Privacy Policy

1. Principles

Typing Musou, including its learning feature Joho Musou (typingmusou.com/joho) ('this site'), treats protecting user privacy as a core responsibility. This policy describes what information we collect, how we use it, how we manage it, and your rights. Joho Musou is provided by the same operator as Typing Musou and shares its accounts and in-game currency, so it is part of this site and this policy applies to it as well. Matters specific to Joho Musou are gathered in Article 13. The Service is intended for users located in Japan, and this policy is operated in accordance with Japan's Act on the Protection of Personal Information (APPI) and related laws and regulations. The Service is open to users of all ages, but children under 13 must use the Service only with the consent and supervision of a parent or legal guardian; the handling of children's personal information is set out in Article 12. The information we handle falls into two categories of a different nature. Because the rules that apply and the point of contact for disclosure and deletion differ between them, we distinguish them here at the outset.

• Information handled in the relationship between you and this site — your account, profile, gameplay records from battles and the dojo, inquiry content, and the like. This is information we collect and use for our own purposes, and we are the personal information handler responsible for it. Most of this policy concerns this category.
• Information handled under entrustment from a school — rosters, enrolment records, submissions, and grading records entrusted to us by a school or its founding body in connection with the school edition (classes, assignments, gradebook, Google Classroom integration, and so on). For this category the school is the personal information handler and we act as its processor. We do not use this information beyond the school's instructions and the scope of the service agreement. Details are set out in Article 11.

2. Information we collect

We may collect the following information. Note that we do not store passwords; authentication is delegated to Google. For the handling of collected information when used to train AI models, please refer to Articles 3 and 6. For the items relating to the school edition, please also refer to Article 11.

