Effective November 5, 2026

Privacy Policy

1. Who we are and how to reach us

This Privacy Policy explains how we handle your personal data when you use Touchtypely at touchtypely.com. Touchtypely is operated by a company based in Slovakia, in the European Union, so we follow the EU General Data Protection Regulation (GDPR) and Slovak Act No. 18/2018 on personal data protection for everyone, wherever they live. Sections 7 and 8 add information for users in the United States.

To ask a question about your data or to exercise your rights, contact us by email at hello@touchtypely.com or through the form on our Contact page. We have not appointed a data protection officer because the law does not require us to.

The controller of your personal data is:

Legal name: Brandrise s. r. o.
Registered office: Sokolovská 178/10, 040 11 Košice
Company ID (IČO): 53196449
Tax ID (DIČ): 2121313865
Not registered for VAT
Commercial register: Obchodný register Okresného súdu Žilina, oddiel Sro, vložka č. 75736/L
Email: hello@touchtypely.com

2. Why we use your data and on what legal basis

We do not sell your data and we do not use it for third-party advertising. The only emails we send you are about your Touchtypely course, and you can turn off each type of email in account settings or with one click in the email itself.

We use your data for these purposes:

Creating and running your account and providing the course: saving results, history, per-key statistics, streaks and XP points, replaying your typing, moving guest results into your account and exporting your data. Legal basis: performance of our contract with you under the Terms of Use (GDPR Art. 6(1)(b)).
Service emails, such as sign-up confirmation, password resets or notice of changes to our terms. Legal basis: performance of the contract (Art. 6(1)(b)).
Emails about your course: a guide to your first 30 days, tips, reminders after a break, congratulations, a weekly summary and referral updates. They include your current progress, and we check whether you opened the email and clicked a link so we can send more useful content. Legal basis: our legitimate interest in helping you finish the course and keep your skill (Art. 6(1)(f)). You can object at any time by turning these emails off in settings or with the link in the email.
The referral program: recording who invited whom and the discounts earned. Legal basis: performance of the contract under the referral program terms (Art. 6(1)(b)).
Keeping customer records in our customer relationship management system (Pipelly CRM), so we know who we have been in touch with and about what, and can help you better. Legal basis: legitimate interest (Art. 6(1)(f)).
Your public profile and the leaderboard, showing your first name or nickname and results. Legal basis: our legitimate interest in running the competitive part of the course, which motivates regular practice (Art. 6(1)(f)). You can turn this off at any time in account settings.
Your city and state on your public profile and the leaderboard. Legal basis: your consent, which you give by filling them in (Art. 6(1)(a)). You withdraw consent by deleting them in account settings.
A short notice on the website about new sign-ups, showing your first name, an approximate town based on the IP address of your first sign-in (looked up in our own database on our server; we never send or publish the IP address) and the time you joined, for up to 60 days. Legal basis: legitimate interest in showing that people really use the course (Art. 6(1)(f)). You can object by turning off your public profile in account settings.
Checking that tests are fair and reviewing suspicious results using the keystroke record. Legal basis: legitimate interest in fair results and leaderboards (Art. 6(1)(f)).
Keeping the service secure and protecting accounts from misuse, for example by limiting repeated sign-in attempts. Legal basis: legitimate interest (Art. 6(1)(f)).
Answering messages sent through our contact form. Legal basis: legitimate interest in replying to you (Art. 6(1)(f)), or performance of the contract if the message is about your account.
Improving the course and publishing aggregate statistics that cannot identify anyone. Every published group has a minimum size. Legal basis: legitimate interest (Art. 6(1)(f)).
Keeping proof that you accepted our terms and confirmed your age, and establishing or defending legal claims. Legal basis: legitimate interest (Art. 6(1)(f)).
Anonymous visitor statistics measured on our own server: which pages people visit, where they came from and whether they signed up, without cookies and without storing IP addresses. Legal basis: legitimate interest in improving the website and the course (Art. 6(1)(f)).
Website analytics with PostHog: only with your consent in the cookie banner (Art. 6(1)(a)).
Payments and accounting records once the paid plan launches. Legal basis: performance of the contract and our legal obligations under accounting law (Art. 6(1)(b) and (c)).

3. What data we collect

To create an account we need an email address and a password; without them we cannot create one. You choose a first name or nickname in the next step. City and state are optional. You can try the first lesson and the typing test without signing up.

Sign-in with Google is coming. If you use it, Google will give us your email address, name and Google account ID. We never see your Google password. Google will learn that you are signing in to Touchtypely, and that processing is governed by Google's own privacy policy.

