Back to home

Privacy Policy

Last Updated: October 2026
Version: 1.5

This Privacy Policy explains how Eyal Lapid (“we”, “us”, or “our”) collects, uses, and protects your personal information when you use TypingPlace.

Note on current state: TypingPlace is a typing practice site with optional user accounts. You can practice without an account. When you practice, we store your practice rounds, described in “Practice data” below. If you are signed in, we also keep what we learn from them, described in “What we learn from your practice”. If you sign in, we keep a small account record, described below. We also process visitor analytics, security logs, and observability/error monitoring described in the “Information We Collect” section below.

Who We Are

Eyal Lapid is the data controller responsible for your personal information.

We are committed to protecting your privacy in accordance with applicable data protection laws, including the EU General Data Protection Regulation (GDPR).

Information We Collect

Information You Provide

You can create an account by signing in with Google. There are no passwords, and we
never see your Google password. When you sign in, Google tells us your Google account
ID, your email address, your name and your profile picture. We keep only your Google
account ID and email address; we don’t store your name or picture. We check the sign-in
response Google sends and don’t keep the tokens Google issues. Our use of information
received from Google follows the
Google API Services User Data Policy,
including its Limited Use requirements.

If you sign in, we store:

  • Account information: Your email address, when it was confirmed, and when the account was created
  • Sign-in tokens: Records of your signed-in sessions, so we can check them and end them
  • Google sign-in: Your Google account ID and the email address Google gave us, so we can recognize you next time
  • Look preference: Whether you chose the dark look, the light look, or your device’s setting
  • View settings: How you set up the practice screen
  • Communications: Messages you send to our support team

Practice data

When you practice, with or without an account, we store for each round:

  • The practice text we gave you, and how the practice screen was set up for that round
  • The typing timings of the round: each key you pressed while typing the round, when
    you pressed and released it, and whether your browser reported it as a real key press or
    a held-down repeat. We only record keys typed into the practice box
  • The result we calculated: your speed, accuracy, and the kinds of slips you made

If you are not signed in, your practice rounds are linked to the anonymous guest ID in
your session cookie (see the Cookies section), not to your name or email address. Guest
practice rounds are deleted 30 days after the round.

A round you start but never finish is deleted within about 2 days of when we gave it to you.

The typing timings of a round are deleted 365 days after the round. The round’s result
stays with your account.

If you sign in from the same browser you practiced in, your guest practice rounds move
to your account. Deleting your account deletes all of your practice data.

What we learn from your practice

If you are signed in, we learn from each practice session after it ends. A session ends
30 minutes after your last round. From the session’s rounds we work out and keep:

  • How you type each key: estimates of your typical press time and how often you miss
    it, compared with a typical typist.
  • How you type pairs of keys: estimates of how quickly you move from one key to the
    next, compared with a typical typist. We show these and the key estimates on your
    Progress page.
  • Letters that moved: when the layout you type puts a letter on a different key than
    your earlier layout did, how well you remember its new key and when it is due for more
    practice.
  • Where your fingers place each letter: for each letter on each layout you type, how
    often you pressed the right key and which other keys you pressed instead, so we can tell
    finger slips apart from habits carried over from another layout. Rounds where hints were
    shown are not used for this, and older counts gradually count for less.
  • Which sessions we learned from, with the number of rounds used.

We don’t learn from guest practice; guest rounds are used only after they move to your
account. These estimates come only from your own practice data. They stay with your
account and are deleted with it.

Boards and layouts

Adding a board is optional. You can keep practicing with the default keyboard without
providing board details. When you add one, we store your board names, keyboard shape,
layout names, key assignments, layer names, layout versions and per-board View settings.
We use these to draw your key tray, choose practice text that your layout can type, and
compare changes. Changes create a new version; earlier versions are not edited. A practice round
refers to the layout version it started with.

You can choose a standard layout, upload a Chrysalis file, or click to read your board
over USB and select it in the browser’s device picker. USB access is read-only: we ask
for the layout and firmware version, and do not change your keyboard. The layout codes
are sent to our server to build the saved layout. We do not keep the raw export,
uploaded labels or palette, or firmware metadata. Only the normalized layout and its
versions are kept; practice still records only typing inside the practice box.