• Google account information — upon Google sign-in, we receive the Google account identifier (sub), email address, display name, and profile picture URL. Not collected in guest mode.
• Profile information — username, selected character/title/effect, avatar icon, and friend code. Configurable by the user.
• Gameplay data — battle history (WPM, accuracy, win/loss, rating changes), dojo training sessions, owned items and in-game currency, transaction log, seasonal rankings, and friend relationships.
• Joho Musou learning records — for each lesson or test taken in our learning feature Joho Musou (typingmusou.com/joho): start and finish times, stars, number of correct answers in tests, study time and number of attempts; for each attempt, how it went step by step (for each step or question: whether it was reached and answered correctly, the number of mistakes, how many hint levels were opened, whether the demonstration or the answer was shown, the time spent, the choices picked in word checks and the feedback messages shown — both limited to text written in the lesson materials —, the step at which an unfinished attempt stopped, and the general type of device used, such as Chromebook, iPad or Windows), together with the in-game currency awarded for them and the days on which you studied (used to show your daily goal and study streak). Study time counts only the time you were actively using the screen (see Article 13). We do not collect the contents of the spreadsheets, documents, or slides you build in the practice apps, or photos you place in them (these are kept only in your device's browser).
• Service usage — for Typing Musou, Joho Musou and Work Musou separately, when you first used it, when you last used it, and the days on which you used it. Collected to understand the number of users and to improve the Service.
• Polls and surveys in Joho Musou news — the option you chose in a poll, your survey answers, the record that you consented to answering a survey, and the in-game currency awarded as thanks. Taking part in polls and surveys is optional.
• Keystroke data — per-key attempt counts and miss counts (and the miss rates derived from them), together with keystroke records collected for research. The research records are typing-speed statistics (the mean and variance of the interval between keystrokes, per key and per pair of consecutive keys), per-key totals for each practice run (attempts, misses, keystroke intervals), and a record of each missed keystroke (the key expected, the key pressed, the previous key pressed, the character being typed, and the time since the start of the word). Collected in order to visualise which keys you struggle with, to suggest practice, and for the research use set out in Article 6. We do not record the text you type.
• Inquiry content — category, message body, an optional attached screenshot, your account and its email address if you are signed in, and user agent, retained so the operator can reply. For inquiries by email (the support address) or through our LINE Official Account, we keep the messages and images exchanged, together with the sender's email address or the LINE user identifier, display name, and profile image. For inquiries sent from Joho Musou we also keep the related lesson, for account-related inquiries the kind of problem and your previous username, and whether you allow the inquiry to be introduced on our official social media without your name. Replies to Joho Musou inquiries are shown on your own News screen.
• Technical information & logs — IP address, browser/device info, access timestamps, request records (access logs), and anti-cheat logs. Collected automatically for security and abuse prevention. Collected IP addresses may be queried against public registries such as WHOIS for the purpose of identifying the organization that administers the originating network.
• Access analytics data — via Google Analytics 4 (GA4) and Microsoft Clarity (Clarity), we collect page visits, time on page, viewport size, referrer, country/region inferred from IP address, and browser cookie IDs (GA4: `_ga` etc.; Clarity: `_clck`, `_clsk`, `MUID` etc.). Clarity additionally records session replays (mouse movement, clicks, scrolls, taps) and heatmaps. Text inside form inputs (including passwords) is masked client-side by Clarity and is neither transmitted nor recorded.
• Cookies & local storage — used for login session management (NextAuth JWT), saving game settings, and access analytics (GA4 / Clarity).
• [School edition] Information a student enters when joining a class — roster number and a display name used only inside the class. Entered by the student and editable by them at any time. Shown to teachers at the student's school and to the other students in the class; the in-class display name also appears in the school-wide ranking (see Article 11).
• [School edition] Information imported from a Google Classroom roster — only where a teacher has connected Google Classroom: the names of the students on that course roster, their school email addresses, their Google Classroom user identifiers, and the course name and identifier. Used to match the Google Classroom roster against enrolment in the Service, and shown only to the class teacher and school administrators. For a student who joins from that roster, however, the name on it becomes the initial in-class display name (see Article 11). If no connection is made, none of this is collected.
• [School edition] Teacher information entrusted to us at contract time — the names, work email addresses, and assignments (year group, subject, etc.) of teachers, provided to us as a roster when a school or its founding body enters into an agreement. Used to link a teacher to their school and classes when they sign in. We may hold this before the individual concerned has begun using the Service.
• [School edition] Learning and assessment records — assignment completion status and timestamps, whether an assignment was completed by its due date, the text of submissions together with a snapshot of the student's weak keys at the time of submission, scores and exemptions entered by a teacher and which teacher entered them, individual comments and returns from a teacher to a student, and notices a student sends the class teacher about the lesson-time battle restriction (chosen from three reasons, with no free text).
• [School edition] School and contract information — school name, prefecture, contract status and expiry, billing and payment records, and a history of operator actions (who did what, and when). Where a Google sign-in occurs on a school domain, we may also retain a hint used to infer that affiliation.
• [School edition] Credentials used to access Google Classroom — only where a teacher has connected Google Classroom: the email address and identifier of the Google account that granted consent, and the access grant issued by Google (a refresh token). Tokens are stored encrypted. We never collect these from students.
• Information received from Google APIs (Limited Use) — Typing Musou's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Information received from Google APIs (the identifier, email address, and profile picture received through Google sign-in, and information received through the Google Classroom integration) is used only for the purposes set out in Article 3; it is not used for advertising, for creating anonymized information under Article 6, or for training AI models, and it is not sold to third parties. The Google Classroom permissions we request and how to disconnect the integration are described in Section 15 of 'Handling of personal information in the school edition'.

