PRIVACY

What Typelesson keeps

Short version: without an account, nothing leaves your device at all. With an account, we store your practice progress and an email address so you can sign in. There is no advertising anywhere, and nothing you type is ever collected. There is one analytics script, and it does not load unless you accept it when asked.

If you do not sign in

Everything stays in your browser’s local storage — lessons completed, typing-test records, game scores, your streak, and your settings. None of it is transmitted anywhere. Clearing your browser data deletes it permanently, and we cannot recover it.

If you sign in

We store, in a Supabase database hosted in Mumbai (ap-south-1):

• Your email address — to identify your account, and for nothing else. No mail is ever sent to it: signing in happens entirely through Google, GitHub or Discord, and there is no newsletter, no confirmation message and no password to reset. It is never shown to anyone else and never appears on a leaderboard.
• A username, chosen the first time you sign in. Every account has one, and it is the only thing other people can see.
• Lesson progress — which drills you finished, per language.
• Typing-test results and game scores — speed, accuracy and the settings used.
• Your practice streak and the dates you practised.
• Your settings, so they follow you between devices.

None of those tables holds an IP address, a device fingerprint or a location, and we never record what you type — only the resulting score.

Results are not kept forever, and the rule is worth stating because it is enforced by the database rather than by anything you can see. Each account holds at most 1,000 typing-test results and 1,000 game scores; past that, a new result displaces your lowest-scoring one. Nothing else is pruned, and nothing is deleted on a schedule.

One qualification, because a flat “we store no IP address” would not be quite true. Supabase’s authentication layer, like essentially every authentication system, records an IP address and a browser user-agent against an active session and in its own audit log. Those are operational records rather than anything this site reads: nothing in Typelesson can see them, and they are never joined to your practice data. Session records are deleted along with your account; the audit log is not linked to your account at all and is pruned by Supabase on its own schedule.

The three ways to sign in, and what each one involves

All three are accounts you already have somewhere else, and there is no longer any option that avoids a third party. That is a real change and worth stating plainly: emailed sign-in links and passwords were removed, so every way in now tells somebody else that you signed in to this site and when.

The reason is not a preference. Sending a sign-in link or a password reset needs a mail service, and the one included with this site’s database manages a couple of messages an hour to its own team. Rather than run a sign-in that quietly fails for most people, the site uses accounts you already hold.

What each of them gets is identical, so it is written once: choosing one sends you there to authorise the sign-in, which means that provider learns you signed in to this site and when. It returns your email address and basic account information to Supabase. We ask for nothing beyond the email address, we never receive your password for that account, and their handling of the sign-in is governed by their privacy policy rather than ours.

• Google
• GitHub
• Discord

If you would rather no third party knew you use this site, do not sign in. That is a supported way to use Typelesson rather than a refusal: every lesson, test, game and setting works without an account, and what you do stays on your own device. The only things an account adds are the leaderboards and carrying your streak between machines.

One consequence of dropping passwords is worth knowing before you choose. Your Typelesson account is reached only through the provider you picked, so if you lose access to that account you lose this one, and there is no email fallback to recover it. Signing in with a provider you expect to keep is the whole of the advice.

Who else sees it

Leaderboards show a username and a number, plus an opaque account id the page uses only to mark your own row. No email address and no individual result is readable by anyone but you, and that is enforced by the database itself rather than by the app asking nicely.

Two service providers process data on our behalf for everyone: Supabase(database and sign-in — it sends no mail, because nothing here needs any) and Netlify (hosting). Google is involved in two unrelated ways, and it is worth separating them: its analytics runs only if you accept it, and its sign-in is used only if you choose it. Either one can happen without the other. GitHub and Discord are involved only for people who sign in with them, and only at the moment they do. Fonts are served from this site, so no font provider ever sees your visit, and there is no advertising provider of any kind.

Analytics, and the one cookie banner

The site uses Google Analytics, through Google Tag Manager, to count visits and see which pages people actually read. It is the only third-party script here and the only reason this site asks you anything on arrival.

It is not loaded until you accept. Not merely blocked from setting cookies — the script is not fetched, and Google is not contacted in any way, for anyone who declines or who has not answered yet. That is a deliberate step past the usual arrangement: Google’s consent mode loads the script for everybody and sends it an anonymous ping even in the denied state, which exists to model advertising conversions. This site has no advertising, so that ping would buy nothing and cost the plain sentence above.

If you do accept, Google receives:

• The pages you visit on this site, and when.
• Your IP address, which Google uses to derive an approximate location and then discards.
• Your browser, device type and screen size.
• Where you arrived from — a search engine, a link, or nothing.
• Cookies, in the _ga family, which recognise a returning browser.

What Google never receives, either way: anything you type. Not a practice word, not a test result, not your email address, not your username, not your score. The typing itself never leaves your device regardless of this choice, which is the same as it has always been.

Changing your mind. Use the button below — it takes effect on this device immediately, and you can switch back as often as you like. This used to say “clear this site’s data in your browser”, which is not a fair answer: withdrawing consent has to be as easy as giving it, and clearing your storage would also wipe your practice, your settings and your streak. Declining costs you nothing otherwise — every lesson, test, game and leaderboard behaves identically.

Deleting your data

Settings → Your data → Clear progress & scores wipes everything stored on this device.

To delete the account itself, open your account panel and use Delete my account. It removes the account, every result and score, your streak and your synced settings, immediately and permanently — practice saved on this device is left alone. The request carries no account id: the server deletes whoever the signed-in token belongs to, so it cannot be pointed at somebody else’s account.

If you cannot reach the panel for any reason, email the address below and it will be done for you. Either way the account is gone from the live database at once and cannot be restored. One qualification, because “permanent” on its own would overstate it: the database is dumped daily to an operational backup kept for thirty days, so rows from a deleted account can survive in those dumps until they age out. They are never read back into the live database except to recover from a failure, and after thirty days no copy remains.

Children

Typelesson is a typing tutor and may be used by students. We do not knowingly collect data from children below the age at which consent is required in their country. If you believe a child has created an account, contact us and we will delete it.

Contact

Questions, corrections or deletion requests: contact@typelesson.com

← Back to Typelesson