Privacy Policy

TypingDuck ("we," "our," or "us") operates the TypingDuck website and application (the "Service"). This Privacy Policy explains what information we collect, how we use it, and the choices you have concerning your data.

Essential data supports your account and practice. Optional analytics and advertising are controlled through Privacy choices at the bottom of every page.

1. Information We Collect

1.1 Information you provide through OAuth sign-in

When you sign in with a third-party provider (Google or GitHub), we receive limited profile information from that provider, which may include:

• Your name or display name
• Your email address
• Your profile picture / avatar URL

We do not receive or store your password for any third-party provider. Authentication is handled entirely by the provider through the OAuth 2.0 protocol.

1.2 Typing session data

If you are signed in, we store data about your typing practice sessions, including:

• Words per minute (WPM) and accuracy metrics
• Session duration, character counts, and error counts
• Aggregate keystroke statistics (per-key accuracy and timing)
• The practice mode and language used

This data is used solely to provide you with progress tracking, performance analytics, and personalized feedback within the Service.

1.3 Automatically collected information

Like most web applications, our servers may automatically record standard log information such as your IP address, browser type, referring URL, and the date and time of your visit. This information is used for security, troubleshooting, and aggregate analytics and is not linked to your typing data.

1.4 Custom practice and connected repositories

We store extracted document text and saved drills so you can practice them later. Original uploaded files are processed in memory and are not stored. GitHub access tokens are encrypted and used only by our server to retrieve code you are authorized to access. Disconnect GitHub to remove the stored token.

2. How We Use Your Information

We use the information we collect to:

• Create and maintain your account
• Provide, operate, and improve the Service
• Display your typing performance history and analytics
• Process payments and manage subscriptions (if applicable)
• Send transactional communications related to your account
• Detect and prevent fraud or abuse

We do not send your typed content, uploaded document text, or private repository contents to analytics or advertising providers. Google advertising may use identifiers subject to your privacy choices and regional consent requirements.

3. Third-Party Services

We rely on the following third-party services to operate TypingDuck:

• Supabase — Authentication, database hosting, and backend infrastructure. Supabase processes your account information and session data on our behalf. See the Supabase Privacy Policy.
• Google — OAuth sign-in provider. When you choose to sign in with Google, your authentication is governed by Google's Privacy Policy.
• GitHub — OAuth sign-in provider. When you choose to sign in with GitHub, your authentication is governed by GitHub's Privacy Statement.
• Stripe — Payment processing for Pro subscriptions. Stripe collects payment information directly; we do not store credit card numbers. See the Stripe Privacy Policy.

Product analytics and advertising

With your analytics consent, PostHog receives account identifiers, practice summary metrics, feature usage, subscription events, and sanitized error categories. Session replay and automatic input capture are disabled. You can withdraw consent through Privacy choices.

Google AdSense supports free practice. Advertising is disabled for Pro users. Where required, Google’s certified consent message provides additional regional choices. Optional analytics and ad storage are disabled until permitted. See Google advertising information and PostHog’s privacy policy.

4. Cookies and Local Storage

We use browser cookies to manage your authentication session. Supabase sets authentication cookies to keep you signed in across page loads. We also uselocalStorage to persist your typing preferences (such as theme, mode, and settings) on your device. Optional PostHog and Google storage is controlled by your privacy choices. Pending session summaries and guided progress are kept on this device so failed saves can be retried. Rejecting optional storage does not prevent practice or sign-in.

5. Data Retention

We retain your account information and typing session data for as long as your account is active. If you delete your account, we will delete your personal information and session history from our systems within 30 days, except where retention is required by law or for legitimate business purposes (such as fraud prevention or financial record-keeping).

6. Data Security

We take reasonable measures to protect your information, including encryption in transit (TLS/HTTPS), secure authentication through OAuth 2.0, and row-level security policies in our database. However, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security.

7. Your Rights and Choices

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your account and associated data
• Object to or restrict certain processing of your data
• Export your data in a portable format

To exercise any of these rights, please contact us at the email address listed below. We will respond to your request within 30 days.

8. Children's Privacy

The Service is not directed to children under the age of 13 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take steps to delete such information promptly.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your own. Our service providers (Supabase, Google, GitHub, Stripe, PostHog) operate globally. By using the Service, you consent to the transfer of your information to these providers in accordance with their respective privacy policies.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by updating the "Effective date" at the top of this page and, where appropriate, through a notice within the Service. Your continued use of the Service after any changes constitutes acceptance of the updated policy.

11. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at:

Email: privacy@typingduck.com. Messages forward to typingduck@mail.com, which is also our reply address.