UK GDPR • DPA 2018 • PECR • ICO Children's Code • COPPA Last Updated: 02 November 2026

Privacy & Cookie Policy

At SkyTyper.co.uk, child safety and data minimisation are built into our architecture. This policy explains what information we collect across Guest, Solo, Family, School, and Multi-Academy Trust accounts, how we protect it, and your rights under UK data protection law.

📋 View Pre-Populated School DPIA Template →

1. Who We Are & Our Role (Controller vs Processor)

SkyTyper (https://skytyper.co.uk) is an educational touch-typing and mouse-skills platform operated in the United Kingdom.

For Guest Visitors, Solo Learners, and Parent/Family Accounts: SkyTyper acts as the Data Controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
For Schools and Multi-Academy Trusts (MATs): The subscribing School or Multi-Academy Trust is the Data Controller, and SkyTyper acts strictly as a Data Processor under Article 28 UK GDPR, processing pupil and teacher data solely on the instructions of the school. School Data Protection Officers can download our Pre-Populated School DPIA Template at any time.

2. Information We Collect by Account Tier

We practice strict data minimisation. We never collect pupil email addresses, dates of birth, home addresses, or behavioural advertising profiles.

A. School Pupils & Home Family Children

• First Name & 1-Character Last Initial (e.g. James B.)
• Pseudonymous Username (e.g. JamesB) & 4-Digit PIN
• Game Performance Metrics: Score, typing speed (WPM), accuracy percentage, and missed keyboard letters (A–Z) for remedial drills.
• Zero Roster Disclosure: Our /play portal requires Class/Child Code + Username + PIN and never lists pupil names in a public dropdown.

B. Teachers, School Leads, Parents & Solo Users

• Account Details: Full name, email address, role, and Bcrypt-hashed password.
• School / Trust Billing Details: School/Trust name, DfE URN, billing address, finance/bursar email address, and Purchase Order (PO) numbers.
• Card Payments: Processed directly by Stripe (PCI-DSS Level 1). SkyTyper never sees or stores your credit/debit card numbers.

3. Lawful Basis for Processing (Article 6 UK GDPR)

Contract (Art. 6(1)(b)): To create and manage Solo, Family, School, and Multi-Academy Trust accounts, process subscriptions, and issue BACS or card invoices.
Public Task / Legitimate Interests (Art. 6(1)(e) & (f)): To enable schools and teachers to deliver computing and literacy curriculum activities and track pupil keyboard fluency.
Legal Obligation (Art. 6(1)(c)): Retaining financial invoices and BACS remittance records for UK tax and accounting compliance (HMRC).
Consent (Art. 6(1)(a) & PECR): For optional analytics or advertising cookies on public pages via our slim bottom cookie banner.

4. Cookie Policy & Local Storage (PECR Compliance)

We have replaced intrusive third-party consent popups with our own transparent, lightweight cookie control bar. You can change your choice at any time by clicking .

Cookie / Storage Name	Category	Purpose	Expiry
PHPSESSID	Strictly Necessary	Maintains your authenticated login session and CSRF security token.	Session
skytyper_cookie_consent	Strictly Necessary	Remembers your cookie banner preferences (Essential Only vs Accept All).	12 Months
cf_turnstile	Strictly Necessary	Cloudflare Turnstile privacy-first bot protection on login and contact forms.	Session
_ga, _ga_*	Analytics (Optional)	Google Analytics 4 anonymous traffic measurement (IP anonymised). Never loaded in pupil `/play` sessions.	Up to 13 Months

5. UK ICO Children's Code & COPPA Compliance

SkyTyper is engineered to comply with the UK ICO Age Appropriate Design Code (Children's Code) and the US Children's Online Privacy Protection Act (COPPA):

Zero Behavioural Advertising to Children: Pupil sessions (/play), School accounts, and Family Plan accounts are 100% ad-free. Even on free guest pages, third-party advertising is disabled by default in favour of first-party SkyTyper plan information.
No Public Profiles or Chat: Children cannot message other users, upload photos/videos, or display their names publicly.
Parental & Teacher Control: Parents and teachers have full visibility into their children's or pupils' accounts and can reset PINs or delete profiles at any time.

6. Data Retention & Automated Deletion Schedule

Active Accounts: Pupil and user game progress is retained while the account or school subscription remains active.
Expired Subscriptions (30-Day Grace & 90-Day Erasure): When a paid School, Trust, Family, or Solo subscription expires, account holders can log in for 30 days in read-only mode to export reports or renew their licence. If an account is not renewed within 90 days after expiry, the account and all associated pupil/child profiles and game sessions are permanently and automatically deleted.
Financial Invoices: BACS and card payment invoices are retained for 6 years + current financial year in accordance with UK HMRC statutory requirements.

7. Your Data Protection Rights

Under UK GDPR, you have the right to access your personal data, request rectification of inaccurate data, request erasure ("right to be forgotten"), restrict or object to processing, and request data portability (CSV exports are built directly into our School and Trust portals).

To exercise any of these rights or to contact our Data Protection Lead, please use our Contact Form. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.