We collect the following data:

Account data: email address, password stored only as an unreadable hash, first name or nickname, city and state if you add them, account settings, confirmation that you are 13 or older, and your acceptance of our terms with the date and time.
Learning data: results of exercises and tests (for example speed, accuracy and errors), history, per-key statistics, streaks and XP points.
Keystroke record: which characters you pressed during an exercise or test and when. We use it to replay your typing and to detect cheating on tests. We record only your typing inside Touchtypely exercises and tests, and we do not use it to identify you.
Guest results: if you use the service without an account, your results are stored only in your browser (localStorage), and we cannot access them. They can be moved to your account when you sign up. For a typing test without an account, we keep only an anonymous entry for aggregate statistics: speed, accuracy, test length, keyboard layout and time, with no IP address or other identifier, so it cannot be linked to you.
Result review records: the fact that a result was automatically flagged, and the outcome of its review.
Contact form messages: your name, email address and the message.
Email data: which automated emails we sent you and when, whether you opened them and clicked a link, and your email settings. We detect opens with a tiny image in the email; if you turn off images in your inbox, we cannot detect opens.
Referral data: your referral code, who signed up through your link or whose link you used, and the discounts earned.
Security data: IP address, browser and device information (for example browser and operating system type) and the times of sign-ins and sign-in attempts, including failed ones.
Sign-in data: a session identifier stored in a cookie. See our Cookie Policy for the full list.
Anonymous server-side visitor statistics: the page visited and the time, the website you came from, any campaign tag in the address (utm), and a hash calculated from your IP address and browser details using a random key that changes every day, with the old key thrown away. We do not store the IP address and the hash cannot be reversed, so we cannot follow you from one day to the next. This measurement uses no cookies or browser storage. If you are signed in, the record is linked to your account. When you sign up, we note in your account where you came to the site from and through which page.
For the paid plan, subscription and payment data: plan type and period, amount, payment date and receipt, and a billing address or company ID if you enter them at checkout. We keep payment records for 10 years as required by Slovak accounting law. Card details are handled directly by our payment processor, Stripe, and we never see them.

4. How long we keep your data

We keep data only as long as we need it. If we need it to establish or defend a legal claim, we keep only what is necessary until the claim is resolved. Aggregate statistics that cannot identify anyone are not personal data, and we may keep them.

Specific periods:

Account, learning data, keystroke records and result review records: until you close your account. If you do not sign in for 3 years, we will send you a reminder. If you still do not sign in within 30 days after that, we will close the account.
Sign-in session cookie: 30 days or until you sign out.
Security records of sign-ins and sign-in attempts, including IP address and browser details: 90 days.
Contact form messages: 2 years from when we receive them.
Records of emails sent, including opens and clicks: 3 years from sending, and no longer than until you close your account.
Data in Pipelly CRM: as long as you have a Touchtypely account. After you close it, we delete the data there too, within 30 days at the latest.
Anonymous server-side visitor statistics: 13 months from when they are recorded; the sign-up source in your account until you close it.
PostHog analytics data: up to 12 months from when it is recorded. If you withdraw consent, measurement stops and the data stored in your browser for it is deleted.
Backups: deleted data may remain in backups for up to 30 days before it is automatically overwritten.
Guest results: only in your browser, until you move them into an account or delete them.
Accounting records once the paid plan launches: 10 years following the year they relate to, as required by Slovak accounting law.

5. Who we share data with

Public data, meaning your first name or nickname, city and state if you added them, and your results, can be seen by anyone on your public profile and the leaderboard until you turn that off.

We disclose data to public authorities, such as a court or the police, only when the law requires us to.

These service providers (processors) help us run the service. They process data only on our instructions and under a data processing agreement:

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: servers and database. The servers are in the European Union.
An email service provider based in the European Union: sending service emails, such as sign-up confirmations and password resets, and emails about your course. We will tell you its name on request.
PostHog Inc., 2261 Market Street #4008, San Francisco, USA: website analytics on public pages, only with your consent in the cookie banner. Data is stored in its EU cloud (Frankfurt, Germany). Because PostHog is a US company, a transfer to the US is possible; see the next section.
Stripe Payments Europe, Limited, Ireland: payment processing, receipts and subscription management. Payment data may also be transferred to the US under standard contractual clauses and the EU-US Data Privacy Framework.

6. Where your data is stored

We store and process most data on servers in the European Union, including Germany. If you use Touchtypely from the United States or another country, your data is transferred to and stored in the EU, where it is protected by the GDPR.

