Data protection

For your data protection officer

The TinyFingers Early Years editions are designed to collect, store and send no personal data, to have no accounts, no analytics and no ads, and to make no network connections. Each edition’s checked statement below confirms this for a named build. On that basis we receive no personal data from your organisation, and we do not expect a processor relationship between your organisation and Halfsky Publishing for the use of the apps.

We expect that no data protection impact assessment (DPIA) is needed. This is our description of the apps, not legal advice: confirm it with your own data protection officer.

This website is not the app: tinyfingers.fi counts visits with Google Analytics and Cloudflare Web Analytics, under the consent rules (read the privacy notice). The apps do not.

TinyFingers Paint privacy policy

Questions about data protection go to privacy@tinyfingers.fi.

Statement for each app

These statements describe the Early Years editions, not the apps for individuals that are sold separately for home use. Each statement names the build it was checked against. It appears only once that build exists.

The statement for TinyFingers Paint Early Years is published with its first build. Until then no checked statement exists.

The statement for TinyFingers Rescue Early Years is published with its first build. Until then no checked statement exists.

The web demo

The TinyFingers Paint Early Years demo that you can try in a browser is a separate build of the same app, made from its source code (TinyFingers Paint, feat/early-years 46a44d6). The statements above are for the builds supplied to organisations; this one is for the demo.

• The app is built to make no requests. The demo app itself is built to make no network requests: it sends no drawing, setting or touch anywhere. The demo page loads its files from tinyfingers.fi, and its content security policy lets the page reach only tinyfingers.fi and the hosts of the two statistics tools. Files: the page; scripts: 4; stylesheets: 2; icons: 2. A link or the email button does something only when an adult taps it.
• The page counts visits. One of the scripts and one of the stylesheets above are this website’s statistics. They count visits to the demo page like visits to any other page, under the same consent rules: in the EU and EEA, the United Kingdom, Switzerland, the other places on its list and wherever the country is unknown, nothing from Google or Cloudflare loads until Allow is chosen. The statistics script loads 6 further small scripts, and when allowed it loads Google Analytics and Cloudflare Web Analytics. The page’s content security policy allows the requests those two tools need and no others. The demo app itself sets no cookie; Google Analytics sets two when allowed. See the privacy notice.
• Stays on the device. The demo keeps the following in the browser’s localStorage, and none of it leaves the device:
  • tinyfingers_settings: the adults’ settings, saved only once an adult changes one: brush size, sound and instrument, canvas colour, dark mode, fading time, the side of the tools, pressure sensitivity, the adult check and hiding the Adults button.
  • tinyfingers_pin: only if an adult sets a PIN: a random salt and a hash of the PIN, never the PIN itself.
  • tinyfingers_pintries: after a wrong PIN: the number of wrong tries and the time until the keypad can be used again.
• Once per visit. After 15 minutes of use a small card offers to ask for an offer. The card is part of the page and sends nothing. A flag named tfEyPromptShown in the browser’s sessionStorage remembers that the card has been shown; it disappears when the tab is closed.

Clearing the browser’s site data for tinyfingers.fi removes all of this.

Open the demo