Legal
Privacy policy
What Typolo collects, why, where it goes, and how to get rid of it.
Last updated 26 August 2026
Typolo is a typing trainer. It is not an advertising business, it has no tracking pixels from ad networks, and none of what follows is sold or shared for marketing. This page describes everything the site collects, in the order you would encounter it.
Who is responsible
Typolo is the data controller for everything described here — your account, your practice history, and the cookies this site sets. Creem is a separate controller for the payment data it holds; see their privacy policy for that. For anything about the data we hold, write to privacy@typolo.app — that address reaches a person, not a queue, and you can expect an answer within a month.
If you never sign in
You can use the trainer without an account, and most people do. On your first visit the site sets one cookie, typolo_visitor, holding a random identifier — no name, no email, nothing derived from your device. Its only job is to attach your finished attempts to something, so the site can show you your own score.
That identifier is not linked to anything else, is not shared, and disappears from your browser after a year or whenever you clear cookies. Clearing it makes you a new visitor with no history; nothing about the old identifier can be reconnected to you.
If you create an account
We store:
Your email address, so you can sign in and be sent a reset link.
The display name you choose, which is shown to you and nobody else.
A hash of your password — computed with scrypt. The password itself is never stored and cannot be recovered from the hash, by us or by anyone who obtained the database.
When the account was created, which plan it is on, and when that plan renews.
What a practice attempt records
This is the part worth reading closely, because typing trainers can be far more invasive than they need to be. When you finish an attempt, your browser sends the keystrokes and their timings to the server so the score can be computed there rather than trusted from the page. That log is used to calculate the result and then discarded. It is never written to the database.
What is kept is the summary:
Which text you practised, and how long the attempt took.
Words per minute, accuracy, first-try accuracy, characters typed, and error count.
How many times you uncovered a word.
A short list of the keys you mistyped most in that attempt — individual letters, so the app can tell you which ones to work on.
The words you typed are not stored. Nothing you type outside the trainer is ever seen by it: the page listens for keystrokes only while a practice attempt is running, and only on the practice screen.
If you subscribe
Payments are handled entirely by Creem (Armitage Labs OÜ, Tallinn, Estonia), the merchant of record and legal seller of your subscription. Card numbers never reach Typolo's servers. What comes back to us is an identifier for your customer record and your subscription, plus the renewal date, which is what lets the site know your plan is active.
Typolo sends three kinds of email and no others: a note when you create an account, a password reset link when you ask for one, and a confirmation when your password changes. There is no newsletter and no marketing list, so there is nothing to unsubscribe from.
Session recording
Neither runs unless you agree. Within the EEA and the UK you are asked before anything is loaded — decline, or simply never answer, and the scripts are not fetched at all, so none of the storage below ever exists. You can change your mind at any time from the cookie policy, and withdrawing also clears what was stored.
OpenReplay records a sample of sessions so we can watch back where the interface confuses people. Input values are obscured rather than recorded, network request and response bodies are never captured, and the sign-in, password reset and account pages are excluded entirely — the same list that is kept out of search results, for the same reason.
Exactly what each stores in your browser, name by name, is listed on the cookie policy. That list is what we observed on a live page rather than copied from a vendor's documentation.
Who else sees any of this
Only the services needed to run the site, each acting on our instructions:
Vercel
Hosting and delivery of the site itself. United States and global edge network. Requests to the site, including IP address, in short-lived operational logs.
Neon
The database holding accounts and attempt scores. Frankfurt, Germany (EU). Your email, display name, password hash, plan, and your attempt scores.
Creem (Armitage Labs OÜ)
The merchant of record — the seller of your subscription, not a payment gateway. Tallinn, Estonia (EU). Your payment details, which go to Creem directly and never reach us, plus your billing email.
Resend
Sending the three emails this site sends: welcome, password reset, password changed. United States. Your email address and the contents of those messages.
OpenReplay
Session replay — watching back where the interface confuses people. OpenReplay cloud. A recording of what happened on the page. Input values are obscured and request bodies are never captured; the sign-in, password reset and account pages are never recorded at all. Only after you agree. Only with your consent.
Amazon Web Services (S3)
Storing and serving the narration audio. Frankfurt, Germany (EU). No account data. Your browser requests audio files directly, so AWS sees the request.
Nothing is sold, rented, or handed to advertisers. Data would be disclosed to an authority only where the law actually requires it.
How long it is kept
Anonymous attempts: kept while the visitor cookie lasts, up to a year.
Account and attempt history: kept while the account exists.
After you delete your account: the account and its attempt history are removed. Records of payments are kept as long as tax law requires — that obligation sits with Creem as the seller.
Server logs: short-lived operational logs held by Vercel.
Your rights
If you are in the EU, the UK, or another jurisdiction with comparable law, you can ask for a copy of your data, have it corrected, have it deleted, have it exported in a portable form, or object to a particular use of it. Write to privacy@typolo.app and expect an answer within a month. You can also complain to your national data protection authority.
The legal grounds, briefly: your account and subscription are processed to perform the contract you entered into; attempt scores and basic security logging rest on our legitimate interest in making the product work and keeping it up; nothing here relies on consent, because nothing here is marketing.
Children
Typolo is not directed at children under 13, and accounts are not knowingly created for them. If you believe a child has created one, write to us and it will be removed.
Getting in touch
Data questions — a copy, a correction, a deletion — go to privacy@typolo.app. Anything else about the service, including billing, goes to support@typolo.app.
Changes
If this policy changes materially, the date at the top changes and account holders are told by email. Continuing to use the site after a change means the updated policy applies.