Four facts, then the details.
What it is
A touch-typing racer for ages 4 to 9 (K to 4): home row first, every finger taught, accuracy before speed. An iPad and Mac app (one App Store listing, id 6801967122, by Click Clack Labs) and the same game in any browser at play.bumpykeys.com for Chromebooks.
Classroom access
All 100 lessons are included. The browser includes Puppy Park and Dino Dash; existing players keep their original free world too. Classroom codes open extra worlds in the browser game. The iPad and Mac apps use Apple in-app purchases or Apple offer codes; browser codes do not unlock native apps. For device-assigned school apps, use the included world or the browser classroom option.
What it sends
Nothing about a child. No accounts, no analytics, no ads, no third-party code. One service we run, rooms.bumpykeys.com, counts class-code seats and carries the optional online rooms; it keeps the seat counts, a scrambled retry record for ten minutes, and nothing else. The full list is in Network footprint.
What you can manage
On iPad and Mac, manage online rooms and a quiet classroom. The browser also supports class codes. Grown-ups shows "Set by your school" beside managed restrictions. See Managed settings.
The privacy one-box.
Every sentence is backed by our privacy policy, effective 22 September 2026, and mirrors the questions districts ask. Paste it as it is; the PDF carries the same words for an attachment.
Bumpy Keys, Click Clack Labs, for your district's vetting form
Student accounts: none. No login, no roster, no SSO (no Clever, ClassLink or Google sign-in), no email, no birthdate, no photo. No student accounts or personal information are needed; the app runs on the device without any student data reaching our servers.
Data collected: none. App Store privacy label "Data Not Collected". No third-party SDKs, no analytics, no ads (App Store Kids Category, rated 4+, guideline 1.3). Progress (stars, levels, settings) stays in the app's container on the iPad; deleting the app, or Grown-ups, Start over, removes it.
Network: Native apps contact rooms.bumpykeys.com only for optional private online races. The relay carries a four-letter room code, one-word racer nickname, character, outfit and race progress while the room is open. Grown-ups can switch online rooms off. Apple handles native purchases, restoration and Apple offer-code redemption. The browser game also uses our service to claim classroom codes. See bumpykeys.com/tech-office for the complete host list.
COPPA: no personal information is collected, so no parental or school consent is required; a first name alone is not "personal information" under 16 CFR 312.2, and the app will not accept a first-and-last name in a room.
FERPA and Ohio SB 29: no education records are created, received or maintained by us; there is no contract and no school-issued device from us, so we are not a "technology provider" under ORC 3319.325(F), and there is nothing for your 1 August provider notice. If your district requires an agreement anyway, we will sign the Ohio NDPA with Exhibit B marked "None: No Student Data collected at this time" and Exhibit E (General Offer), so other districts can subscribe, and we will add an SB29 exhibit if your counsel asks.
Suggested registry status: Approved, In Use/No Agreement (No Data Collected). Product: Bumpy Keys. Developer: Click Clack Labs. Grades K to 4. Privacy policy: bumpykeys.com/privacy. Contact for inspection or questions: Brett Bejcek, [email protected].
Deployment: Install the App Store app through Apple School Manager Apps and Books by device assignment, with any supported MDM. iPadOS 17 or later is required. The included world contains all 100 lessons and works offline. Additional native worlds require Apple purchase access. Device-assigned apps cannot make in-app purchases. Classroom codes are for the browser game at play.bumpykeys.com and cannot unlock native worlds. Native managed configuration supports the onlineRooms restriction; it does not accept classCode.
Monitoring: the app adds no account, keystroke log or web activity to your SB 29 device monitoring notice; nothing a child types is stored or sent.
Accessibility and content: color and shape for every finger (color-blind safe); every prompt spoken; Reduce Motion honored; VoiceOver labels; a self-authored Accessibility Conformance Report (ITI VPAT 2.5) on request. No links out of the app except behind the parent gate.
