Privacy Policy

Last updated: October 17, 2026

This policy explains what information typeflow collects, why, and how it's used. By using typeflow, you agree to the practices described here.

Information we collect

  • Account details — your username, email address (if you give one), and password (stored only as a secure hash), or your Google account email and name if you sign in with Google.
  • Typing activity — your test results (WPM, accuracy, duration), race history, streaks, daily targets and Daily test results.
  • Profile & customization — your bio, equipped themes, cursors, sounds, backgrounds, avatars, coin and gem balances, and privacy settings.
  • Social activity — friend requests, friendships, blocks, team memberships, profile visits, and the content of direct/group messages you send through the site.
  • Purchases — if you buy gems or subscribe to typeflow Plus, a record of the purchase (amount, gems credited, date, Stripe's payment and customer references, and your subscription's status and renewal date). Card details are entered on Stripe's own checkout page and never reach our servers.
  • Push notifications — only if you turn them on for a device: the push address your browser gives us for that device, so we can send it notifications. Turning notifications off deletes it.
  • Security logs — to protect accounts and the site, we log security events (failed and successful sign-ins, blocked requests, rate limits being hit, suspicious requests) with the IP address and browser they came from. These are kept for 90 days and used only for security. You can see your own recent sign-ins in Account settings.
  • Contact messages — the name, email address and message you submit through the contact form.
  • Usage analytics — for each page view: the page, the referring site, your browser's user-agent string, a coarse device type, and the country your IP address resolves to. Analytics never store your IP address; unique visitors are counted using a one-way hash that changes every day, so visits can't be linked across days.
  • Cookies — a session cookie to keep you logged in, a CSRF token to protect form submissions, and two preference cookies that remember your last typing-test settings and whether you've seen the first-visit warm-up. We don't use advertising or tracking cookies, so there's no cookie banner.

How we use your information

We use this information to operate core features: showing your stats and progress, running races and leaderboards, delivering friend requests and messages, and keeping your customizations and coin balance in sync across sessions. We use email addresses only for account emails such as password resets and replies to your contact messages. We don't sell your data or share it with advertisers.

Service providers

We rely on a small number of providers who process data on our behalf, only to run the site:

  • Railway — hosts the site and its database.
  • Stripe — processes gem payments and typeflow Plus subscriptions. Stripe handles your card details under its own privacy policy.
  • Google — only if you choose "Sign in with Google", to confirm your identity.
  • Brevo — sends account emails such as password resets.
  • Sentry — receives technical error reports when something breaks, so we can fix it. These exclude IP addresses, cookies and account details.
  • ipapi.co — receives a visitor's IP address to look up its country for our analytics. Analytics don't store the IP.
  • Browser push services (Google, Mozilla, Apple) — deliver notifications to devices where you turned them on. They receive the notification's text, not your account details.

Virtual currency

Coins and gems are virtual, have no cash value, and cannot be withdrawn, exchanged, or transferred outside the platform. See the Terms of Service for purchase and refund terms.

Sharing with other users

Your username, bio, typing stats, and equipped cosmetics are visible to other users on leaderboards and public profiles. Messages are only visible to participants in that conversation. You can limit who can message you and whether your recent profile visitors are shown in Account settings.

Data retention & deletion

We keep your account data for as long as your account is active. You can delete your account at any time from Account settings → Security. This immediately and permanently removes your profile, results, friendships, messages, balances and unlocks. Teams or group chats you created are handed to another member, or removed if no one else is left.

Anonymous analytics records are kept to understand overall traffic and aren't linked to you after deletion. You can also contact us to ask for a copy of your data, a correction, or deletion.

Children's privacy

typeflow is not directed at children under 13, and we don't knowingly collect personal information from them.

Changes to this policy

If this policy changes, we'll update the date at the top of this page.

Contact

Questions about this policy? Contact us.