Privacy

Last updated 25 October 2026

Tot Up is a free daily numbers game, made and run by one person in the UK. There are no accounts. Your phone makes a random player ID, and that’s what links your games to you. Tot Up keeps your games, your name if you choose one, and your council area if you use your location, but never your exact position. Your name and scores go on tables that anyone can see. Tot Up has no analytics and no ads. If it shows ads in future, you’ll be asked first if you’re in the UK, the EEA or Switzerland, and saying no won’t stop you playing.

If anything here isn’t clear, email hello@tot-up.com.

Who runs Tot Up

Tot Up is made and run by Darren Anderson, one person in the UK. I’m responsible for the personal data Tot Up uses, which makes me its “controller” under UK data protection law.

To ask about your data, use any of your rights or make a complaint, email hello@tot-up.com. It comes straight to me.

What’s kept on your phone

Tot Up keeps a few small things in your browser’s storage on your phone. This is local storage, not cookies: Tot Up itself sets no cookies. Each item is either needed for the game to work or remembers a choice you’ve made, so none of them needs your consent. Here’s the full list.

• Your player ID. A random code your phone makes the first time you open Tot Up. It goes with everything the game sends, and it’s what links your games, streak and leagues to you. Anyone who had it could play as you, so treat it like a password. totup:pid
• The round you’re playing. Your moves, kept until the round is checked. Then they’re deleted from your phone. If you leave a round unfinished, its moves are deleted the next time you open Tot Up two or more days later. totup:log:…
• Your settings. Light or dark theme, sounds on or off, and the league you looked at last. You can change the theme and sounds in Settings. totup:theme, totup:sound, totup:group
• What you’ve already seen. Whether you’ve played before, seen the intro, or been asked for your name, your area or reminders, and when you last saw the rest-day note. This stops the game asking twice. totup:played, totup:intro, totup:tried, totup:nameAsked, totup:areaAsked, totup:pushAsk, totup:restSeen
• Your arcade best. Your best arcade score. It never leaves your phone. totup:arcade:best
• A game from Tot Up’s old address. Only if you played there before Tot Up moved to tot-up.com. Opening the old address carries your game across inside the link, in a part that never reaches a server. If your phone had a game at both, the other one waits here until you pick which to keep. The copy at the old address stays until you clear it. totup:other, totup:standIn
• A link you opened. If you came in from a shared score or league link, Tot Up remembers that link until you close it. Session storage: totup:landing
• The reminder helper. A small script your browser keeps for Tot Up (a “service worker”). It’s there only to show the evening reminder, and it stores nothing. If you turn reminders on, your browser also keeps the details it needs to receive them.

If Tot Up shows ads in future, Google and its partners will use cookies too. See Adverts.

How long: until you clear Tot Up’s data on your phone. You’ll find it in your browser’s or phone’s settings, under site data or website data for tot-up.com.

Clearing it gives your phone a new player ID, and the old one can’t be got back. Your old games stay on Tot Up’s server, but nothing links them to your phone any more. If you want them deleted too, email me before you clear anything.

What Tot Up’s server keeps, and why

Tot Up’s server and database are run by Cloudflare. They keep:

• Your player record: your player ID, your name, a random public code that shows with your scores (see What’s public), when you started, your streak, best streak, rest days, best score and number of games, and your council area if you’ve used your location. Until you choose a name, your record has a made-up one, like Plucky Puffin, which the game doesn’t display.
• Your games: for each day you play, when each round started and ended, how long you took, your closest number, how far off it was, your points and your total. Each game also keeps the table it counted on. That’s your council area, or outside the UK, the city, region and country your connection is in.
• Your moves, only for a moment: they’re sent at the end of each round so the server can replay them and check your score. Then they’re thrown away.
• Leagues: each league’s name and code, who started it and when, and who’s in it and when they joined.
• Reminders, if you turn them on. See Reminders.
• Counts and averages, like how many people played in each area each day. These don’t say who anyone is.

Tot Up’s database doesn’t keep your IP address, though Cloudflare’s request logs do for up to 7 days (see Who else handles your data). Tot Up never asks for your email address, your age or anything else about you.

Why, and the law that allows it

• Running the game: dealing the numbers, timing rounds, checking scores, keeping your streak, and keeping Tot Up working, fair and safe from abuse. The law calls this legitimate interests: it’s needed to run the game you’ve chosen to play, in the way you’d expect.
• The tables, leagues and score links: legitimate interests. Comparing scores is the point of the game.
• Placing you on a table from your internet connection (outside the UK, and knowing you’re in the UK): legitimate interests. It puts you on a sensible table without asking you for anything.
• Your council area from your phone’s location: your consent, given when you tap Use my location and allow it on your phone.
• Evening reminders: your consent, given when you turn them on.
• Adverts, if Tot Up shows them: your consent, asked for in Google’s consent message.
• Tips: the name, email address and message Ko-fi passes on when you tip, so I know who’s tipped and can read your message: legitimate interests, and a legal obligation to keep records of income for tax.
• Answering your emails and complaints: legitimate interests, and a legal obligation where the law says I must answer.