3. Purposes of use

Collected information is used solely for the following:

• Providing game features such as matchmaking, friends, leaderboard aggregation, and data sync
• Authentication via Google, session management, and security
• Detecting and responding to abuse such as cheating, macros, and rating manipulation
• Investigating, recording, and responding to conduct prohibited by the Terms of Service (harassment, defamation, impersonation, posting inappropriate content, abuse of multiple accounts, etc.), including account suspension and corrective action. Such investigations may involve cross-referencing access logs, inquiry contents, and gameplay data
• Protecting the rights, property, and safety of this site, its users, or third parties; complying with legal obligations; resolving disputes; and responding to inquiries from law enforcement and other public authorities
• Keeping Joho Musou learning records (including carrying them over to other devices), awarding in-game currency for learning, showing your daily goal and study streak, and preventing the currency from being obtained improperly
• Improving Joho Musou lesson materials (tallying, for each question or step, how often it is answered correctly, how often hints or answers are shown, and where attempts stop, to find and fix confusing materials)
• Showing your own Typing Musou records (dates, practice menus, WPM, accuracy, time spent and frequently missed keys) in Joho Musou lessons as learning data for you alone (they are not shown to anyone else)
• Tallying polls and surveys in Joho Musou news and showing poll results (only the total count per option is shown; other users are never shown who chose what)
• Improving service quality and considering new features
• Responding to inquiries and sending important notices
• Checking reported problems using screenshots attached to inquiries, and — only where you have chosen to allow it — introducing an inquiry on our official social media without your name
• Access analytics, usage pattern understanding, and UX improvement via Google Analytics 4 and Microsoft Clarity (including drop-off and interaction-friction analysis)
• Training, evaluation, and improvement of AI models operated within the Service (matchmaking CPU behavior optimization, typing-assist features, anti-cheat models, etc.)
• Statistical analysis, academic research, and third-party sharing or publication of anonymized gameplay data, and use or provision as training datasets for machine-learning and artificial-intelligence models (see Article 6 for details)
• Screening usernames against the prohibited conduct set out in the Terms of Service (this involves sending the name to an external AI service; see Article 8 for what is sent, where, and how it is used for training)
• In the school edition: running classes, distributing assignments, aggregating and displaying progress, producing growth records, analysing weak keys, and supporting teachers in instruction and assessment (see Article 11 for details)
• In the school edition, where a teacher has connected Google Classroom: posting assignments to Google Classroom, returning grades, retrieving submission states, and posting announcements to the class
• Concluding, performing, and administering agreements with schools and their founding bodies (including contract status, billing and payment administration, and responding to inquiries)

4. Third-party disclosure & processors

We do not share personal information with third parties without user consent, except in the following cases:

• When required by law
• When we receive a statutory inquiry from law enforcement, a court, or another public authority (including an investigative inquiry under Article 197(2) of Japan's Code of Criminal Procedure and a bar-association inquiry under Article 23-2 of the Attorney Act)
• When necessary to protect life, body, or property (including where the Operator reports or consults with law enforcement regarding an incident in which this site or its users were harmed)
• Disclosure to service providers required to operate the Service — including Google LLC for authentication, a self-hosted PostgreSQL database operated by the Operator on Oracle Cloud Infrastructure (Japan region) for primary data storage, Google Analytics 4 (Google LLC) and Microsoft Clarity (Microsoft Corporation) for access analytics, OpenAI, L.L.C. for username screening, Google LLC for the Google Classroom integration in the school edition, Cloudflare, Inc. for relaying and protecting traffic, Zoho (Zoho Mail) and LY Corporation (LINE Official Account) for the inquiry channels, and Anthropic, PBC for assisting the Operator in answering inquiries, reviewing inappropriate usernames, and dealing with abuse (see Article 8). These processors handle data only to the extent necessary — except that content sent to OpenAI, L.L.C. is used to train that company's models (see Article 8).
• [School edition] Disclosure to teachers at the student's school — when a student joins a class, that student's learning records are shown to the class teacher and to other teachers at the school. This is the very purpose of the school edition, but from the student's own standpoint it is a disclosure to a third party, so we state it as a separate item. What is shown, and what is not, is set out in Article 11.
• [School edition] Disclosure to Google Classroom — where a teacher has connected Google Classroom, the content of assignments, the grade derived from that student's completion status, and — where the teacher chooses to do so — the text of announcements to the class are sent to the Google Classroom course managed by the school. The destination is an environment the school itself administers, and whether anything is sent depends on the teacher's action. Returning grades is optional per assignment and is off by default.

