Bumpy Keys is free on iPad and Mac. 100 typing lessons, no ads.Download free

Privacy policy

Bumpy Keys for iPad and Mac, and bumpykeys.com · Effective September 22, 2026

The short version. The Bumpy Keys app collects no personal information from anyone. There are no accounts, no analytics, no ads, no tracking, and the app's own code makes no network connections, except when a racer joins a Race together room, which sends the racer's one-word name, character, outfit, age range and race progress through our relay (the full list is in section 5) and keeps nothing afterwards, or, in the browser game, when a class code is claimed as described in section 4. Your child's progress stays on your iPad or Mac, and leaves it only as a picture or a racer file a grown-up chooses to share. Purchases, browser codes, optional online rooms, email and website hosting use the services described below. Our marketing homepage also uses cookieless website analytics, separate from the game (section 8).

Bumpy Keys is made and published by Click Clack Labs ("we"), a one-person studio in the United States. This policy covers the Bumpy Keys app for iPad and Mac (from the App Store or the TestFlight beta), the bumpykeys.com website, the full browser game at play.bumpykeys.com (the address bumpykeys.com/play opens it), and email between you and us.

About the words "some versions". Families update at different times, so a few sentences below say "some versions" or "depending on the version". Each of those sentences is true for every version a family can be running. To find out what your version does, write to us (section 14) and we will tell you.

1. The app collects nothing

  • We never ask for an account, sign-in, email address, birthdate, photo or phone number. A grown-up may give a racer a first name or nickname (section 2); an online room uses the first word of that name, and the join screen asks for a one-word nickname when the racer has no name yet or its saved name cannot be used in a room (section 5). Otherwise the only things a child types are the letters and words of the lessons. Some versions of the game also have one page where a child can type anything they like; the device reads it aloud and nothing keeps it (section 3).
  • The native app connects to our service for optional Race together rooms (section 5). The browser game also contacts our code service to claim classroom access (section 4). We run the small relay and code service those use, on Cloudflare; nothing else of ours. The Mac version runs in Apple's App Sandbox with permission only for those connections. The other network traffic is Apple's App Store handling a purchase or a restore, and the web page or email app that opens when a grown-up taps a link behind the parent gate.
  • No analytics, advertising, crash-reporting or other third-party code is built into the app.
  • The app never asks for, and cannot read, the microphone, camera, location, contacts, photos, or the advertising identifier. It asks for no permission, with one exception: if a grown-up sets a Grown-ups PIN and forgets it (section 2), the app offers the device's own lock (Face ID, Touch ID, the passcode or the Mac password) through Apple's own prompt, and learns only whether it passed.
  • Race a friend (hot seat) is two players on one device; nothing leaves it. Racing with friends online is described in section 5.

2. What stays on your device

The app keeps a small folder of progress files on the device, one per racer plus the device's own settings file. They hold:

  • progress: levels passed, stars, recent runs, per-key accuracy and speed, minutes played per day (an online race adds to the minutes, nothing else), the daily quest and streak, the dress-up items the racer has earned and is wearing (every item is earned by playing; none is sold);
  • a small race log, one entry per day the racer plays (laps, keys typed, average accuracy and speed, stars earned, keys learned so far), kept for up to a year. It draws the "My race log" charts for your child and the progress charts in Grown-ups, and nothing from it is sent anywhere;
  • the racer's name, if a grown-up typed one (below), and the answer to the one-time placement offer (below);
  • the racer's kart as the child dressed it: the Paint it wears and the Plate on its flank. The "My Name" plate draws the first six letters of the racer's name on the kart, and "My Number" a number the child picks (0 to 99); both are drawn on the device from the racer's own file and go nowhere else. An online room sends the outfit's item ids, never the plate: the other racers see the paint and the hat, and the name only as the room's one-word name (section 5);
  • settings: the age band a grown-up picked (one of three ranges: 4 to 5, 6 to 7, 8 to 9), the chosen world, sound/music/voice switches, hands on or off, finger colors, the word your family uses for the # key, whether levels must be played in order, whether online rooms are allowed, and whether the other worlds are shown on the Home screen (a switch a teacher can turn off to keep a classroom iPad quiet);
  • a browser unlock code, or legacy code data retained from an older app version;
  • a few counters the app keeps for the grown-up: how often the "Ask a grown-up" card, the parent gate and the world shop were opened, how many purchases, restores and codes happened, how many guest laps your child took in worlds you don't own, and which racers your child has "met". They are shown only in Grown-ups, never to the child, and never leave the device. There is no analytics behind them: they exist so a parent can see whether the locked worlds are being asked about.

