Privacy Policy

Last updated: July 28, 2025

Itchy is a third-party mobile and web client for interacting with Scratch projects via TurboWarp, with features like mobile-friendly controls and MultiPlay (real-time collaboration). This Privacy Policy explains how Itchy handles your data and protects your privacy.

1. Account Information

Itchy does not allow users to create Scratch accounts. All accounts must be created via scratch.mit.edu. However, some Itchy features—like submitting mobile control schemes or joining MultiPlay sessions—require login with a Scratch account.

  • Your Scratch username and password are stored only in your device's encrypted local storage .
  • You can sign out at any time, which removes this data from your device.
  • Authentication and session tokens issued by Scratch are stored on your device in cookies to maintain login sessions. These tokens are never used for analytics or tracking and expire according to Scratch’s own rules.

2. ControlsDB

ControlsDB is a community-powered database of user-submitted mobile control schemes for Scratch games. This allows players to interact with keyboard-based projects on touchscreen devices.

When submitting a new control mapping to ControlsDB:

  • The app verifies that you are logged in to your Scratch account using your Scratch session token.
  • No username, password, or personally identifying information is sent to or stored by ControlsDB.
  • ControlsDB is operated by Micah Lindley, the lead developer of Itchy.

3. TurboWarp Integration

Itchy embeds TurboWarp inside a WebView to play Scratch projects. Additional JavaScript is injected to:

  • Provide touchscreen keyboard controls.
  • Enable MultiPlay peer-to-peer collaboration.

Any projects loaded or data sent through TurboWarp servers are governed by TurboWarp’s own privacy policy. Itchy does not modify TurboWarp’s storage or networking beyond UI integration and input simulation.

4. MultiPlay (WebRTC Communication)

MultiPlay allows users to collaborate in real-time by:

  • Streaming the Scratch project canvas (via canvas.captureStream) from the host device—no camera or microphone access is used.
  • Receiving control input (e.g., key presses) from remote clients via WebRTC.

All MultiPlay communication is:

  • Peer-to-peer and encrypted.
  • Facilitated through a signaling server (run by Micah Lindley) that connects devices but does not store or log any communication.

MultiPlay is restricted to users aged 13 and older in compliance with child privacy guidelines.

5. Cookies and Local Storage

Itchy uses on-device storage and cookies to store:

  • Your Scratch authentication token for session management.
  • Your Scratch credentials (encrypted) for persistent login.

This data is not shared, not used for tracking, and is deleted upon logout or app uninstallation.

6. Comment Moderation and Community Interaction

Itchy does not host or moderate user comments or community content. All comment functionality is part of the official Scratch platform and is moderated solely by the Scratch Team. If you encounter inappropriate content or behavior in comments, please report it through scratch.mit.edu.

7. Data Sharing and Retention

  • No WebRTC communication or authentication data is stored or shared externally.
  • ControlDB submissions use only the Scratch session token at the time of submission.
  • All local data (credentials, tokens) is stored only on your device and not synced to any cloud services.
  • Tokens expire according to Scratch’s session policies.

8. Children’s Privacy

Itchy is accessible to users under 13. However, to protect younger users:

  • MultiPlay is available only to users aged 13 and older.
  • Itchy does not collect or transmit personal information from any user.
  • Parental guidance is encouraged when children use interactive features.

9. Contact

For questions or concerns about privacy, contact:

Micah Lindley
[email protected]