5. Transfer of personal information to third parties located outside Japan

Among the processors listed in Article 4, Google LLC, Microsoft Corporation, OpenAI, L.L.C., Cloudflare, Inc., and Anthropic, PBC are located in the United States. As part of the entrusted processing, certain personal information such as authentication identifiers, access logs, interaction records, usernames, traffic content, and inquiry content may be processed on servers located outside Japan. The same applies to communication with Google LLC for the school edition where a teacher has connected Google Classroom. Note that the database we operate is located in Japan (Oracle Cloud Infrastructure, Japan region): rosters, submissions, and grading records entrusted to us by schools are stored in Japan. Pursuant to Article 28 of Japan's Act on the Protection of Personal Information, we provide the following information.

• Destination country — the United States of America.
• Personal-data-protection regime in the destination country — The United States does not have a comprehensive federal personal-information-protection law equivalent to Japan's APPI; protection is provided through sector-specific federal laws (finance, healthcare, telecommunications, etc.) and state laws (such as the California Consumer Privacy Act / CPRA). For details, please refer to the 'Survey of foreign personal information protection regimes' published by Japan's Personal Information Protection Commission (https://www.ppc.go.jp/personalinfo/legal/kaiseihogohou/).
• Safeguards taken by the recipient — Google LLC, Microsoft Corporation, and OpenAI, L.L.C. publish privacy protection programs aligned with OECD privacy guidelines. We confirm the contents of each provider's terms of service and data processing agreements (DPA) before entrusting data. Please refer to each provider's privacy policy for details (Google: https://policies.google.com/privacy / Microsoft: https://privacy.microsoft.com/ / OpenAI: https://openai.com/policies/privacy-policy/). Note that content sent to OpenAI, L.L.C. is used to train that company's models (see Article 8). Cloudflare, Inc. and Anthropic, PBC also publish their policies on the handling of personal information (Cloudflare: https://www.cloudflare.com/privacypolicy/ / Anthropic: https://www.anthropic.com/legal/privacy). We use Anthropic, PBC's AI assistant tool with a setting under which inputs are not used for model training.

6. Anonymously processed information — research use & third-party sharing

This site may statistically process collected gameplay data into 'anonymously processed information' as defined in Article 43 of Japan's Act on the Protection of Personal Information (APPI) — that is, information processed so that no specific individual can be identified and the original personal information cannot be restored — and may then sell, share, or distribute it to third parties, and use or publish it in academic papers, research presentations, public datasets, training datasets for machine-learning and artificial-intelligence models, and similar outputs. The aim is to contribute to research in typing skill development, esports, human–computer interaction, natural-language processing, and machine learning.

• Categories processed — typing speed (WPM), accuracy, win/loss, rating trajectories, mistype patterns, play time distributions, dojo stage progress, and other statistical data derived from gameplay.
• Items removed or substituted — Google account identifier (sub), email address, real name or display name, profile picture, IP address, username, friend code, inquiry content, and any other information that could identify a person are never included.
• Disclosure on third-party provision — when anonymously processed information is provided to a third party, the categories of items provided and the provision method will be published on this page, and the recipient will be informed that the information is 'anonymously processed information.'
• No re-identification — this site will not re-identify specific individuals by matching created anonymously processed information with other data.
• Information entrusted to us by schools, and accounts that have joined a school class, are excluded — as set out in Article 1, information we handle under entrustment from a school (rosters, enrolment records, roster numbers, in-class display names, submissions, grades entered by teachers, teacher comments, and contract information) is excluded from the creation of anonymously processed information. This is information that should be handled only within the school's instructions, and we neither use it for research nor provide it to third parties, even in anonymized form. Accounts that have ever joined a school class are also excluded from the creation of anonymously processed information, research use, and third-party provision, including the gameplay records belonging to the account itself (battles, dojo, keystroke data, and the like); this continues to apply after leaving the class. This Article applies only to gameplay records belonging to accounts that have never joined a school class.

