Privacy Policy

What this website collects

Browsing the catalogue creates no profile of you. There is no analytics script, no advertising pixel, no social embed and no third-party tag of any kind on this site. Fonts are served from this domain rather than fetched from Google Fonts, and every image, cover and screenshot is stored here rather than hot-linked from a shop, so loading a page tells nobody but this server that you visited.

There are no visitor accounts, no newsletter and no payment on this website. Nothing you buy is bought here: the shop links send you to Displate, Amazon or an app store, which are separate companies with their own privacy policies.

What the applications collect

The applications do not ask for an account, a name or an email address. Scores, settings and progress are stored on your own device, and are removed when you uninstall the app.

Applications that display advertising do so through Google AdMob. AdMob is a Google service, and Google acts as an independent controller for the data it processes to deliver and measure ads — including device identifiers such as the advertising ID. The Advertising page explains what that means, and how to turn personalised advertising off.

Every application is distributed through Google Play, and some through Apple’s App Store as well. Each store collects data of its own — installs, crashes, and the diagnostics the platform reports — under its own privacy policy. The Data safety section of a Google Play listing, and the App Privacy section of an App Store listing, is the per-application statement, and it is the one that governs that app.

Applications aimed at children run under Google Play’s Families policy: they serve non-personalised ads only, do not use the advertising identifier for that audience, and do not knowingly collect personal information from children. If you believe a child has provided personal information to the studio, write in and it will be deleted.

The legal grounds

For visitors in the EEA and the UK, the GDPR requires a lawful basis for each purpose. These are the studio’s:

• Answering your message — performance of a step taken at your request, and the studio’s legitimate interest in replying to correspondence.
• Rate-limiting the contact form and screening spam — legitimate interest in keeping the form usable.
• Remembering your language and theme — strictly necessary for a feature you asked for; no consent banner is required, and none is shown.
• Personalised advertising in the applications — consent, collected through a Google-certified consent form before any personalised ad is requested.

How long it is kept

Who else sees it

The studio does not sell personal information, does not share it for cross-context behavioural advertising, and does not pass contact messages to anyone for their own purposes.

• The hosting provider that runs this site processes it on the studio’s instructions in order to serve the pages.
• Google, for advertising and distribution in the applications, as described above and on the Advertising page.
• A public authority, where the studio is legally required to respond to a valid request.

Where data is transferred outside the EEA or the UK — Google’s services operate internationally — it travels under the transfer mechanisms that provider publishes, such as the European Commission’s standard contractual clauses.

Your rights

Wherever you live, you can ask the studio for a copy of what it holds about you, ask for it to be corrected, or ask for it to be deleted. In the EEA and the UK you also have the right to object to processing based on legitimate interest, to ask for processing to be restricted, to receive your data in a portable form, and to complain to your national data protection authority. In California, you have the rights set out on the Your Privacy Choices page.

None of these requests costs anything, and none of them requires an account — the studio does not run one. The Data Deletion page is the fastest route for a deletion request.

How it is protected

• The site is served over HTTPS, with a strict set of security headers and no third-party scripts to be compromised.
• IP addresses are hashed with a secret salt before they are written, so the database cannot be turned back into a list of visitors.
• The admin panel is behind a signed, http-only session cookie that expires after twelve hours, and refuses every login when its secrets are not configured.
• The studio holds no payment details, because no payment is ever taken here.

Children

This website is not directed at children and the studio does not knowingly collect personal information from anyone under 13 (or the higher age of digital consent in your country) through it. Some of the books and applications are made for children; they are designed so that no personal information needs to be given at all.

Changes to this policy

When the wording changes in substance, the effective date at the top of this page changes with it. The policy lives at a stable URL, so a shop listing that points here keeps pointing at the current version.

How to reach the studio

Write to the studio through the contact form at https://typotouches.com/contact. A request about personal data is answered within 30 days.

TypoTouches is an independent creative studio, also listed on the shops as Typotouches Ess. It is the data controller for this website and for the applications it publishes.

Common questions