Privacy policy

1. What stays in your browser

Without an account, TypeCart saves your progress only on your device, in your browser’s storage. Nothing of it is sent to us. It holds:

• your test history and results, key statistics, lesson progress, game scores and practice progress
• your own custom texts — these never leave your browser, even with an account
• your settings and choices (such as your analytics choice and whether your device can show the 3D hands), and a few small notes that make the site work: when your settings last changed, so the newest change wins between your devices; during sign-up, whether to add this browser’s history to your new account; whether an account has signed in on this browser, so the header offers Sign in rather than Sign up; whether you hid the reminder to make an account; which coming-soon features you said you want, so a click isn’t counted twice; and, for the open tab only, the results of the lesson you just finished

You can download all of it, load it into another browser, or delete it under Settings → Your data. Clearing your browser’s site data deletes it too.

2. If you make an account

Accounts are optional and only for people aged 13 or older. When you sign up we keep:

• your email address, used to sign in and to send you a link to get back into your account when you ask for one
• your display name (2–24 characters)
• that you confirmed you are 13 or older
• your sessions: a sign-in cookie, and for each signed-in device its IP address and browser name, so a session can be recognised and signed out
• your typing results and lesson progress, including the keystroke timing of speed tests, which we replay to check a result is genuine; your key statistics, adaptive practice progress, placement test result and settings (except a few that belong to one device, such as the keyboard size); and, when races are open, your race results and rating

If you sign up or sign in with Google, Google tells us your email address, whether Google has verified it, your Google account id and your name. We keep the email, the account id (to recognise you next time) and your first name as your display name (you can ask us to change it). We don’t keep your Google profile picture or Google’s access tokens, and we ask Google for nothing beyond your basic profile — not your contacts, files or anything else. An account made with your email opens with Google only after you connect Google to it under Account, while signed in — and only a Google account with the same email; you can disconnect it there again.

Signed in, your results, lessons, key statistics, practice progress and placement result are kept with your account, and the pages read them from our servers; your browser keeps no copy of them — only, for a short while, a result it couldn’t send yet (it goes on the next visit). Per-second speed samples are not kept with your account. Your settings are kept both in the browser and with your account, so they follow you; the latest change wins. Signing in sends nothing that was already in that browser — that history stays in the browser, apart from your account. Signing up asks once whether to add the browser’s history to the new account. Custom texts and game scores stay in the browser. We use this data to run your account, to sync your progress between devices, and to keep results fair. Results our check refuses are kept for review, with the reasons, and may lead to a result being removed or an account being suspended (see the terms).

3. If you buy Pro

Pro is sold through Stripe, which acts as the seller (the "merchant of record", shown as "Sold through Link"): it takes your payment details, works out and collects sales tax or VAT, sends receipts and handles payment questions and refunds. Your card details go to Stripe only; we never see or store them. Stripe uses your data as its own privacy policy describes.

From Stripe we keep, with your account: Stripe’s ids for you as a customer and for your subscription, your plan (monthly or yearly), its status, when the paid period ends and whether you cancelled. We use them to turn Pro on and off and to answer your questions. Pro given by us without a payment is kept the same way, with its end date.

4. Feedback you send

The feedback form keeps your message, the type you chose, the page you were on, the app version, theme and language, and your email only if you give it. If you are signed in, it is linked to your account. To stop abuse we keep a scrambled key made from your account or IP address — not the address itself.

We may turn feedback into a task on GitHub, where we track our work. Such a task carries the text of the message only — never your email, name or account.

5. Coming-soon pages

Pages about features that are coming soon have an "I want this" button. A click adds one to a count for that feature; the count says nothing about who clicked.

Signed in, you can also ask for one email when the feature is out. We keep that request with your account, along with the language of the page, and send the email through Resend, the service that sends our other emails. Once it is sent, the request is deleted; you can take it back on the same page before then.

6. Error reports and server logs

When something breaks, on our servers or in your browser, we log what went wrong: the page’s address (without anything after a question mark), the error, your browser name and, if you are signed in, your account id. Logs never contain what you type, your email or your sign-in details. They are kept by Cloudflare for a few days and then deleted.

Like every website, our hosting provider sees your IP address with each request, to deliver the page and to protect the site from attacks.

To slow down break-in attempts and spam, we count sign-ins, sign-ups, requests to get back into an account, account deletions and error reports per IP address and per email address for a minute at a time. The counter (Cloudflare’s) gets a scrambled key made from the address, never the address itself, and we don’t store it.