A guest lap is a preview: the lap in a world you don't own records no stars, no progress and no minutes, only the counter above.

Several racers on one device. Up to eight racers can share one iPad or Mac, each with their own progress. Every racer has a name: a grown-up may type one (up to 20 characters) when adding the racer or later in Grown-ups; until then the racer is "Racer 1", "Racer 2" and so on. A name is text only, stored with that racer's progress on the device, shown only inside the app (the home screen says "Playing as Pip"), never spoken by Bumper, and used for nothing else; its first word is the name the other racers see when the racer joins an online room (section 5). A first name or nickname is all the app needs. A name is never one of the game's own words (a world or a character), and a racer who was never named is asked for one once; "Not now" keeps "Racer". The device keeps one small settings file of its own (the original free-world choice and legacy swap fields retained for compatibility, legacy code data from an older app version, the sound and keyboard switches, and the Grown-ups PIN as a salted hash if one was set), shared by every racer on it. Removing a racer deletes that racer's files and nothing else; there is no sync of any kind, so nothing has to be told.

The placement lap. A racer of 6 or older who has not raced yet may be offered one placement lap ("Typed before?"). Its accuracy and speed decide only where that racer's road begins; the answer, either way, is kept with the racer's progress and nothing is sent anywhere.

The Grown-ups PIN. A grown-up can set a four-digit PIN that Grown-ups asks for after the press and hold (section 4). The PIN is kept in the device's settings file as a salted hash (a scrambled form the digits cannot be read back from), never as the digits themselves; it is never synced, never put in a racer file, and never leaves the device. Five wrong tries pause the pad for a minute, counted in memory only. If you forget it, the app offers the device's own lock (Face ID, Touch ID, the passcode or the Mac password), which Apple checks and we never see; where the device has no lock, a 10-second hold opens Grown-ups and clears the PIN. Some versions of the app and the browser game ask for 30 seconds, not 10. Version 1.0.2 of the app is one of them. The screen says how long.

Race on this iPad (hot seat) names. When two to four racers share one device for a race, each seat has a one-word name (a suggested nickname, or one the racers type). Those names are kept in the app's memory only for as long as the app is open, so "Race again" can reuse them; they are never written to the progress files, never spoken by Bumper, never sent anywhere, and are gone when the app closes.

Moving a racer to another device. A grown-up can make a file of one racer (Grown-ups, Racers, the racer's page, "Send to another device"; on a Mac also "Save as a file"): the racer's name and progress, and nothing of the device (no unlock, no code, no settings, no PIN). The file is yours. It goes only where you send or save it (AirDrop, Files, Mail, a folder, any app you pick), and nothing leaves the device unless you share it; we never receive a copy and are not told that you made one. On the other device, "Add from a file" reads it back in (section 6).

Next to the progress files, the app keeps rendered music for the worlds that have been played on this device: plain sound files it generates once instead of every launch (a slower version is made for Little Racers). They contain nothing about your child and are remade after an update.

No birthdate and no photos; a name only if a grown-up typed one. The files are protected by the device's built-in data protection.

