurt; the pages come from Vercel's worldwide network.
• Supabase: the database, in the EU.
• Resend (US): sending emails. Sending data may be stored in the US.
• ImprovMX: forwarding email sent to contact@typcoon.com.
• Telegram: notifications to the administrator, with counts and countries, without names or email addresses.

For the US services, the EU-US Data Privacy Framework and the European Commission's standard contractual clauses apply.

Security

All connections use https. We store sign-in tokens only as a hash. We count attempts per IP address to stop abuse, made unrecognisable with a secret key, and delete those counters after 2 days. The database can only be reached by our own server functions.

What we never do

• No ads and no third-party tracking.
• No selling or sharing of data for advertising.
• No chat and no public profiles.
• A child can never buy anything on their own.

Your rights

You can ask us to access, correct, delete or export the data, or to restrict its use, and you can object to the measuring (or switch it off yourself above). Email contact@typcoon.com; you will get an answer within a month. If you disagree with us, you can complain to the data protection authority in your country (in the Netherlands the Autoriteit Persoonsgegevens, in the UK the ICO).

Changes

If something changes, we update this page and the date below. For a parent account, we email important changes in advance.

Last updated: 6 October 2026.