Chromebooks: the full game plays in the browser at play.bumpykeys.com on any Chromebook (also Windows and Mac): every level, no accounts, no student data, works offline after the first visit. It uses the same service for a class code and for rooms. The iPad and Mac apps use Apple purchases for additional worlds; browser classroom codes do not transfer to them.
The SDPC row and the Ohio NDPA.
Suggested registry status
Approved, In Use/No Agreement (No Data Collected). Product: Bumpy Keys. Developer: Click Clack Labs. Grades K to 4. Privacy policy: bumpykeys.com/privacy. Contact: Brett Bejcek, [email protected]. This is the status districts on the Student Data Privacy Consortium registry give a resource that creates no student accounts and collects no student information; the wording "no student accounts or PII are needed" and "runs locally without any student data touching the vendor's servers" is the kind of reasoning those rows carry.
If your district requires an agreement anyway
We sign the Ohio NDPA v1 (or the National DPA for another state) with Exhibit B, the Schedule of Data, marked "None: No Student Data collected at this time", and Exhibit E, the General Offer of Privacy Terms, so other districts can subscribe to the same signature for three years. If your counsel asks for an SB 29 exhibit, we add it. Email [email protected] with the district name and the form comes back signed, price $0.
Ohio SB 29 (ORC 3319.325) defines a technology provider as a person who contracts with a district to provide a school-issued device and creates, receives or maintains education records under that contract. There is no contract, no device and no education record here, so there is nothing for a district's 1 August provider notice; a public registry row is still the normal way to record an approved, no-data app.
Every host the app or the web game ever contacts.
Derived from the code: every host name in the iPad and Mac app and in the web game, found by search, listed here, and kept from growing by a test. Fonts, pictures, voice clips and sound effects ship inside the app or come from our own host; nothing loads from a third party.
| Host | Used by | When | What travels, what is kept |
|---|---|---|---|
| rooms.bumpykeys.com | The iPad and Mac app, the web game | Browser only: when a class code is claimed (HTTPS). Both native and browser: while a Race together room is open (HTTPS and WSS). | The browser class code check: the ten letters, a random number the browser made up for that purpose and the platform name; the service keeps a count per code, and, for ten minutes, a scrambled copy of the random numbers it has just seen so a retried claim is not counted twice; nothing else, and the record is deleted a month after the code ends. Rooms: a four-letter room code, the racer's one-word name, character, outfit and race progress, deleted when the room closes; no logs of names, codes or addresses. Cloudflare Workers, run by us. |
| play.bumpykeys.com | The web game | On every visit; after the first, the service worker serves it offline. | The game itself: its code, fonts, pictures, voice clips and sound effects, all from this host. No third-party script, font or pixel. Vercel, run by us. |
| bumpykeys.com | The app, the web game | Only when a grown-up taps a link behind the Grown-ups hold (privacy policy, terms), or opens a class-code link (bumpykeys.com/code/...) we sent. | A web page in the browser; the site sets no cookies and runs no analytics. Vercel, run by us. |
| Apple's App Store | The iPad and Mac app | The install through Apple School Manager; a family's purchase or restore at home. | Apple's own traffic under Apple's privacy policy. A device-assigned app cannot make an in-app purchase, so on a school device it is the install alone. |
| checkout.stripe.com | The web game only | Only when a grown-up buys the family unlock in a browser, behind the Grown-ups hold. Never needed on a school device. | Stripe's hosted checkout page; we never see the card. |
If you filter by allowlist: bumpykeys.com, play.bumpykeys.com, rooms.bumpykeys.com (HTTPS and WSS), and Apple's App Store hosts for the install. On a school device no other host is contacted. Not on a school device: checkout.stripe.com, reached only when a grown-up buys the family unlock in a browser at home, behind the Grown-ups hold. With Allow online rooms off, the native app does not use our relay. The browser still contacts it when claiming a classroom code.
Optional email for grown-ups: the marketing site’s “email me a play link” form uses challenges.cloudflare.com (Cloudflare Turnstile) to prevent automated email requests. It is not loaded by the browser game or the native apps, and is not required to play.