You control it: Grown-ups → Start over clears the racing racer's progress (the settings stay), Grown-ups → Racers → the racer → Remove deletes one racer's files and nothing else, Grown-ups → This iPad / This Mac → Remove the PIN clears the PIN, and deleting the app deletes everything. Your own device backups (iCloud Backup, Time Machine, a Mac or Finder backup) may include the files, like any app's data; that copy is yours, and we never receive it.

3. Bumper's voice and the sounds

Bumper the bear's lines are about 1,260 short audio clips that ship inside the app. They are not a recording of a real person and never of a child: we designed the voice with a text-to-speech model (Qwen3-TTS) on our own computers, then listened to and checked every clip before it went in. Nothing is streamed, nothing is recorded, and the microphone is never used.

Everything Bumper says is one of those clips. Some versions of the game also have one page where a child can type anything they like, and the speech engine built into the device or the browser reads it back (the same voices the system uses to read screens aloud). That happens on the device only: the typed text is not stored and is not sent anywhere, every word is checked against our word list first, and a word we would not read aloud becomes a beep instead. It never uses a Personal Voice. In every other version, no voice is made on your device.

Sound effects are sound files we made ourselves and ship inside the app; the music is generated on the device, then kept as sound files so it does not have to be generated every launch (section 2).

4. Purchases and unlock codes

  • The single in-app purchase ("All twenty worlds") is a one-time, non-consumable purchase processed entirely by Apple's App Store on iPad and Mac (one listing, one purchase, Family Sharing included). Apple handles payment, receipts, Family Sharing and refunds under Apple's terms and privacy policy; we receive no name, email, address or payment details, only Apple's aggregate sales reports.
  • Purchases, Restore Purchases, settings and every link out of the app sit behind a parent gate (press and hold a button; a grown-up can also set a four-digit PIN that is asked after the hold, kept on the device as a salted hash and never sent anywhere; section 2), as the App Store Kids Category requires.
  • Buying in the browser. When browser checkout is available, a grown-up leaves the game for Stripe's hosted checkout. Stripe Managed Payments (Link) processes the payment, applicable sales taxes and receipt as merchant of record. Stripe receives the grown-up's payment, contact and billing information under its own privacy policy. Our purchase service receives the payment status and stores the unlock code and link on the Stripe payment record so we can fulfil the purchase and recover a lost code. No racer name, age or learning progress is sent with the purchase. The code appears in the game after payment; it is not included in Stripe's receipt. A pending checkout reference is temporarily kept in the browser tab so reloading can finish delivery. When purchase emails are enabled, Resend sends the grown-up a separate Bumpy Keys email containing the unlock code and restore link. We share the checkout email address and purchase code with Resend for this delivery, never a child’s name, typing or progress. This is a purchase email, not a marketing subscription. Stripe keeps a delivery identifier to avoid sending the same email twice. See Resend’s privacy policy. Email [email protected] for help recovering a code.
  • Browser unlock codes. Native build 27 and later use verified Apple purchases and Apple offer codes for additional worlds. Custom classroom and family codes cannot unlock native content; older native versions may still contain the earlier code system and its stored data. In the browser game, a ten-letter class code is sent once to a small code service we run on Cloudflare, with a random number the device made up for this purpose and the platform name, so the code's seats can be counted. The service keeps only the counts per code (including counts retained from older native versions and browser claims, and, for ten minutes, a scrambled copy of the random numbers it has just seen so a retried claim is not counted twice) and deletes the record a month after the code ends; it keeps no logs, no device identifiers and nothing about the child. The unlock it answers with, and every other code (a family code's link, the older word codes), is checked on the device itself, offline, against keys built into the browser game. Codes can cover a number of devices and have an end date, both shown in Grown-ups; when the end date passes the extra worlds close again and nothing else changes.