Where Tot Up relies on legitimate interests, you can object. See Your right to object.

What you have to give

Only your player ID and your games, because the game can’t work without them. Everything else is up to you.

• No name: the tables show you as “Someone in” your area, or just “Someone”.
• No location: in the UK, your scores go on the Everyone table instead of your council area’s.
• No reminders: you won’t get a nudge, or the one-off 30 bonus points for turning them on.
• No to ad cookies, if ads come: you can still play.

Decisions made by computer

Your scores and your places on the tables are worked out automatically. That’s the game. Tot Up makes no other decisions about you by computer.

What’s public

Tot Up is a game of shared tables, so some of what you do is public. Anyone can look at the tables, without playing.

• The tables show your name, your score, how close you got in each round and your area or town. Weekly tables also show how many days you played. If you haven’t chosen a name, you show as “Someone in” your area.
• Score links: when you share your score, anyone with the link can see your name, score, how close each round was, your area, the day and how long you took. Chat apps such as WhatsApp show a preview with your name and score.
• Leagues: anyone with a league’s link or code can see its members’ names and scores, and can join it. Opening a league link joins you straight away. If you’re in a league, any score you share carries a league’s code (the one you looked at last, or else your busiest), so whoever opens the link joins that league too and can see its members’ names and scores. A league link’s preview shows the league’s name, how many have played today and the top score, with the leader’s first name if they’ve chosen one. You can leave a league in Settings.
• Your public code: each player has a random code that comes with their rows, so the same player can be recognised across tables, days and leagues. It isn’t your player ID and can’t be used to play as you.

So use a first name or a nickname, not your full name. You can change it in Settings. Once you’ve chosen a name you can’t blank it there, but you can email me to have it taken off.

Your location

Your area decides which table your scores go on. Tot Up can find it in two ways.

From your internet connection

Everything you send to Tot Up goes through Cloudflare, which works out roughly where your connection is: the country, region, city and a rough position. Tot Up uses this:

• Outside the UK, to put you on your city’s table. The city, region and country are kept with each game.
• In the UK, only to know you’re in the UK, which is all that’s kept. Your connection is never used to choose your council table, because on mobile data it often points to the wrong town.

UK games played up to and including 24 October 2026 may have been put on a town or council table going by the connection. They keep that table.

From your phone, if you choose

• It happens only when you tap Use my location. Your phone asks your permission the first time.
• Your phone rounds its position to about 100 metres before sending it.
• Tot Up finds the council area for that spot. It keeps the area and the time you set it, and throws the position away.
• It looks once. Tot Up doesn’t follow where you go, and only looks again if you tap the button again.
• If you’ve already started today’s game, the game moves to your new table.
• Outside the UK there are no council areas, so a council area you already have stays put.

To stop: tap Forget my area in Settings. Tot Up deletes your council area, and your next games go on the Everyone table (outside the UK, your city’s). Games you’ve already played stay on the tables they were played on. You can also turn location off for tot-up.com in your phone’s settings.

Reminders

If you turn reminders on, Tot Up sends you one nudge between 7pm and 10pm your time on any evening you haven’t finished the day’s game.

• Your phone asks your permission first. Then your browser’s push service gives Tot Up an address to send reminders to. Depending on your phone and browser, that service is run by Apple, Google, Mozilla or Microsoft.
• Tot Up keeps that address, two keys that come with it, your time zone (so it knows when it’s evening for you), when you turned reminders on, the last day it sent one, and how many have failed in a row. The keys aren’t used, because the reminder itself is empty.
• It also notes that you’ve had the 30 bonus points for turning reminders on.
• Each evening it sends an empty message through the push service. The words you see come from Tot Up on your phone, so the push service only sees that a reminder was sent.

To stop: in Settings, tap Turn off reminders. Tot Up deletes the address straight away. If you block notifications in your phone’s settings instead, the reminders stop showing. Tot Up then keeps the address until the push service says it no longer works, or until five tries in a row fail.

Adverts

Tot Up doesn’t show any adverts yet. I’m applying to Google AdSense to help pay for the hosting. Once that’s approved, Tot Up may show one advert at the foot of the results, Scores and home screens after the day’s game, from your second day of playing. There are never ads during a round or between rounds. The How to play and Sharpen your mental maths pages may show one between their sections.

You choose first

In the UK, the EEA and Switzerland, Google’s consent message will ask you before any ad loads. It’s Google’s own message, certified to the ad industry’s standard for consent (the IAB Transparency and Consent Framework). It names each company that may be involved, says what they’d use your data for and links to their privacy pages. You can say yes, say no, or choose company by company. Saying no doesn’t stop you playing. Google keeps your choice on your phone so you aren’t asked every time.

To change your mind at any time, open Settings and tap Privacy and cookie settings. That button will be there before any ads are.

Outside the UK, the EEA and Switzerland, Google may show personalised ads without asking. You can still opt out with the links below.

