Privacy Policy for Typing Expert

Who we are

• Controller: Compli Tech OÜ, Republic of Estonia.
• Contact: use the Contact page on typing.expert, or email support@typing.expert.
• We have not appointed a Data Protection Officer because our core activities do not require one under GDPR Article 37. Privacy questions can be sent through the Contact page.

Information we collect

Depending on how you use the Application, we may process:

• Account data: email address, password hash (we do not store your password in plain text), interface language, optional leaderboard handle, and email-verification status.
• Progress data: lesson and speed-test attempts (speed, accuracy, typos, duration, completion date), course settings, streaks, and achievements.
• Technical data: IP address and browser metadata as processed by our hosting provider for security, rate limiting, and delivery of the Application.
• Guest progress: if you practise without an account, attempts are stored only in your browser (localStorage) until you sign in and choose to merge them.
• Communications: the name, email, subject, and message you send via the Contact form, plus transactional emails we send you (verification, password reset).

Legal bases (GDPR Article 6)

• Contract (Art. 6(1)(b)): creating and running your account, saving progress, sending verification and password-reset emails.
• Legitimate interests (Art. 6(1)(f)): securing the service (rate limits, fraud prevention), debugging, and understanding aggregated usage so we can keep the curriculum working.

How we use information

• To provide typing lessons, speed tests, progress tracking, and account features.
• To respond to Contact form messages and to send strictly transactional email. We do not send marketing newsletters unless we introduce that feature and ask for a separate opt-in.

Processors and recipients

We share personal data only with providers that help us run the Application:

• Cloudflare, Inc. — hosting, content delivery, Workers, D1 database, and related infrastructure (processing in the EEA and, where needed, the United States under Cloudflare’s transfer tools).
• Resend — delivery of transactional email.
• We may disclose data if required by law, court order, or to protect the Application and our users.

International transfers

Some processors are located outside the EEA. Where that happens we rely on an adequacy decision or the European Commission’s Standard Contractual Clauses, plus the provider’s supplementary measures.

Cookies

• Essential cookies: session cookies (tt_access, tt_refresh, tt_csrf) keep you signed in and protect against cross-site request forgery. The locale cookie (te-locale) remembers your interface language. These are necessary for the service.
• You can delete cookies in your browser. Blocking essential cookies will sign you out or reset language.

Retention

• Active accounts: we keep account and progress data while the account exists.
• Deleted accounts: we anonymise your email, clear the password, unlink social logins, and revoke sessions. Attempt rows may be retained without your email so we can honour fraud and integrity obligations.
• Guest localStorage: remains on your device until you clear it or successfully merge into an account.
• Contact messages: kept as needed to handle your request, then deleted or archived according to our support retention.

Your rights

• You may request access, rectification, erasure, restriction, objection, and data portability (GDPR Arts. 15–21).
• Download a copy of your account data from Account → Download my data, or ask via the Contact page.
• Delete your account from Account → Danger zone. This anonymises your profile and unlinks Google sign-in so you can register again later. It is not a complete wipe of non-identifying attempt history.
• You may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local EU supervisory authority.

Children

Typing Expert is intended for users aged 16 or older. We do not knowingly collect personal data from children under 16. If you believe a child has created an account, contact us and we will delete it.

Security

We use HTTPS, hashed passwords, hashed session tokens, and access controls on our database. No method of transmission or storage is completely secure.

Changes

We will post updates on this page and change the “Last updated” date. Material changes will be highlighted where reasonable.

Contact

Questions about this policy or your data: Contact page at typing.expert, or support@typing.expert.