Privacy Policy

Last updated: May 26, 2026

1. Principles

Typing Musou ('this site') treats protecting user privacy as a core responsibility. This policy describes what information we collect, how we use it, how we manage it, and your rights. The Service is intended for users located in Japan, and this policy is operated in accordance with Japan's Act on the Protection of Personal Information (APPI) and related laws and regulations. The Service is open to users of all ages, but children under 13 must use the Service only with the consent and supervision of a parent or legal guardian. If a parent or guardian has concerns about how a child's personal information is handled, please contact us via the contact page.

2. Information we collect

We may collect the following information. Note that we do not store passwords; authentication is delegated to Google. For the handling of collected information when used to train AI models, please refer to Articles 3 and 6.

  • Google account information — upon Google sign-in, we receive the Google account identifier (sub), email address, display name, and profile picture URL. Not collected in guest mode.
  • Profile information — username, selected character/title/effect, avatar icon, and friend code. Configurable by the user.
  • Gameplay data — battle history (WPM, accuracy, win/loss, rating changes), dojo training sessions, owned items and in-game currency, transaction log, seasonal rankings, and friend relationships.
  • Inquiry content — category, message body, optional email address, and user agent, retained so the operator can reply.
  • Technical information & logs — IP address, browser/device info, access timestamps, and anti-cheat logs. Collected automatically for security and abuse prevention.
  • Access analytics data — via Google Analytics 4 (GA4) and Microsoft Clarity (Clarity), we collect page visits, time on page, viewport size, referrer, country/region inferred from IP address, and browser cookie IDs (GA4: `_ga` etc.; Clarity: `_clck`, `_clsk`, `MUID` etc.). Clarity additionally records session replays (mouse movement, clicks, scrolls, taps) and heatmaps. Text inside form inputs (including passwords) is masked client-side by Clarity and is neither transmitted nor recorded.
  • Cookies & local storage — used for login session management (NextAuth JWT), saving game settings, ad delivery, and access analytics (GA4 / Clarity).

3. Purposes of use

Collected information is used solely for the following:

  • Providing game features such as matchmaking, friends, leaderboard aggregation, and data sync
  • Authentication via Google, session management, and security
  • Detecting and responding to abuse such as cheating, macros, and rating manipulation
  • Improving service quality and considering new features
  • Responding to inquiries and sending important notices
  • Delivering and optimizing ads via Google AdSense and similar services
  • Access analytics, usage pattern understanding, and UX improvement via Google Analytics 4 and Microsoft Clarity (including drop-off and interaction-friction analysis)
  • Training, evaluation, and improvement of AI models operated within the Service (matchmaking CPU behavior optimization, typing-assist features, anti-cheat models, etc.)
  • Statistical analysis, academic research, and third-party sharing or publication of anonymized gameplay data, and use or provision as training datasets for machine-learning and artificial-intelligence models (see Article 6 for details)

4. Third-party disclosure & processors

We do not share personal information with third parties without user consent, except in the following cases:

  • When required by law
  • When necessary to protect life, body, or property
  • Disclosure to service providers required to operate the Service — including Google LLC for authentication, a self-hosted PostgreSQL database operated by the Operator on Oracle Cloud Infrastructure (Japan region) for primary data storage, Google AdSense for ad delivery, and Google Analytics 4 (Google LLC) and Microsoft Clarity (Microsoft Corporation) for access analytics. These processors handle data only to the extent necessary.

5. Transfer of personal information to third parties located outside Japan

Among the processors listed in Article 4, Google LLC and Microsoft Corporation are located in the United States. As part of the entrusted processing, certain personal information such as authentication identifiers, access logs, and interaction records may be processed on servers located outside Japan. Pursuant to Article 28 of Japan's Act on the Protection of Personal Information, we provide the following information.

  • Destination country — the United States of America.
  • Personal-data-protection regime in the destination country — The United States does not have a comprehensive federal personal-information-protection law equivalent to Japan's APPI; protection is provided through sector-specific federal laws (finance, healthcare, telecommunications, etc.) and state laws (such as the California Consumer Privacy Act / CPRA). For details, please refer to the 'Survey of foreign personal information protection regimes' published by Japan's Personal Information Protection Commission (https://www.ppc.go.jp/personalinfo/legal/kaiseihogohou/).
  • Safeguards taken by the recipient — Google LLC and Microsoft Corporation publish privacy protection programs aligned with OECD privacy guidelines. We confirm the contents of each provider's terms of service and data processing agreements (DPA) before entrusting data. Please refer to each provider's privacy policy for details (Google: https://policies.google.com/privacy / Microsoft: https://privacy.microsoft.com/).