Signing up, signing in, asking to get back into an account and sending feedback show a short Cloudflare Turnstile check that you are a person. Turnstile looks at your browser and IP address to tell people from bots, without cookies for tracking, and tells us only whether the check passed.

7. Analytics and cookies

We count visits to learn which parts of TypeCart people use, with two tools:

• Cloudflare Web Analytics — counts page views without cookies and without tracking you across sites. It is always on.
• Google Analytics — uses cookies, kept up to two years, to tell visits apart. In the European Union, the EEA and the UK — and anywhere we can’t tell your country — it starts only after you click Accept on the card at the bottom of the page. Elsewhere it is on unless you turn it off. You can switch it on or off at any time under Settings → Privacy; turning it off deletes its cookies.

We send Google page paths and events such as "a test finished", with the mode and a rough speed band, or "checkout started", with the plan — never what you type, your exact scores, your email or your account. Google’s ad features are off.

Two other cookies: one remembers your interface language (about a year), and one keeps you signed in (only with an account). Both are needed for the site to work and are never used for tracking.

8. Who else handles your data

We use a few companies to run TypeCart. They handle data only on our behalf:

• Cloudflare (USA) — hosting, our database, logs, Web Analytics, rate limits and the Turnstile check
• Resend (USA) — sends our emails, such as the link to get back into your account
• Stripe (USA) — sells Pro and handles payments, as described above; for your payment it acts as a seller in its own right, not only on our behalf
• Google (USA) — Google Analytics, and "Continue with Google" if you use it, as described above
• GitHub (USA) — our task tracker; it receives feedback text only, as described above

These companies may process data in the United States and elsewhere. Where the law asks for it, transfers from the EU and UK rely on the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses. Fonts and the 3D hands are served from our own site, not from Google Fonts or other third parties. Texts from Wikipedia are fetched by our server and served from our own site too: your browser never contacts Wikipedia, and nothing about you is sent to it.

We don’t sell or rent your data, and we don’t share it for advertising.

9. Why we may use it

Data protection law (the GDPR in the EU, the EEA and the UK) asks for a reason, a "legal basis", for each use of personal data. Ours:

• Your account, your results, syncing between devices and account emails — to give you the service you signed up for (a contract with you).
• Pro and payments — to give you what you bought (a contract), and to keep the records tax law requires (a legal obligation; Stripe keeps them as the seller).
• Error reports, server logs, rate limits, the Turnstile check and checking results for cheating — our legitimate interest in keeping TypeCart working, safe and fair. They keep as little as they can, as described above.
• Google Analytics — your consent in the EU, the EEA and the UK (and wherever we can’t tell your country); elsewhere our legitimate interest in learning which parts of TypeCart people use. You can turn it off at any time.
• Cloudflare Web Analytics — our legitimate interest in counting visits, without cookies and without tracking you.
• Feedback you send — our legitimate interest in answering you and improving TypeCart.
• The email when a coming-soon feature is out — your consent, which you give by asking for it and can take back on the same page.

10. How long we keep it

• Account data and results: until you delete your account or ask us to.
• Your plan and Stripe ids: as long as your account. Deleting your account ends a running subscription at once; Stripe keeps its own payment records as the law requires.
• Links to get back into an account: one hour, and used once.
• Sessions: until you sign out or they expire.
• Feedback: until it has been dealt with and is no longer useful, or until you delete your account.
• A request for the coming-soon email: until the email is sent, you take it back or you delete your account.
• Server logs: a few days.

11. Your choices and rights

Wherever you live, you can:

• download everything kept in your browser under Settings → Your data, and — when signed in — everything in your account under Account
• delete your account and everything stored with it under Account; it is removed at once
• ask us to correct your display name, email or anything else that is wrong
• turn analytics off under Settings → Privacy
• ask us anything about your data at support@typecart.app

If you are in the EU, the EEA or the UK, the GDPR also gives you the right to object to or restrict how we use your data, and to complain to your data protection authority. Why we may use each kind of data is in Why we may use it. We answer requests within one month.

12. Children

Accounts are for people aged 13 or older; sign-up asks you to confirm it. Anyone can use TypeCart without an account, and then nothing about them reaches us. If you believe a child under 13 has made an account, write to support@typecart.app and we will delete it.

13. Security

TypeCart is served only over HTTPS. No system is perfectly safe; if we learn of a breach that affects you, we will tell you as the law requires.

14. Changes and contact

When this policy changes, we update the date at the top, and for important changes we say so on the What’s new page and, if you have an account, by email.

Questions or requests: support@typecart.app.