7. Analytics & cookies

This site uses access-analytics services Google Analytics 4 ('GA4') and Microsoft Clarity ('Clarity'). These services collect browser identifiers, access information, and interaction data through cookies and local storage.

• Access analytics (GA4) — measures page views, in-SPA navigation, and custom events (battle start/end, dojo, login, purchase, etc.). IP addresses are anonymized by Google. You can opt out of GA4 via the Google Analytics Opt-out Browser Add-on (https://tools.google.com/dlpage/gaoptout).
• Session analytics (Microsoft Clarity) — records session replays (mouse movement, scroll, tap interactions) and heatmaps. Form input contents (including passwords and other personal information) are masked client-side and are neither transmitted to nor recorded by Microsoft. You can opt out of Clarity via your browser's tracking-prevention features or by blocking the `clarity.ms` domain.
• Universal opt-out options — these analytics can also be disabled by clearing/blocking cookies, blocking third-party cookies, using private/incognito mode, or sending a 'Do Not Track' signal from your browser.
• Joho Musou pages — on the Joho Musou pages (under typingmusou.com/joho), we measure page views, in-app navigation, and interaction events (opening, finishing, and submitting lessons and tests, buttons pressed, locked lessons, settings changes, break reminders, consent to the terms, on-screen errors, page-speed metrics, and the like) with GA4, in a GA4 property separate from Typing Musou's. Along with these we send the account's internal identifier (including for guests), whether the account is a guest, and the plan type. Usernames and email addresses, stars, scores, and pass/fail results, answers and typed text, the contents of spreadsheets, documents, and slides built in the practice apps, and the text of inquiries and surveys are not sent to GA4. Clarity is not used. Cookies and local storage are otherwise used there to keep you signed in, to save your learning records and practice-app content, and to save settings.

9. User rights

Users have the following rights regarding their own personal information. Requests for disclosure and similar actions are accepted via the contact page. For identity verification, we may ask you to be signed in with the Google account associated with the relevant account or to provide equivalent verification. We will respond, in principle, within two weeks of receipt, via email to the address you specify (please indicate if you prefer a written response). There is no fee for disclosure-type requests. However, we may decline disclosure-type requests in any case falling under Article 33(5) of Japan's Act on the Protection of Personal Information (cases where disclosure would risk harm to the life, body, property, or other rights or interests of the data subject or a third party; cases where disclosure would significantly impede the proper conduct of this site's business; or cases where disclosure would violate other laws or regulations).

• Request disclosure of retained personal data and notification of purposes of use
• Request correction, addition, or deletion of content
• Request suspension of use or of third-party disclosure
• Delete your account — you can do this yourself at any time from "Delete account" in the settings screen. Deletion takes effect immediately and cannot be undone. Because you can carry it out yourself, we do not require identity verification for it; what is erased and what is retained is set out in Section 10 below.
• Point of contact for information we handle under entrustment from a school — as set out in Article 1, the school is the personal information handler for information entrusted to us in the school edition (rosters, enrolment records, submissions, grading records, and so on). Requests for disclosure, correction, or deletion of that information are, in principle, accepted through the school the student attends. Where such a request reaches us directly, we refer it to the school and act on the school's instructions. For information belonging to your own account (profile, gameplay records, and so on), we accept requests directly under this Article.

10. Data retention & protection

Account and gameplay data are retained while the account is active, under encrypted transport (HTTPS) and appropriate access controls. When you delete your account, everything under "What is erased" below is erased immediately. However, records that are bound up with other users' records, and records we must keep for a limited period to prevent abuse or to meet legal obligations ("What remains after deletion" below), are retained after being detached from information that identifies you, such as your name, display name, and email address. Data already anonymized and disclosed to or published by third parties under Section 6 cannot be technically re-identified and is therefore outside the scope of deletion.