The steps, in your console's own words.
Free app, device-based assignment, no Managed Apple Accounts on the iPads. The labels are the 2026 consoles'; the setting to look for is in bold.
Apple School Manager (the licenses)
- Sign in at school.apple.com and open Apps and Books.
- Search Bumpy Keys (Click Clack Labs) and open the iPad app.
- Under Buy Licenses, choose the location your MDM syncs, type the Quantity (one per iPad, a few spare), price Free, and click Get.
- The licenses reach your MDM at its next sync, usually within minutes. Device-based assignment is chosen in the MDM, not here, so the iPads need no Managed Apple Accounts. The Mac app is the same listing and is bought the same way.
Jamf School
- Apps, then Inventory: Bumpy Keys appears after the Apple School Manager sync (or Add App, Apps and Books, and search).
- Open it, then Scope: add the device groups for the classrooms.
- Choose Install automatically, not Self Service, and keep the licenses assigned to devices (the default).
- Optional, the managed settings: the app's App Configuration takes the dictionary from the AppConfig file; Jamf School can also draw the form from the file itself.
- Save. The app installs at the next check-in; no student taps anything.
Mosyle
- Management, Apps, then Apps and Books (Mosyle syncs the licenses from Apple School Manager).
- Find Bumpy Keys and Add it. In the profile choose Automatic installation (managed) and Device based licensing, then assign the device groups.
- Optional: Managed Configuration in the same profile takes the three keys (the dictionary in the AppConfig file).
- Save.
Jamf Pro
- Devices, Mobile Device Apps, + New, App Store app or VPP store app, search Bumpy Keys, Add.
- General: Distribution Method Install Automatically/Prompt Users to Install.
- Managed Distribution: tick Assign Content Purchased in Volume and pick the location; Jamf Pro assigns by device on iPads that support it.
- Scope: the device groups.
- Optional: the App Configuration tab takes the dictionary from the AppConfig file.
- Save.
Google Admin (Chromebooks)
- Devices, Chrome, Apps & extensions, Users & browsers.
- Pick the organizational unit (the grade or the room), then the yellow +, Add by URL, enter
https://play.bumpykeys.com/, Select. - Installation policy: Force install, or Force install + pin to ChromeOS taskbar. Save. The game installs as an app on every managed sign-in, with its icon on the shelf; it works offline after the first visit.
- If you filter with an allowlist: Devices, Chrome, Settings, Users & browsers, URL blocking: allow
play.bumpykeys.comandrooms.bumpykeys.com. Leave Autoplay alone; sound starts on a tap. - The class code on Chromebooks, the simple way: a Managed bookmark on the same Settings page to
https://play.bumpykeys.com/?code=MANGO-ROBOT(your code in place of MANGO-ROBOT). One click opens the game and claims the code, once per sign-in. Nothing to type. The teacher's class link (bumpykeys.com/code/MANGO-ROBOT) does the same from an email or a class page: kids tap it and play. To type the code instead: the gear, press and hold, Worlds, Teacher code. The silent way is the managed configuration below.
Seats. A class code covers a number of devices we set when we mint it (35 is the usual classroom). Each student sign-in on a Chromebook keeps its own copy of the game, so the code counts one seat per student sign-in there, not per Chromebook. Tell us the setup and the number of students when you ask for the code and we size it; a code that fills up says so on the screen and a second code is one email away.
Three keys, read on the device, sent nowhere.
