Privacy Policy

Effective September 28, 2026 · Version 2026-09-28

Outland.Work LLC operates KeyNinja at playkeyninja.com. This policy explains the information used to provide our typing lessons, game, accounts, and purchases. Contact brett@outland.work with privacy questions or requests.

Guest play and children

You can use the Dojo and try the game without signing in. Practice results, settings, free-run counts, and certain unlocks are stored in your browser. Please do not enter names, email addresses, or other personal information in typing exercises.

Accounts and purchases are for adults aged 18 or older using their own Google account. Children should play signed out with a parent or guardian supervising. We do not offer child accounts or a verified parental-consent process. An adult account is not a substitute for legally required parental consent to collect a child’s information. Do not use cloud saves to store a child’s activity. If a child’s information has been submitted, contact us so we can investigate and arrange deletion.

Information we process

• Accounts: Google account identifier, email address, name, and profile picture. Google handles your password. We do not store Google access tokens.
• Signed-in game data: free-run usage, stage and boss progress, WPM, accuracy, strikes, tokens, completed runs, and saved checkpoints. The Dojo keeps lesson progress locally.
• Payments: Stripe processes payment details. We receive purchase and subscription status, plan, customer and subscription identifiers, and information needed to connect a membership to an account. Our application does not receive full payment-card numbers.
• Service and security: requests pass through Cloudflare, which processes connection information such as IP addresses and request metadata to deliver and protect the service. Error logs may contain technical request details.
• Support: messages and information you choose to send us.

Why we use information

We use account and game data to sign adults in, save their progress, enforce free-play limits, and provide purchases. We use payment records for billing, fraud prevention, and accounting; technical information for delivery, security, and troubleshooting; and support messages to answer requests. Where a legal basis is required, these purposes rely on performing our agreement with you, legitimate interests in operating a secure service, or legal obligations, as applicable.

Cookies, local storage, and analytics

Essential first-party cookies maintain your login (normally up to 30 days) and protect Google sign-in (normally up to 10 minutes). Browser storage holds gameplay settings, progress, and purchase unlocks until cleared. Clearing it can reset local progress and the browser-only Armory Pass.

Automatic browser analytics and the visitor-event forwarding endpoint are disabled. The application removes its previous portfolio analytics identifiers when loaded. Previous versions collected random visitor/session identifiers, page paths, referral/campaign data, and interaction events through Outland.Work’s portfolio analytics service. Disabling collection does not itself erase earlier server records; contact us about those records. The current server sends subscription-start and cancellation events containing the plan and price, without account or visitor identifiers, to that service.

The application does not use advertising cookies, sell personal information, or share it for targeted advertising. It does not change its behavior in response to Do Not Track or Global Privacy Control because automatic browser tracking is disabled. Essential service requests still occur.

Who receives information

Cloudflare hosts the application and database; Google provides sign-in and serves the web fonts used on site pages (receiving connection information such as your IP address when fonts load); Stripe processes payments; and Outland.Work operates the service and subscription reporting. These providers process information necessary for their roles and may also process information under their own policies: Cloudflare, Google, and Stripe. We may disclose information when required by law, to protect rights or security, or in a business transfer subject to applicable privacy protections. Data may be processed in the United States and other countries where providers operate.

Retention and security

Account and cloud-save data remain until deleted; the current application does not automatically expire inactive accounts. We retain billing, acceptance, and support records as needed for the service, accounting, legal obligations, and resolving disputes. On a deletion request, we review what can be deleted and explain any required retention. Browser data remains until you clear it. We use access controls, HTTPS, and signed login cookies, but no system is completely secure.

Your choices and requests

You can play signed out, sign out on shared devices, and clear site data in your browser. Email brett@outland.work to request access, correction, deletion, or a copy of your information, or to object to or restrict processing where applicable. We may need to verify account ownership. Parents may contact us about a child’s information without creating an account. Do not send passwords or full card details. Deleting browser data or signing out does not cancel a paid subscription; see Billing & Help. Depending on your location, you may also complain to your data-protection regulator.

Policy changes

We will update the effective date when this policy changes and provide additional notice of material changes where required. New uses requiring consent will not be authorized merely by changing this page.