6. Anonymously processed information — research use & third-party sharing

This site may statistically process collected gameplay data into 'anonymously processed information' as defined in Article 43 of Japan's Act on the Protection of Personal Information (APPI) — that is, information processed so that no specific individual can be identified and the original personal information cannot be restored — and may then sell, share, or distribute it to third parties, and use or publish it in academic papers, research presentations, public datasets, training datasets for machine-learning and artificial-intelligence models, and similar outputs. The aim is to contribute to research in typing skill development, esports, human–computer interaction, natural-language processing, and machine learning.

  • Categories processed — typing speed (WPM), accuracy, win/loss, rating trajectories, mistype patterns, play time distributions, dojo stage progress, and other statistical data derived from gameplay.
  • Items removed or substituted — Google account identifier (sub), email address, real name or display name, profile picture, IP address, username, friend code, inquiry content, and any other information that could identify a person are never included.
  • Disclosure on third-party provision — when anonymously processed information is provided to a third party, the categories of items provided and the provision method will be published on this page, and the recipient will be informed that the information is 'anonymously processed information.'
  • No re-identification — this site will not re-identify specific individuals by matching created anonymously processed information with other data.

7. Advertising, analytics & cookies

This site uses third-party ad networks such as Google AdSense, as well as access-analytics services Google Analytics 4 ('GA4') and Microsoft Clarity ('Clarity'). These services collect browser identifiers, access information, and interaction data through cookies and local storage.

  • Advertising (Google AdSense) — ad providers may use cookies based on prior site visits to display interest-based ads. Such cookies are controlled by the respective ad providers.
  • Access analytics (GA4) — measures page views, in-SPA navigation, and custom events (battle start/end, dojo, login, purchase, etc.). IP addresses are anonymized by Google. You can opt out of GA4 via the Google Analytics Opt-out Browser Add-on (https://tools.google.com/dlpage/gaoptout).
  • Session analytics (Microsoft Clarity) — records session replays (mouse movement, scroll, tap interactions) and heatmaps. Form input contents (including passwords and other personal information) are masked client-side and are neither transmitted to nor recorded by Microsoft. You can opt out of Clarity via your browser's tracking-prevention features or by blocking the `clarity.ms` domain.
  • Universal opt-out options — these analytics can also be disabled by clearing/blocking cookies, blocking third-party cookies, using private/incognito mode, or sending a 'Do Not Track' signal from your browser.

You can disable Google's use of cookies via Google Ads Settings.

8. User rights

Users have the following rights regarding their own personal information. Requests for disclosure and similar actions are accepted via the contact page. For identity verification, we may ask you to be signed in with the Google account associated with the relevant account or to provide equivalent verification. We will respond, in principle, within two weeks of receipt, via email to the address you specify (please indicate if you prefer a written response). There is no fee for disclosure-type requests. However, we may decline disclosure-type requests in any case falling under Article 33(5) of Japan's Act on the Protection of Personal Information (cases where disclosure would risk harm to the life, body, property, or other rights or interests of the data subject or a third party; cases where disclosure would significantly impede the proper conduct of this site's business; or cases where disclosure would violate other laws or regulations).

  • Request disclosure of retained personal data and notification of purposes of use
  • Request correction, addition, or deletion of content
  • Request suspension of use or of third-party disclosure
  • Request deletion of the account and related data (please contact us via the contact page)

9. Data retention & protection

Account and gameplay data are retained while the account is active, under encrypted transport (HTTPS) and appropriate access controls. Upon receiving a deletion request, we erase related data such as battle history, owned items, and friend relationships within 30 days of receipt. Note that leaderboard and battle records combined with other users' records may remain as anonymized aggregate data. Server logs are retained for up to 90 days; anti-cheat logs for up to one year; inquiry content is retained for three years after resolution. Data already anonymized and disclosed to or published by third parties under Article 6 cannot be technically re-identified and is therefore outside the scope of deletion requests.

10. Personal-information handler disclosure

The name and address of the personal information handler (Operator) for this Service (or, for a corporation, the corporate name, registered head-office address, and representative's name) and the complaint contact will be provided promptly when a data subject whose personal data is held by this site submits a request via the contact page and completes the identity verification set out in Article 8 (handling under Article 32(1) of Japan's Act on the Protection of Personal Information). We are unable to respond to requests from persons whose personal data is not held by this site. The complaint/inquiry window itself is the contact page linked at the end of this document.

11. Contact

For privacy questions, please use the contact page.

12. Changes to this policy

This policy may be updated to reflect legal changes or service updates. For significant changes, we will announce the updated content and the effective date on the site no later than 14 days before the effective date. Continued use of the site on or after the effective date constitutes acceptance of the updated policy.