The native app reads onlineRooms and classroomSound from com.apple.configuration.managed. The browser game reads the same two plus classCode through Chrome's managed configuration. A key you leave out leaves the device's own setting alone. A change lands live, no relaunch. Nothing is written back and nothing is sent. In Grown-ups, a switch the policy owns shows its value and the line "Set by your school". Browser classroom codes are issued to teachers. They cannot unlock the iPad or Mac apps.
| Key | Type | Values | What it does | Where a grown-up sees it |
|---|---|---|---|---|
classCode (browser only) | string | The browser classroom code from your teacher email. | Claims a browser seat and opens the worlds in the browser game. | Browser Grown-ups settings. Ignored by native apps. |
onlineRooms | boolean, or the words true / false | true or false; leave the key out, or empty, for the device's own setting | false hides and disables Race together rooms; Friends is the two-player race on one device. true keeps rooms available; the switch is still the school's. | Grown-ups, Online rooms: the switch shows the value and Set by your school. |
classroomSound | boolean, or the word true | true; leave the key out, or empty, for the device's own setting | true keeps music and key sounds off for a quiet classroom. Bumper's voice and the sound effects stay. Any other value does nothing. | Grown-ups, Sound, Music: the slider does not move and reads Set by school. |
iPad and Mac. The AppConfig file is in the AppConfig Community format (appconfig.org), bundle id com.bumpykeys.BumpyKeys: Jamf School, Jamf Pro, Mosyle and most MDMs draw a form from it. A form sends every field it shows, so the switch is a three-way choice there (Device's own setting, On, Off) and the form never forces a key you did not choose. A console that wants a raw dictionary instead takes the plist at the end of the same file; leave a key out of it for the device's own setting.
Chromebooks. Chrome hands a force-installed web app a managed configuration through the ManagedConfigurationPerOrigin policy: you host a JSON file like the example with your own code in it (the example sets the code and turns online rooms off), and the policy for https://play.bumpykeys.com carries the file's URL and its SHA-256 hash (the hash changes when the file does). The game reads it at launch and follows changes. If your console does not show that policy, the managed bookmark with the code in the link needs no policy at all and costs one click per sign-in.
What is not here, on purpose. No feedback dictionary, no reporting, no per-student setting. The age band, the volume and the hands choices stay with the teacher in Grown-ups, because a class is not one age.
The ticket, ready to paste.
Send this to whoever approves and installs apps in your district. Fill in the two brackets; the links carry the rest.
Subject: App request: Bumpy Keys (free typing game, K to 4) Hi [name], I would like Bumpy Keys on the [grade or room] iPads (or Chromebooks). It is a free touch-typing game for K to 4; ten minutes a day. What it is: Bumpy Keys by Click Clack Labs, App Store id 6801967122 (iPad, iPadOS 17 or later; the Mac app is the same listing), and the same game in the browser at https://play.bumpykeys.com for Chromebooks. Access: all 100 lessons in Puppy Park and Dino Dash. Classroom codes unlock extra worlds in the browser only. Native apps use Apple purchases and Apple offer codes. Student data: none. No accounts, no sign-in, no roster; App Store privacy label "Data Not Collected"; no analytics, no ads, no third-party code. The vetting answers: https://bumpykeys.com/tech-office#one-box (also a PDF there). Network: on a school device the app talks to one service the developer runs, rooms.bumpykeys.com, and nothing else (a grown-up's links behind the hold open bumpykeys.com). The full list: https://bumpykeys.com/tech-office#network Install: Apple School Manager, Apps and Books, device-based assignment (no Managed Apple Accounts), through our MDM; on Chromebooks, force-install https://play.bumpykeys.com/ from Google Admin. Steps with the button names: https://bumpykeys.com/tech-office#install Settings (optional): turn online rooms off on native devices. Browser configuration also supports our class code: https://bumpykeys.com/tech-office#managed Our browser class code: [the code from the teacher's email] Devices: [number] Thank you! [teacher]
Districts that want fixes before the App Store does.
The TestFlight beta at bumpykeys.com/testflight is the same app one build ahead of the store. TestFlight needs an Apple Account signed in on the device, so it suits a tech office's test iPad or Mac, not a cart: put the App Store build on the cart and the beta on the test device. Tell us your district at [email protected] and we flag your tester, so a fix you reported reaches you the day it is built.
Questions a form does not cover: Brett Bejcek, Click Clack Labs, [email protected]. We answer within a day; a signed NDPA within a week. Privacy policy, Terms, the teachers page.