Guest boards are linked to the guest ID in your session cookie and are deleted
30 days after their last use. Signing in from the same browser moves them to your
account, including their versions and preferences. Account boards remain until you remove them
or delete your account. Removing a board removes its layouts and versions.
Deleting your account deletes its boards, layouts and versions as well.

Information Collected Automatically

  • Usage data: Pages visited and features used
  • Device information: Browser type, operating system, device type, and screen size
  • Log data: IP address, access times, and referring URLs
  • Observability data: Error reports, performance telemetry, request metadata, and
    stack traces used to operate and secure the service. These reports may include limited
    request context needed to diagnose failures. We do not use observability tools to
    intentionally collect lesson or practice content.
  • Cookies: An essential session cookie for sign-in and for an anonymous guest ID
    (see Cookies section)

Visitor Analytics

We use Umami — an open-source, privacy-focused analytics tool — to understand how
visitors use TypingPlace. Umami runs on our own EU infrastructure (analytics.joinwith.com);
no third-party analytics provider processes this data. Our infrastructure sub-processors
may process hosting and network traffic as described in our sub-processor list.

What we collect:

  • Page URL (hostname and path; query parameters are discarded)
  • Referrer URL (the page that linked you here)
  • Browser type and version
  • Operating system
  • Device type and screen size
  • Language preference
  • Country, region, and city — derived from IP address; the raw IP address is not stored

How we count returning visitors without tracking you: Umami uses a server-side
hash salt to derive visitor identifiers from request data such as IP address and
user-agent. Raw IP addresses and user-agent strings are not stored in the analytics
database. These identifiers are used only for first-party aggregate analytics and do not
track you across other websites.

No cookies, no cross-site tracking, no advertising profiles. Umami does not set
cookies or persistent identifiers in your browser. We do not share visitor analytics
data with advertising networks or any third party.

Lawful basis:

  • GDPR (EU users): Article 6(1)(f) — legitimate interest in operating, securing, and
    improving our service. We have considered your rights and freedoms in a balancing
    assessment and concluded that this minimized, pseudonymous analytics processing does not
    override them. You have the right to object to this processing at any time (see “Your
    privacy choices” below).
  • Israeli PPL (Israeli users): processing is necessary for the operational provision and improvement of the service. You may opt out at any time (see “Your Privacy Choices” below).
  • CCPA (California users): we honor the Global Privacy Control signal as an opt-out
    request.

Retention: Aggregated visitor analytics data is retained for 24 months, after which it is deleted. This period allows year-over-year comparison of seasonal traffic patterns; aggregated data older than 24 months is deleted because it no longer serves a documented operational purpose.

How We Use Your Information

We use your information to:

  • Provide our service: Operate the platform and deliver typing practice pages
  • Accounts: Sign you in, keep you signed in, and remember your look preference and view settings
  • Practice: Give you practice texts, calculate your results on our servers, and show them to you
  • Progress: If you are signed in, learn from your finished practice sessions how you type each key and show you your progress
  • Boards: Save the keyboard layouts and preferences you choose so your key tray and practice text fit your board
  • Communicate with you: Respond to support requests and notify you of important updates
  • Improve and protect: Analyze usage to improve our service, fix bugs, and ensure security

We process current visitor analytics, security, and observability data based on our
legitimate interests in operating, securing, and improving the service. We process
account data, practice data and board data based on our contract with you. We may process data when necessary to comply with legal obligations.

What We Don’t Do

  • We do not sell your personal information
  • We do not use your data for third-party advertising
  • We do not make automated decisions that significantly affect you without human oversight

Information Sharing

We do not sell your personal information. We share data only with carefully evaluated
sub-processors to operate the service. The current list, including each sub-processor’s
purpose, location, and legal transfer mechanism, is published at
typingplace.com/legal/sub-processors.

We may also disclose information when required by law or to protect our rights.

International Data Transfers

Your data is primarily stored in the European Union (DigitalOcean). Some data is
transferred to the United States for processing by sub-processors listed at
typingplace.com/legal/sub-processors.

These transfers are protected by Standard Contractual Clauses approved by the
European Commission and Data Processing Agreements with each provider.

Data Retention

We keep your data only as long as necessary:

Account data: Retained while your account is active. Deleted within 30 days of account closure.

