Privacy notice
This notice says what personal data Typiano processes, why, for how long, and your rights, as the Swiss Federal Act on Data Protection (FADP) requires, and the EU General Data Protection Regulation (GDPR) where it applies.
1. Who is responsible
Loïc Berthod, Rte de Nax 43, 3979 Grône, Switzerland — contact@loicberthod.ch.
2. Without an account
You can play every piece without an account. Then no personal data is stored about you.
- Anonymous counts. The site counts, per piece and per day, how many times it is listened to, started, started again, finished, or stopped before the end (page left or started over, and at which quarter): numbers only, without any cookie or identifier. Purpose: knowing which pieces are used and where they get too hard, to improve them and choose the next ones.
- Anonymous visit counts, without cookies. Each page tells our own server (in Switzerland) which page was seen, for how long, at what hour, from which site you came (only its name, for example « instagram.com »), the tag of the link you followed if it has one (utm_source, utm_campaign, ref), and your device type (phone, tablet or computer), browser, system, language and time zone. To count a person once a day, the server makes a scrambled code from your IP address and your browser's identification string, mixed with a random key of the day; this code and the key stay in the server's memory only, are never written to disk, and are replaced with the first visit of each new day. Only totals per day are kept, never a list of visits or visitors. Your IP address is also used in memory for at most one hour to limit abuse. (Where the GDPR applies: legitimate interest, art. 6 para. 1 let. f GDPR.)
- In your browser. The stars you earn while logged out are kept in your browser (sessionStorage) until
you close the tab or log in; they are sent only if you log in or create an account. The keyboard layout you
choose is kept in your browser (localStorage,
ty_layout). In the administrator's own browser only, a mark (ty_me) keeps their visits out of the counts. - No tracking. No advertising, no analytics company, no social network plugin, no fonts or scripts loaded from another company.
3. With an account
One account for Typiano and Pianumero. Typiano and Pianumero are run by the same publisher on the same server, with the same accounts: you can log in on either site with the same email and password. What you play on each site is kept apart and shown on that site only.
| Data | Why | How long |
|---|---|---|
| Email address | To log you in; to answer you if you write | Until you delete your account |
| Name you choose | To greet you | Until you delete your account |
| Password | To log you in. Only a scrypt hash is stored, never the password itself | Until you delete your account |
| Progress: best stars, mistakes, time and number of plays per piece; the pieces you finish with their date; the site you played them on | To show your progress, recent pieces and streak of days | Until you delete your account |
| The site where you created the account | To count new accounts per site | Until you delete your account |
| Session (a random token; only its hash is stored) | To keep you logged in | 60 days, or until you log out |
| Date of your last visit | To count active accounts | Until you delete your account |
| Your answer to « Email me when new pieces are added » (yes or no, when, and where) | To email you only if you said yes, and to be able to show it | Until you delete your account |
| If you said yes: a random unsubscribe key | For the unsubscribe link in each email | Until you unsubscribe or delete your account |
New pieces by email — only if you ask. The box is not ticked unless you tick it, at sign-up or on your account page. Typiano's emails and Pianumero's are separate choices. Before the first email, we send one message to confirm that the address is yours; only then do we email you, about once a month at most, when new pieces are added: nothing else, no advertising for others. Every email says who sends it and has a link to unsubscribe in one click; you can also untick the box on your account page at any time. If we use an email-sending service, it will be named in this notice before the first email is sent. (Where the GDPR applies: your consent, art. 6 para. 1 let. a GDPR.)
Legal basis where the GDPR applies: the performance of the service you asked for (art. 6 para. 1 let. b GDPR). Your data is never sold, rented, shared with third parties or used for advertising. There is no profiling and no automated decision about you.
4. Security logs and backups
To protect the site, the server records failed logins and refused requests, with the IP address and, for a failed login, the email address that was typed. These records are erased after 30 days. The database is backed up every night on the same server, readable only by the administrator; each backup is erased after 14 days, so data you deleted disappears from the backups within 14 days. (Where the GDPR applies: legitimate interest in the security of the service, art. 6 para. 1 let. f GDPR.)
5. Who else sees your data
The site's administrator (Loïc Berthod) sees the list of accounts (name, email, dates, totals) to run the sites and answer you. The host, Infomaniak Network SA (Geneva, Switzerland), stores the data on our behalf as a processor. Nobody else. Your data is never transferred abroad: it stays in Switzerland.
6. Cookies and storage in your browser
One cookie only, pn_session, set when you log in: it keeps you logged in, is strictly necessary
for the account to work, is sent only to our own server (secure, not readable by scripts) and is deleted when you
log out. No cookie is set if you do not log in. The site also keeps in your browser the stars earned while logged
out and your keyboard layout (section 2). You can clear all of this at any time in your browser's settings.
7. Security
Encrypted connections (HTTPS with HSTS), passwords stored as scrypt hashes, sessions stored as hashes, limits on login attempts, access to the server restricted to its administrator, and a content security policy that lets no script from elsewhere run on the site.
8. Your rights
- Access (FADP art. 25): My data, on your account page, downloads everything your account holds, on both sites.
- Portability (FADP art. 28): the same download, in a common machine-readable format (JSON).
- Correction (FADP art. 32): change your name on your account page; for anything else, write to us.
- Deletion: Delete my account, on your account page, erases your account and all your progress on both sites at once.
- You can also write to contact@loicberthod.ch for any request; we answer within 30 days.
- You can complain to the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch) or, in the EU, to your national data protection authority.
9. Children
The site is for everyone and can be used without an account. A child under 16 should create an account only with the agreement of a parent or guardian.
10. Changes
If this notice changes, the new version is published here with its date.
Last updated 2026-09-28. Legal notice · Terms of use