5. Racing with friends online

When a racer starts or joins a Race together room (Friends → Online room), the app connects to a small relay service we run so that racers on different devices can race the same words at the same time. Here is exactly what travels:

  • Sent by your device. The four-letter room code. The racer's name, one word (the first word of the name a grown-up gave the racer, section 2), up to 16 letters, digits, apostrophes or hyphens, checked against a list of words that aren't allowed both on the device and by the relay; if the racer has no name yet or its saved name cannot be used in a room, the join screen asks for "a first name or nickname" and says that everyone in the room will see it. Newer versions also reject names that look like phone numbers or contact handles and hide unsafe names received from older room servers. The chosen world, the racer character and the dress-up items the racer is wearing (so the other racers see the same outfit). The racer's age band (one of three ranges, so a fair start can be applied and the words suit the youngest racer). The other devices in the room receive it. Whether it shows on a screen depends on the version the other racer is using, not yours: some versions of the iPad and Mac app show it as a small label beside each racer's name in the room (4 to 5, 6 to 7 or 8 to 9). Other versions and the browser game do not show it. For difficulty recommendations, a small typing-readiness number (1 to 26), calculated on the device from learned keys and recent accuracy. Other devices in the room receive this number so the room can suggest text everyone can handle; they do not receive the profile, learned-key list, past runs or accuracy values. Guests and older app versions omit it. Progress ticks: how many characters the racer has typed so far, how many slips, and the time since the green light, at most four times a second, plus the finish. If your racer is the host: the words setting and a random number every device uses to generate the same words. A random reconnect code the device makes up when it joins a room, so a racer whose Wi-Fi drops can come back; the same seat is held for 20 seconds; a newer relay can also recognize the reconnect code later in the same room and let that racer rejoin, including when the room is locked. The relay forgets the code when the racer leaves or is removed, and at the latest when the room closes.
  • Remembered on your device. Newer versions keep a temporary room ticket (room code, random reconnect code, seat number and room settings) so reopening the app or reloading the browser tab can recover a seat. If a saved racer name cannot be used in a room, a nickname chosen for that visit is kept beside the ticket without changing the saved racer name. The ticket and that nickname are cleared when the racer leaves, is removed, the room closes or recovery fails; in the browser they are also cleared when the tab closes. Naming a racer who has no name yet also saves its name with the profile (section 2). Older versions may keep the reconnect code only in memory.
  • Never sent. The letters typed, the words themselves, voice, chat, photos, an account, a device identifier, the child's exact age or birthdate, stars, detailed level history, past runs or accuracy values, or anything from the rest of the device.
  • Keeping scripts out. Opening and joining rooms is rate-limited by the relay: it allows only so many rooms at once and per hour in total, and only so many creations and joins per network address per minute and per day. That is the whole check for rooms: no account, no device attestation, no browser challenge, and nothing that could recognize the same device twice.
  • Who sees it. Everyone in the same room (people who have the four-letter code), including a "Big screen" view a teacher may show on a projector (names, outfits and lane positions). There are no public rooms, no room list and no way to find a room without its code.
  • What the relay keeps. The room's current state (the things listed under "Sent by your device" above: names, characters, outfits, age ranges, readiness numbers, ticks, reconnect codes and the rest) in that room's own small store on Cloudflare while the room is open, so a brief pause does not lose the room, and all of it is deleted when the room closes: after ten minutes without activity, when the last racer leaves, two hours after it opened at the latest, or if we switch rooms off. Apart from live rooms the relay holds two counts (rooms open, rooms created this hour) and a per-address rate limit kept in memory under a random salt and forgotten as soon as the limit refills; it writes no address to disk. It keeps no logs of names, room codes, IP addresses or messages (error logs carry a fixed code and nothing else), and Cloudflare's logging products are switched off for it. We keep no history of who raced whom.
  • Where it runs. On Cloudflare's Workers platform at rooms.bumpykeys.com, which carries the connection. Like any network carrier, Cloudflare sees your IP address and connection details while the room is open, under Cloudflare's privacy policy. We have no per-visitor analytics there.
  • On the Mac. The Mac version has permission for one kind of outgoing connection: this relay.
  • Grown-ups' controls. The host sees every racer's name as they join and can remove a racer or lock the room; Grown-ups → Online rooms has a switch that hides Race together entirely. Online races earn no stars. Bumper never speaks a name.