What happens when ads show

• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to Tot Up or other websites.
• Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visits to Tot Up and/or other sites on the internet.
• Google and other companies may place and read cookies on your browser, or use web beacons, IP addresses or other identifiers, to collect information as a result of ad serving on Tot Up. They use it, for example, to show and measure ads, to stop you seeing the same ad too often and to stop fraud.
• Other ad networks may also show ads on Tot Up through Google. In the UK, the EEA and Switzerland, Google’s consent message lists each one, with a link to its privacy page. Wherever you are, you can opt out of many of them at aboutads.info.
• Personalised ads involve profiling: Google and its partners use what they’ve learned about your browsing to guess what might interest you. If you say no, Google shows ads that aren’t based on your past browsing, though they can still depend on the page and your rough location.

Google and its partners also use this data for their own purposes, under their own privacy policies. Google explains this in How Google uses information from sites or apps that use our services.

Opting out

You can opt out of personalised advertising by visiting Google’s Ads Settings. You can also opt out of other companies’ use of cookies for personalised advertising at aboutads.info or, in the UK and Europe, at Your Online Choices.

Tips

The Buy me a coffee link opens Ko-fi’s tip page. It’s a plain link. Tot Up loads nothing from Ko-fi and sends it nothing about you, though, as with any link, your browser tells Ko-fi you came from tot-up.com.

If you tip, Ko-fi and its payment providers handle it under Ko-fi’s own privacy policy. Ko-fi tells me about your tip, as it does for any creator. That can include the name and email address you give it and any message you leave. Nothing links a tip to your game.

Who else handles your data

• Cloudflare runs Tot Up’s server, database and network, so everything on the server is stored with Cloudflare. It handles your IP address to deliver Tot Up to you, as any host does. It logs each request to Tot Up’s server for up to 7 days: the web address (which can contain your player ID), your IP address, the rough location Cloudflare works out from it, and the details your browser sends with it. It keeps copies of the public tables for up to a minute, to keep them quick. It also asks your browser to report failed connections to it, a standard feature called Network Error Logging.
• Your browser’s push service (Apple, Google, Mozilla or Microsoft), if you turn reminders on.
• Google and its ad partners, if Tot Up shows ads.
• Ko-fi, only if you choose to tip.
• My email provider, if you email me.
• Other players, who see what’s on the public tables.

Nobody else gets your data from Tot Up, unless the law requires it.

Data outside the UK

Cloudflare and Google are US companies, and so are the companies that run the push services. Cloudflare has computers around the world, so your data may be handled in the US and in other countries outside the UK. Cloudflare and Google are certified under the UK Extension to the EU–US Data Privacy Framework (the “UK–US data bridge”), which the UK recognises as protecting personal data sent to the US companies on it. To find out more about these safeguards, or about the push services’, or to get a copy, email me.

How long things are kept

Tot Up doesn’t delete your player record, your name, your games or the leagues you’ve started by itself. They’re kept for as long as Tot Up runs, so your streak, best scores and past tables stay right.

• Player record, name and games: for as long as Tot Up runs, unless you ask me to delete them.
• Leagues you’ve started: the same. A league can’t be deleted yet, even after everyone has left.
• Being in a league: until you leave it.
• Your council area: until you tap Forget my area, or until you use your location again and a new area replaces it.
• Reminder details: until you turn reminders off, or the push service stops accepting them. The note about your bonus stays with your record.
• Your moves and your phone’s position: not kept.
• Counts and averages: kept, but they don’t identify anyone.
• Cloudflare’s request logs: up to 7 days. Copies of the tables: up to a minute.
• Emails to me: for as long as I need them to deal with what you asked.
• Tip details from Ko-fi: only as long as HMRC requires records of income to be kept: five years after the 31 January tax return deadline for that tax year. Then I delete them.
• Things that are deleted: Tot Up’s database keeps a restore history, so a deleted item can still be recovered from it for up to 30 days. After that it’s gone for good.
• Things on your phone: until you clear them. See What’s kept on your phone.

To have your data deleted, email hello@tot-up.com. There’s no delete button in the game yet. Tot Up has no accounts, so I’ll need a way to find your record and be sure it’s yours. I’ll explain how when you get in touch.

Your rights

You have the right to:

• get a copy of your data
• have it corrected (you can change your name yourself in Settings)
• have it deleted
• have its use restricted
• object to how it’s used (see below)
• get your data in a form you can take elsewhere
• withdraw your consent at any time. This doesn’t affect anything done before. Use Forget my area for your location and Turn off reminders for reminders, both in Settings. For ads, once they start, use Privacy and cookie settings in Settings.

Some of these rights depend on the circumstances. To use any of them, email hello@tot-up.com. I’ll reply within a month.

Complaints

If you’re unhappy with how Tot Up uses your data, please tell me first at hello@tot-up.com. I’ll acknowledge your complaint within 30 days, look into it and tell you the outcome.

You can also complain to the Information Commission (ICO), the UK’s data protection regulator, at ico.org.uk/make-a-complaint.

Children

Tot Up doesn’t ask anyone’s age and doesn’t check it. Location stays off unless you tap the button. If you think a child has used Tot Up and you’d like their data deleted, email hello@tot-up.com.

Changes to this page

I’ll update this page before Tot Up uses your data in any new way. The date at the top shows when it last changed.

Last updated 25 October 2026