• What is erased — your username, email address, and Google account identifier; rating, rank, and season records; battle history and results; owned items (characters, icons, titles, effects); Musou Coins and transaction history; character enhancements; friends and friend requests; dojo records; login-bonus state; keystroke data collected for research; Joho Musou learning records (per-lesson records, per-attempt details, study days, and in-game currency awarded); your Joho Musou poll votes and survey answers; Work Musou work records; and service usage records.
• What remains after deletion — your opponents' own battle records (your identifier is stripped from them); anti-cheat logs (up to one year); penalty records; reports (which are also a record for the other party involved); friend-referral records (counts only, to prevent repeat claiming of rewards); and inquiry content, including attached screenshots (three years after resolution, detached from your account).
• What remains after deletion if you use the school edition — your class enrolment record, roster number, submissions, assignment completion status, grades entered by teachers, and teacher comments. These are also the teacher's records, and deleting them would remove the enrolment itself from the roster and gradebook, leaving no way to tell who had left. The roster number is likewise kept so that the ordering of the roster holds. After account deletion your entry on the roster is shown as a deleted user.
• What is erased if you use the school edition — your in-class display name, any hint retained to infer school affiliation from a Google sign-in on a school domain, and any notices you sent about the lesson-time battle restriction. Names and school email addresses imported from a Google Classroom roster are erased when school data is deleted at the school's request (see Article 11).
• Server logs — retained for up to 90 days.

12. Children's privacy

We handle children's information with care, including where the Service is used in schools. The Service is intended for users located in Japan and is operated in accordance with Japan's Act on the Protection of Personal Information and related laws, but we also set out below our position on the standards expected internationally of a service supplied to educational institutions.

• No advertising — the Service displays no advertising of any kind, whether directed to children or otherwise. Nor do we use the information we collect for behavioural or other advertising purposes, or provide it to third parties for such purposes.
• No purchases by students — our in-game currency is virtual, cannot be exchanged for cash, and there is no facility to buy it with real money. No path exists by which a student can make a payment.
• Children under 13 — children under 13 should use the Service with the consent and supervision of a parent or legal guardian. Where the Service is used through the school edition, explanation to guardians and the collection of any consent required are carried out by the school, which stands in a position to decide on the use of educational tools on the guardian's behalf. In that case we handle information on the school's instructions, on the basis that the school has obtained guardian consent or is authorised to consent on the guardian's behalf.
• Our position under the US Children's Online Privacy Protection Act (COPPA) — we do not intend to collect personal information directly from children under 13 without the consent of a parent or of the school. Where the Service is used through a school, we act as an agent of the school and handle information only for the educational purposes the school specifies. Guardians may request review of their child's information, cessation of further collection, and deletion, through the school the child attends.
• Our position under the US Family Educational Rights and Privacy Act (FERPA) — the learning records and assessment records entrusted to us by a school are treated as education records under the school's control. We do not use them contrary to the school's instructions, do not disclose them to third parties without the school's authorisation, and on termination will delete or return them at the school's request (see Article 11).
• Inquiries from guardians — inquiries relating to the school edition are, in principle, accepted through the school the student attends. Where going through the school is impractical, please contact us directly via the contact page.

14. Personal-information handler disclosure

The name and address of the personal information handler (Operator) for this Service (or, for a corporation, the corporate name, registered head-office address, and representative's name) and the complaint contact will be provided promptly when a data subject whose personal data is held by this site submits a request via the contact page and completes the identity verification set out in Article 9 (handling under Article 32(1) of Japan's Act on the Protection of Personal Information). We are unable to respond to requests from persons whose personal data is not held by this site. For the school edition, because schools and boards of education must be able to complete their own review, we provide the Operator's name, address, representative, and complaint contact promptly in writing on request or on conclusion of a contract; that procedure is set out in Article 2 of 'Handling of personal information in the school edition' (https://typingmusou.com/en/school/privacy). The complaint/inquiry window itself is the contact page linked at the end of this document.

15. Contact

For privacy questions, please use the contact page.

16. Changes to this policy

This policy may be updated to reflect legal changes or service updates. For significant changes, we will announce the updated content and the effective date on the site no later than 14 days before the effective date. Continued use of the site on or after the effective date constitutes acceptance of the updated policy.