6. Sharing from the app

Two things can leave the device, and only when a grown-up sends them:

  • Share progress (Grown-ups → Racer's progress) draws a picture: the racer on its world, the racer's name if a grown-up typed one, stars, keys learned, this week's accuracy and speed, the date and our name. No birthdate, no photo, nothing else.
  • Send to another device (Grown-ups → Racers → the racer's page; on a Mac also Save as a file) makes a file of one racer (NAME.bumpyracer): that racer's name and progress, including the race log, the dress-up items and the counters in section 2, and nothing of the device (no purchase, no code, no settings, no PIN). On the other iPad or Mac, Add from a file reads it back in.

Each one is handed to your device's own share sheet (AirDrop, Mail, Files, or any app you pick), or on a Mac to a save panel, and goes only where you send it; from then on it is in that app's hands, not ours. We never receive a copy and are not told that you shared anything. The file is your family's: keep it, move it or delete it as you like.

7. The TestFlight beta

If you install Bumpy Keys through Apple's TestFlight, Apple's TestFlight service, not the app, collects crash logs, basic usage statistics and any feedback you send (including screenshots) and shares them with us, under Apple's TestFlight terms and privacy policy. Testers who join through our public link are shown to us without a name or email address. We use crash logs only to fix bugs and delete them when the bug is fixed. TestFlight is for grown-ups (Apple sets a minimum tester age): a parent or teacher installs the beta and the child plays under their supervision. You can stop at any time by deleting the beta.

8. The website and the browser game

  • bumpykeys.com is a set of static pages hosted on Vercel and delivered through Cloudflare's network. Fonts and images come from our own site. The marketing homepage uses Vercel Web Analytics for aggregate page views, referrals, approximate location, browser and device type. It uses no analytics cookies or advertising pixels. We remove query parameters and fragments from page-view URLs before sending them. Analytics does not run in the browser game, code redemption pages or native apps, and receives no racer names, typing or learning progress. See Vercel's analytics privacy documentation.
  • Like every hosting provider, Vercel and Cloudflare keep standard, short-lived server logs (IP address, browser type, pages requested, time) to run and protect the service. We do not use these logs to identify visitors. Cloudflare also supplies a website performance beacon that measures page loading, browser and device details. Its network-error-logging header may make your browser send Cloudflare a report if a page fails to load; that report carries the failing address and your IP.
  • The free typing tools. bumpykeys.com also has free typing games, tests and practice pages, such as the typing race and the typing test, and free word games and printable sheets, such as the word search maker. They run in your browser. Nothing typed in them, including a word list of your own, is saved or sent to us or to anyone else, and they have no accounts, no ads and no analytics of ours. Two of them, Type the alphabet and the quick brown fox typing test, keep a best time in this browser's own storage on that computer or tablet; clearing the browser's site data removes it. The others store nothing. Like every page on the site, they are served with the hosting logs and the performance beacon described above.
  • The browser game. play.bumpykeys.com is the full game, and the address bumpykeys.com/play opens it. It has no accounts and no analytics, and it sets no cookies. It saves your child's progress in this browser only, in the browser's own storage on that computer or tablet: the racers and their names, stars and levels, the settings, small notes the game keeps for itself (such as the random number it uses to suggest nicknames), the Grown-ups PIN as a salted hash if one was set, an unlock if there is one, or a class code that is waiting to be checked, with the random number a class code used (section 4), and whether you put off the install reminder. It also keeps a copy of the game's files so it works offline. None of it is sent to us, with two exceptions that sections 4 and 5 spell out: the random number travels with a class code when it is claimed, and joining a Race together room sends what section 5 lists, such as the racer's first name. Progress saved in one browser does not appear in another, and clearing the site's data in the browser deletes all of it.
  • What the browser game talks to. The game normally uses two hosts, both ours. play.bumpykeys.com, hosted on Vercel, serves the game's code, fonts, pictures, voice clips and sound effects. rooms.bumpykeys.com is contacted only to check or claim a code (section 4) and to make, join and run a Race together room (section 5). No third-party script, font or pixel loads in the game.
  • The teacher code-request form on /teachers opens your own email app with a pre-filled message; nothing is submitted to a server.
  • Links to the App Store, TestFlight, Apple support pages and the sources cited in our guides take you to sites with their own privacy policies.
  • Do Not Track / Global Privacy Control. The marketing homepage skips Vercel analytics events when your browser sends Do Not Track or Global Privacy Control. We do not use advertising trackers.

