Privacy Policy

This Privacy Policy explains how TypiTrain ("we", "us", or "our"), operated by Tobias Wetzel, collects, uses, and protects your personal data when you use our typing practice application at typitrain.com.

We take your privacy seriously and process your data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

By using TypiTrain, you agree to the collection and use of information as described in this policy.

The data controller responsible for your personal data is:

• Tobias Wetzel
• Email: contact[at]typitrain.com
• Website: typitrain.com

For any privacy-related questions or to exercise your rights, please contact us at the email address above.

We collect the following categories of personal data:

• Account Information: Email address, username, and encrypted password when you register. If you use Google Sign-In, we receive your email and name from Google.
• Typing Statistics: Your typing speed, accuracy, completed exercises, time spent practicing, and progress data.
• Class & Organization Data: If you join a class or organization, we store your membership, role (student/teacher), and related assignment data.
• Technical Data: IP address, browser type, device information, and access times when you visit our website.
• Error Reports: If an error occurs, our error tracking service may collect technical details about the error, including browser information and a session replay to help us diagnose issues.

We store some data locally on your device using IndexedDB for offline functionality and faster performance. This data stays on your device unless you sync it to your account.

Even if you do not create an account, we may collect and store non-account-linked typing data (such as typing patterns, speed, and accuracy) on our servers. We use this data in anonymized or aggregated form where possible to improve our service and train machine learning models. This data is not linked to a registered user account.

We use your personal data for the following purposes:

• To provide and maintain our typing practice service
• To track your progress and display statistics
• To enable class features for teachers and students
• To analyze learning progress and, where available, use model-supported functions to adapt exercises, estimate future learning development, and support educational evaluation within the agreed learning context
• To authenticate you and secure your account
• To diagnose and fix technical issues
• To improve our service based on usage patterns
• To send service-related notifications (if applicable)

The legal basis for processing your data is: (a) performance of a contract when you use our service, (b) legitimate interests for security and service improvement, and (c) your consent for optional analytics.

We use anonymized and aggregated data to improve our service through machine learning:

• Training algorithms to generate more effective typing exercises
• Analyzing learning patterns to optimize exercise difficulty
• Improving adaptive features that personalize your experience

For general service improvement and model training, we use anonymized or aggregated data where possible and do not use directly identifying account information such as email address or name. Model-supported features within a user account or school context may process typing, performance, and progress data for the agreed learning purposes described above.

You benefit from these improvements through smarter exercise recommendations and more effective learning progressions.

We use the following third-party services that may process your data:

• Supabase (supabase.com): Provides authentication and database services. Your account data and typing statistics are stored on Supabase servers in the Frankfurt, Germany (EU). Privacy Policy: https://supabase.com/privacy
• Cloudflare (cloudflare.com): We use Cloudflare for DNS, CDN/edge delivery, security, and reliable delivery of the website. Cloudflare may process technical access data such as IP address, request metadata, security events, and approximate country information. Core account and progress data are not stored with Cloudflare. Privacy Policy: https://www.cloudflare.com/privacypolicy/
• Resend (resend.com): We use Resend to send transactional emails such as account confirmations, invitations, and password resets through the Supabase SMTP configuration. Resend may process recipient address, email content, and delivery metadata. Privacy Policy: https://resend.com/legal/privacy-policy
• PostHog (posthog.com): With your consent, we use PostHog to understand how visitors use our site and track product engagement. This is optional and only activated if you allow analytics and tracking. Privacy Policy: https://posthog.com/privacy
• Microsoft Clarity (clarity.microsoft.com): With your consent, we use Microsoft Clarity to understand how visitors interact with our site through session recordings and heatmaps. This is optional and only activated if you allow analytics and tracking. Privacy Policy: https://privacy.microsoft.com/privacystatement
• Google Analytics (analytics.google.com): With your consent, we use Google Analytics 4 to understand website traffic patterns, user demographics, and how visitors find our site. IP addresses are anonymized. This is optional and only activated if you allow analytics and tracking. Privacy Policy: https://policies.google.com/privacy
• Google Sign-In: If you choose to sign in with Google, Google shares your email and name with us. Privacy Policy: https://policies.google.com/privacy
• Microsoft Sign-In / Microsoft Entra ID: If you choose to sign in with Microsoft or Azure, Microsoft shares the required identity data such as email address, name, and account ID with us. Privacy Policy: https://privacy.microsoft.com/privacystatement
• Google Fonts: We use fonts from Google Fonts, which may log your IP address. Privacy Policy: https://policies.google.com/privacy
• Sentry (sentry.io): We use Sentry for error tracking and performance monitoring. When errors occur, technical data (such as browser information and error details) may be sent to Sentry to help us fix issues. Sentry remains active for all users, including institutional accounts, as it is essential for maintaining service reliability and does not perform analytics or user profiling. Privacy Policy: https://sentry.io/privacy
• Stripe (stripe.com): We use Stripe to process payments. When you make a purchase, Stripe collects payment information (such as credit card number, billing address, and email) directly. We do not store your full payment details on our servers. Privacy Policy: https://stripe.com/privacy

We use cookies and similar technologies as follows:

• Essential Cookies: Required for authentication and basic functionality. These cannot be disabled.
• Analytics and Session Recording: Optional analytics and replay tools such as PostHog, Microsoft Clarity, and Google Analytics are only activated after explicit consent where required. These services are completely disabled for users signed in with institutional accounts (schools and organizations) — no analytics data is collected or transmitted.
• Local Storage: We use IndexedDB and localStorage for app functionality and settings. This data remains on your device.

You can manage your tracking preferences at any time in Settings, on the Trackers page, or by adjusting your browser settings.

We retain your personal data only as long as necessary:

• Account data: Kept while your account is active
• Typing statistics: Kept while your account is active
• Error logs: Retained for up to 90 days for debugging purposes

Inactive registered accounts may be deleted after an extended period of inactivity. We will attempt to notify you via the email associated with your account before any deletion.

Anonymized usage data from non-registered users may be retained indefinitely for service improvement purposes, or deleted at our discretion.

When you delete your account, all your personal data is permanently deleted immediately from our systems. Some anonymized or aggregated data that cannot identify you may be retained for statistical purposes.

Your data may be processed in countries outside your country of residence, including the United States and European Union, where our service providers operate.

We ensure appropriate safeguards are in place for international transfers, including Standard Contractual Clauses approved by the European Commission where required.

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit (HTTPS/TLS)
• Secure password hashing
• Row-level security in our database
• Regular security updates and monitoring

To protect the privacy and personal data of students and other users, we may temporarily restrict accounts, roles, permissions, or access to data where this is necessary to prevent unauthorized access, respond to a sufficiently substantiated suspicion of misuse, or maintain the confidentiality, integrity, availability, and resilience of our systems.

While we strive to protect your data, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

Under the GDPR, you have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data
• Right to Restriction: Request that we limit how we use your data
• Right to Data Portability: Request your data in a machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent for optional processing (like analytics) at any time

To exercise any of these rights, please contact us at contact[at]typitrain.com. We will respond within 30 days.

You also have the right to lodge a complaint with your local data protection supervisory authority if you believe your rights have been violated.

You can delete your account at any time through the account settings page. Upon deletion:

• All your personal data is permanently deleted immediately
• Your typing history and statistics are removed
• Any class memberships are terminated
• This action cannot be undone

We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new policy on this page and updating the 'Last Updated' date.

We encourage you to review this Privacy Policy periodically for any changes.

If you have any questions about this Privacy Policy or our data practices, please contact us at:

• Email: contact[at]typitrain.com
• Website: typitrain.com