Practice data: Rounds never finished are deleted within about 2 days. Guest practice rounds are deleted 30 days after the round. The typing timings of a round are deleted 365 days after the round; its result stays with your account. All practice data is deleted with your account.

Learned estimates: Kept while your account is active and updated as you practice. Deleted with your account.

Board data: Guest boards are deleted 30 days after their last use. Account boards remain until you remove them or delete your account. Removing a board or deleting your account also removes its layouts and versions.

Consent records, if collected: Retained for 7 years as required by law, even after account deletion.

Security logs: Retained for 24 months for security and compliance.

Application logs: Retained for 90 days for service improvement.

If you delete your account, we remove your personal data within 30 days. Some data may persist in encrypted backups for up to 90 days before
being permanently erased.

Your Rights

You have the right to access, correct, export, or delete your personal data. If you
have an account, you can change your look preference in your account settings, and you
can ask us to delete your account. Deleting an account removes its email address,
sign-in tokens, linked Google sign-in, and practice data, including boards, layouts and versions and what we learned from your practice.

You can also remove the permission you gave TypingPlace in your Google account, at
myaccount.google.com/connections. Removing it
doesn’t sign you out, and doesn’t delete your TypingPlace account or its data; to delete
those, ask us to delete your account.

For requests we can’t handle through account settings—or if you have concerns about how we handle your data—contact us at privacy@typingplace.com. We respond within 30 days.

You can also contact your local data protection authority.

Cookies

TypingPlace uses one essential first-party Phoenix session cookie
(_typing_place_hub_key). It supports session integrity and CSRF protection, and it
holds:

  • Sign-in: If you sign in, a session token that keeps you signed in during your visit
  • Guest ID: If you are not signed in, a random anonymous guest ID. It is not linked
    to your name or email address

While you sign in with Google, it also briefly holds random values that tie Google’s reply
to your request.

TypingPlace does not use a remember-me cookie. This cookie is necessary for the service
and does not require consent. We do not
use advertising or tracking cookies. We do use cookieless visitor analytics, which does
not set cookies in your browser — see the “Visitor Analytics” section above.

Your Privacy Choices

You can opt out of visitor analytics at any time:

  • Global Privacy Control (GPC): if your browser supports GPC (e.g., Brave, DuckDuckGo, or Firefox with the appropriate extension), we honor the GPC signal as an opt-out request under applicable law (including California’s CCPA).
  • Do Not Track (DNT): if your browser sends the DNT: 1 header, our analytics tracker will not record your visit. Note: DNT support has been removed from current versions of Chrome and Safari; Firefox still exposes the setting.
  • Advanced — per-site browser flag: open the browser console on TypingPlace and run localStorage.setItem('umami.disabled', '1'). Your visits will not be recorded from that browser. Run localStorage.removeItem('umami.disabled') to re-enable.

We are adding a “Privacy preferences” UI toggle so this opt-out can be exercised without the browser console; until that lands, the three mechanisms above are the available paths.

TypingPlace also stores the typingplace-mode local-storage value when you choose a
light, dark, or system look. This preference stays in your browser until you change it
or clear site data. If you are signed in, your choice is also saved to your account.

When you practice without a selected board and are not signed in, TypingPlace stores
practice screen settings in the typingplace-view local-storage value and reads them
when the practice page connects. With a selected board, per-board View settings are
stored on our server for that guest or account; changing them does not overwrite the
browser preference used without a board. If you remove all boards, that browser preference is
used again. When signed in without a board, settings are saved to your account and
typingplace-view is no longer read or updated. An earlier copy stays in your browser
until you clear site data.

Security

We protect your data with:

  • Encrypted connections (HTTPS) for all data in transit
  • Encrypted storage for sensitive data
  • Sign-in with Google, so we hold no passwords
  • Regular security updates and monitoring
  • Access controls limiting who can view your data

No system is 100% secure. If you discover a vulnerability, please contact us at security@typingplace.com.

Children

TypingPlace is for users 18 and older. We do not knowingly collect data from anyone under 18. If we become aware that we have collected personal data from a person under 18, we will delete that data promptly.

Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes by email or through the app. Continued use after changes constitutes acceptance.

Contact

For privacy-related questions or to exercise your rights:

Email:privacy@typingplace.com

We aim to respond within 30 days.