Privacy

TODO before publishing: confirm the legal entity name, registered address, effective date and minimum age below with a qualified adviser. Everything else on this page describes what the software actually does today.

Last updated: TODO · Effective: TODO

Who we are

KeystrokePro (TODO: legal entity name and registered address) is the controller of the personal data described here. For anything on this page, or to exercise any of the rights below, contact hello@keystrokepro.io.

What we collect

• Your account. Name, email address, whether that email is verified, an optional profile image, and your role. You sign in with an email and password, or with Google or GitHub if you choose to.
• Your typing. The characters you type during a practice session and the timing of each keystroke, plus the speed and accuracy figures derived from them. This is the product — it is what produces your stats, your weak-key analysis and your progress over time.
• Replays. A replay is a record of keystroke timings stored as data — it is not video, audio, or a recording of your screen or microphone. Replays are uploaded so you can review a session on another device. Replay sync is on by default and can be turned off at any time in settings; with it off, replays stay on your device.
• Progress and activity. Lessons completed, badges earned, league and competition results, and the texts in your library.
• Billing. Payments are handled by Paddle, which acts as the merchant of record — the seller for your purchase. Your card details go to Paddle, not to us, and we never see or store them. We receive transaction metadata such as the plan, amount, currency and status.
• Technical information. IP address, device and operating system, application version, screen size, language and time zone.
• Anything you send us, such as an email to support.

Why we use it, and on what basis

• To provide the service — your account, your typing history, syncing between devices, and your subscription. This is necessary to perform our contract with you.
• Analytics — only with your consent, which you give or refuse when asked and can change at any time.
• Security, fraud prevention and keeping the service working — our legitimate interest in running a service that is not abused.
• Legal obligations — for example, keeping records relating to tax.

Analytics, and how to say no

We use Google Analytics 4 to understand which parts of the product people use. It is switched off until you agree to it: on the website all storage and advertising signals are set to denied before anything loads, and the desktop app sends nothing at all until you opt in.

• We do not use Google's advertising features. Google Signals is off, and advertising personalisation signals are always denied.
• When you are signed in, we send Google a pseudonym — an irreversible keyed hash of your account identifier. We never send Google your name, your email address, your raw account identifier, or anything you type.
• The desktop app sends its analytics directly to Google, rather than through our servers. Google therefore receives your device's IP address.
• Analytics data is retained for 14 months.
• You can withdraw consent at any time — in the desktop app under Settings → Privacy, and on the website from the consent banner. Withdrawing also discards the analytics identifier held on your device.

Cookies

• kp_consent — remembers your analytics choice across keystrokepro.io and the web app, for six months. This one is necessary to honour your choice, so it is set either way.
• _ga and _ga_* — set by Google Analytics, and only after you accept.

AI-assisted coaching

Your practice results are analysed to generate coaching suggestions and your practice roadmap. This runs on Cloudflare's AI infrastructure as our processor. It is not used to train third-party models.

Who else processes your data

• Cloudflare — hosting, database, file storage and the AI coaching above.
• Google — analytics, and sign-in if you use a Google account.
• Paddle — payments and invoicing. As merchant of record Paddle is a controller of your payment data in its own right, under its own privacy policy.
• Resend — sending account emails such as verification and receipts.
• GitHub — sign-in, if you use a GitHub account.

We do not sell your personal data, and we do not share it for advertising.

International transfers

These providers may process data outside the UK and the EEA, including in the United States. Cloudflare, Google, Resend and GitHub act as our processors, and each sets out its own safeguards for those transfers: the European Commission's Standard Contractual Clauses, the Information Commissioner's Office's International Data Transfer Addendum for data protected by the UK GDPR, and in some cases certification under the EU–US Data Privacy Framework and its UK Extension.

Paddle is different: as merchant of record it is an independent controller of your payment data, and makes its own transfer arrangements under its own privacy policy.

How long we keep it

• Account and typing data: for as long as your account exists.
• Analytics: 14 months.
• Records we must keep by law, such as billing records, for as long as the law requires.
• When you delete your account we delete or anonymise your data within 30 days, except where we must keep it.

Your rights

Under UK and EU data protection law you can ask for a copy of your data, ask us to correct or delete it, ask us to restrict how we use it, ask for it in a portable form, object to processing based on legitimate interests, and withdraw consent to analytics at any time. Withdrawing consent does not affect anything done before you withdrew it.

Email hello@keystrokepro.io and we will respond within one month. If you think we have got it wrong you can complain to the UK Information Commissioner's Office at ico.org.uk, or to your local supervisory authority.

Children

KeystrokePro is not intended for children under 16. If you believe a child has given us personal data, contact us and we will delete it.

Changes

If we change this policy we will update the date at the top, and tell you in the app if the change is significant.