Privacy notice
This notice is about the website tinyfingers.fi: who is responsible, what the website counts, which cookies and browser storage it uses, what happens when you play the video, and what you can do. The TinyFingers apps are a different matter, and they collect nothing.
Last updated:
Who is responsible
The website is run by Kim Asplund – Halfsky Publishing, the publisher of TinyFingers. Write to us about anything in this notice: privacy@tinyfingers.fi.
The apps
No TinyFingers app has ads, accounts or tracking, and none collects data about the child or the adult. This notice does not cover the apps.
What each Early Years app does is on the Data protection page, and the privacy policy of TinyFingers Paint is on halfskypublishing.com (TinyFingers Paint privacy policy).
The Early Years web demo is a page on this website, so this notice covers the page around it. The app inside it collects nothing; what the demo keeps in the browser is listed under the web demo on the Data protection page.
What the website counts
The website counts visits to see which pages are read. Two tools do the counting, and only under the consent rules further down.
Google Analytics
Google Analytics (measurement ID G-LVMKDME3ZN) counts page views, scrolls, clicks on links that leave the site and file downloads. It sets two first-party cookies, _ga and _ga_LVMKDME3ZN, which the table under “Cookies and browser storage” describes; Google’s documentation gives them a default lifetime of 2 years. Google keeps event and user data for 14 months. Google signals and ad personalisation are switched off, and the ad-related consent types are always denied: this website shows no ads.
Cloudflare Web Analytics
Cloudflare Web Analytics measures page loads and how fast they are, from the browser’s own performance data. Cloudflare says it does not track individual end users across its customers’ sites and that it collects only timing metrics (Cloudflare: data origin and collection), and that it does not use client-side state such as cookies or localStorage for analytics (Cloudflare blog, 9 December 2020: privacy-first Web Analytics).
When the statistics run
The website asks Cloudflare which country each visit comes from and uses that only to choose the rule below. We do not store it.
- In the EU and EEA, the United Kingdom, Switzerland, a few other countries and regions on our own list, and wherever we cannot tell where you are: nothing from Google or Cloudflare loads, and nothing is sent, until you choose Allow.
- Elsewhere, for example in the United States: the statistics start with the page, and a small bar tells you so once. You can decline.
- Global Privacy Control: if your browser sends it, we treat it as Decline everywhere, and ask nothing.
- Decline, or withdrawing later: Google Analytics stops at once and its cookies are deleted. Cloudflare’s counter cannot be unloaded from a page that has already started it, so it stops from the next page you open. A choice in one tab applies in your other tabs.
You can change your choice at any time with Statistics settings in the footer of every page.
Cookies and browser storage
Cookies, set by Google Analytics only after the consent rules above allow it. Lifetimes and purposes are as Google’s documentation gives them (Google Analytics help: cookie usage):
| Cookie | What Google says it is for | Default lifetime |
|---|---|---|
_ga | Used to distinguish users. | 2 years |
_ga_LVMKDME3ZN | Used to persist session state. | 2 years |
Apart from the video player (see The video on the Early Years and Paint pages), the pages of this website set no cookies themselves. Cloudflare says its Web Analytics uses no cookies or localStorage for analytics (see Cloudflare Web Analytics above).
Browser storage (localStorage) that the statistics keep on your device. You can delete it by clearing this site’s data in your browser:
| Key | What it holds |
|---|---|
tf.stats.v1 | Your statistics choice, “allowed” or “declined”, once you have made one. |
tf.stats.gpc | A marker, “1”, set when you chose Allow while your browser was sending Global Privacy Control. |
tf.stats.notice | A marker, “1”, set once the small statistics bar has been shown, so that it appears only once. |
The Early Years web demo keeps a few more keys for the app itself; they are listed under the web demo on the Data protection page.
The video on the Early Years and Paint pages
The pages TinyFingers Early Years and TinyFingers Paint Early Years show their video as a picture. The YouTube player loads only when you tap play; until then this website does not contact YouTube, and your statistics choice does not change that. The player comes from youtube-nocookie.com, YouTube’s privacy-enhanced mode.
From the tap on, your browser loads the player from youtube-nocookie.com. That request carries what any page load from that address carries: your IP address, details of your browser and, as the referrer, this website’s address (the origin only). This describes the request; what Google, which runs YouTube, does with that data is described in its privacy policy (Google Privacy Policy). YouTube may also store data on your device from then on, under Google’s own terms; the Google pages we read do not say whether the player stores anything on your device. Google says that in privacy-enhanced mode a view of an embedded video does not influence the viewer’s later YouTube browsing and that any ads shown are non-personalised (YouTube Help: privacy-enhanced mode). Google’s pages were read on .
Hosting
Cloudflare serves this website. To deliver the pages, Cloudflare processes your IP address and the details of each request, as any web server does (Cloudflare’s privacy policy).
Google and Cloudflare, and transfers
Google and Cloudflare process the statistics data for us. What each says today about transferring personal data out of Europe (their pages, read on ):
- Google says it complies with the EU-U.S. and Swiss-U.S. Data Privacy Frameworks and the UK Extension, that Google LLC has certified that it adheres to the DPF Principles, and that it relies on Standard Contractual Clauses where they are required and no adequacy decision applies (Google: legal frameworks for data transfers, effective August 23, 2025).
- Cloudflare says it relies on its certifications under the EU-U.S. Data Privacy Framework and on the European Commission’s Standard Contractual Clauses (Cloudflare: GDPR).
Your rights
Under data protection law you have rights such as asking what is held about you, having it corrected or deleted, objecting to its use, asking for it to be restricted and taking it elsewhere. You can withdraw your consent at any time with Statistics settings. Write to us at privacy@tinyfingers.fi.
You can also complain to the Finnish supervisory authority: Tietosuojavaltuutetun toimisto (Finnish), Dataombudsmannens byrå (Swedish), the Office of the Data Protection Ombudsman (English). tietosuoja.fi
Changes
If the website starts handling data differently, this notice is updated before the change takes effect, with a new date at the top.