Privacy policy

1. Who we are

Typano is provided by the Typano team, the controller of the personal data described here. Questions or requests: [email protected], or the contact page (Contact) with the topic "Privacy and my data".

An account belongs to one adult: a parent, guardian or adult learner. Children use profiles inside a parent's account and never have their own login.

2. What we collect

About the account holder:

• email address, password (stored only as a salted hash) or your Google sign-in id, country and language;
• plan and billing history. Card details are handled by Stripe; we never see or keep full card numbers;
• the parental-consent record (method, date, country and policy version);
• for the Family plan, the household's verified home country, worked out from your connection's IP address when you verify it.

About each profile:

• a display name, an avatar chosen from our set and an optional birth year (no photos);
• practice data: which keys and notes were played, how accurately and how fast, and when; streaks, achievements and goals;
• songs imported for the profile, and settings such as keyboard layout, piano input and session cap.

From your device:

• the keyboard layout you choose and, if you connect a piano, the name of the MIDI or Bluetooth device;
• technical data needed to run and secure the service: IP address, browser type and the time of requests, kept in security logs.

When you contact us: your name, email, the topic and your message.

3. Keyboard, piano and microphone

Key presses and piano notes are turned into feedback in your browser. We store summaries such as accuracy and timing, not a recording of what you type or play.

If you choose to learn with the microphone, the sound is analysed on your device to work out which notes were played. Nothing from the microphone is recorded, stored or sent to us. It only listens while a lesson, test or set-up step needs it, and the browser shows when it's on.

4. How we use it, and why we're allowed to

• To provide the service you asked for (contract): teach, pick the next lesson, build drills from the keys you find hardest, show progress to you or the parent, and process payments.
• To keep the service safe and working (legitimate interests): sign-in security, rate limits, fraud prevention, fixing bugs and understanding which lessons work, using aggregated data.
• With consent: the parental consent for each child, and optional emails such as tips and news, which you can turn off at any time.
• To meet legal duties (legal obligation): tax and accounting records, and responding to lawful requests.

We don't sell personal data, show advertising, or use children's data for marketing or profiling beyond choosing their next lesson.

5. Children's data

Before a child profile is created, a parent gives verifiable consent. The method depends on the country (for example a signed form checked by our team). We follow the UK Age Appropriate Design Code, and for children in the US we follow the Children's Online Privacy Protection Act (COPPA).

Children can't upload photos or write free text to other people. Friends see progress only, and friend requests need a parent's approval. Imported songs and AI-generated lessons wait for a parent's approval before a child sees them.

Settings for children are private by default. A parent can see, export or delete a child's data at any time from the account area, and can withdraw consent, which deletes the child's profile.

6. Who we share it with

We share personal data only with service providers that help us run the service, under contracts that require them to protect it and use it only on our instructions:

• hosting and databases (our servers and backups);
• Stripe, for payments;
• our email provider, for sign-in codes, receipts and replies to your messages;
• Google, if you choose to sign in with Google;
• an AI provider, for AI features. We send what's needed to make the lesson (such as the instrument, level and the notes to practise), not your name or email.

We may also share data if the law requires it, to protect someone's safety, or with a buyer if the business changes hands (who would have to keep these promises).

7. International transfers

Some providers process data outside the UK or your country. Where they do, we use safeguards recognised by UK and EU law, such as adequacy decisions or standard contractual clauses.

8. How long we keep it

• Account and profile data: while the account is open. When you delete a profile or close the account, it is removed after 30 days (so a mistake can be undone), and from backups within a further 35 days.
• Billing records: 6 years, as tax law requires.
• Consent records: for as long as the child profile exists, plus 3 years.
• Contact messages: 2 years after we've resolved them.
• Security logs: 90 days.

9. Your rights

You can access, correct, export or delete your data, object to or restrict some uses, and withdraw consent. Most of this is self-service under Account → Data and privacy; for anything else, email [email protected]. We reply within one month.

If you're unhappy with how we handle your data, please tell us first. You can also complain to your data-protection authority: in the UK, the Information Commissioner's Office (ico.org.uk); in Ireland, the Data Protection Commission.

10. Security

Data is encrypted in transit (HTTPS) and passwords are stored only as salted hashes. Accounts can turn on two-factor sign-in. Staff access is limited to people who need it, and admin actions are logged. If a breach puts you at risk, we'll tell you and the regulator as the law requires.

11. Cookies

We use only the cookies and browser storage the service needs. They are listed on the cookies page (Cookies).

12. Changes to this policy

We'll update the date and version above when this policy changes, and email account holders about material changes before they apply.

Version history