9. Email

If you write to [email protected], we receive your email address and what you wrote. Mail to that address is forwarded by our domain registrar's mail-forwarding service (Porkbun) to our mailbox. We use it to reply, to issue school or family unlock codes, and to fix problems you report. We keep it as long as we need to help you (for school codes, long enough to re-issue a lost code), and we delete it when you ask. We never add you to a mailing list and never share it.

10. Children

Bumpy Keys is designed for children ages 4 to 9, offered in the App Store Kids Category and meant to be used with a parent or teacher's supervision; the parent or guardian sets it up. We collect no personal information from children, so no parental consent for data collection is needed under the U.S. Children's Online Privacy Protection Act (COPPA) or similar laws. The parent gate exists to keep children away from purchases, settings and links, not to collect anything. A racer's name, if a grown-up typed one, stays on the device and is never sent to us. Online rooms show the other racers in that room one word, the racer's first name or nickname (and, on the versions of the app that show it, the racer's age range, section 5), and the relay keeps nothing after the room closes; a first name or nickname is not personal information under COPPA, and the app will not accept a first-and-last name in a room. A grown-up can switch rooms off in Grown-ups. In the versions that have a page where a child can type anything they like, what is typed is read aloud by the device's own speech engine and kept nowhere (section 3).

Schools: no student accounts, no student data, no education records are created, sent to or held by us, so there is nothing for a school to sign with us under FERPA. A teacher's own contact details, if they email us for codes, are handled as in section 9.

11. Your rights, wherever you live

  • Data from the app: we hold none. A room's state lives on our relay only while the room is open and is deleted when it closes. So there is nothing of yours for us to access, correct, export or delete; you hold it all on your device (sections 2 and 6).
  • Email we hold: write to [email protected] to see, correct or delete it. We answer within 30 days.
  • We do no profiling, make no automated decisions, and do not sell or share personal information.
  • EU, UK, Switzerland: Click Clack Labs is the controller for the email, the hosting logs and the live-room relay described above. Our basis for handling support email is your request (legitimate interest in answering you); for a live room, providing the race you asked for; for hosting logs, our providers' legitimate interest in running a secure service. Our providers are U.S. companies with global networks; they rely on standard contractual clauses and, where certified, the EU-U.S. Data Privacy Framework. You may complain to your local data-protection authority.
  • California: we do not sell or share personal information and are well under the thresholds that make the CCPA apply to a business; the Do Not Track statement is in section 8.

12. Security

There is no account to steal. Our relay holds no accounts and nothing that identifies a person; a live room's state is deleted when the room closes. On the device, the progress files use the system's data protection, the optional Grown-ups PIN is stored as a salted hash (never the digits) and never leaves the device, and its recovery is the device's own lock, checked by Apple and never seen by us; the website and the relay are served over HTTPS/WSS only.

13. Changes

If this policy changes, the effective date at the top changes with it and the new text is published here. A change that affects what leaves your device (for example a new feature that uses the network) will also be described in the app's release notes before it ships.

14. Contact

Click Clack Labs · [email protected] · bumpykeys.com

See also the Terms of Use.