One exception is website analytics, if you allow it in the cookie banner. Our processor, PostHog Inc., is based in the US. Analytics data is stored in its EU cloud in Frankfurt, but because it is a US company, transfers to the US cannot be ruled out, for example for technical support or staff access. Any such transfer is covered by the European Commission's standard contractual clauses and the EU-US Data Privacy Framework. The legal basis for analytics is your consent, which you can withdraw at any time in cookie settings.

Payment data may also be transferred to the US through our payment processor, Stripe, as described above.

If this changes, we will update this page in advance and describe the safeguards that protect the transfer.

7. Children's privacy (COPPA)

Touchtypely is intended for people 13 and older. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Everyone who signs up confirms that they are 13 or older, and we do not offer accounts for younger children.

If we learn that we have collected personal information from a child under 13, for example because a child gave a false age, we will delete the account and the information promptly. If you are a parent or guardian and believe your child under 13 has given us personal information, please contact us at hello@touchtypely.com and we will delete it.

In some EU countries, the age at which a person can consent to the processing of their data on their own is higher, up to 16. Users in those countries who are below that age may use Touchtypely only with the permission of a parent or legal guardian.

For teens, we collect the same data as for any user and only what the course needs. We do not use anyone's data for advertising. We recommend that teens use a nickname rather than their real name, and the public profile can be turned off at any time in account settings.

8. Your rights as a US resident

Several US states, including California (CCPA, as amended by the CPRA), give residents specific privacy rights. Whether or not a particular state law applies to us, we offer the following to all US users.

In the last 12 months, we have collected these categories of personal information, from you directly and from your use of the service, for the purposes described in section 2: identifiers (such as email address, nickname and IP address), customer records (such as billing details), commercial information (subscriptions and payments), internet activity (pages visited and interactions with our emails), approximate location derived from an IP address, and inferences about your typing skills from your exercise results. We disclose these only to the service providers listed in section 5, for the purposes described there.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined in California law. We have not done so in the last 12 months, and we do not knowingly sell or share the personal information of anyone under 16. We do not use sensitive personal information to infer characteristics about you.

You have the right to:

know what personal information we collect, use and disclose, and get a copy of it; most of it you can download yourself in account settings as a CSV file,
correct inaccurate personal information,
delete your personal information; you can close your account with all its data with one button in account settings,
opt out of the sale or sharing of personal information; since we do not sell or share it, there is nothing to opt out of,
not be treated differently, for example with a different price or level of service, for exercising your rights,
use an authorized agent to make a request for you; we may ask the agent for proof that you authorized them and ask you to confirm your identity,
appeal if we decline your request, by replying to our decision; if you are still not satisfied, you can contact your state attorney general.

10. How to make a request

Send your request by email at hello@touchtypely.com or through the form on our Contact page. Include the email address on your account. If it is not clear that the request comes from you, we may ask you to verify your identity so that we do not give your data to someone else.

Requests are free. We respond within one month, which also meets the 45-day deadline under California law. For complex or numerous requests, we may extend this by up to two more months, and we will let you know if we do.

11. Complaints to a supervisory authority

If you believe we are handling your data unlawfully, we would appreciate it if you contacted us first. You also have the right to lodge a complaint with a data protection authority in the EU country where you live, work or where the violation occurred. Our lead authority in Slovakia is:

Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky)
Address: Galvaniho Business Centrum II, Galvaniho 7/B, 821 04 Bratislava, Slovakia
Website: dataprotection.gov.sk
Email: statny.dozor@pdp.gov.sk
Phone: +421 2 32 31 32 14
In the United States, you can also contact your state attorney general or the Federal Trade Commission (ftc.gov).

12. Automated decision-making

We do not make decisions based solely on automated processing that have legal effects on you or similarly significantly affect you (GDPR Art. 22).

Our system automatically flags test results that look unrealistic, for example because the speed is implausibly high. A flag is only a prompt for review. A person always decides whether a result stays or is removed, and may look at the keystroke record from the test. Until it is reviewed, the result may not appear on the leaderboard. If you disagree with the outcome, write to us.

13. Cookies

We use only essential cookies and browser storage, for example to keep you signed in or remember your chosen theme. Website analytics (PostHog) runs only after you consent in the cookie banner, and we do not use marketing cookies. Basic visitor statistics are measured anonymously on our own server, without cookies and without storing anything in your browser; see What data we collect. The full list is on our Cookie Policy.

14. How we protect your data

Connections to the service are encrypted (HTTPS), passwords are stored only as an unreadable hash, and only people who need it to run the service can access the data. We monitor sign-in attempts to catch misuse early.

If a data breach is likely to put you at high risk, we will tell you without undue delay.

15. Changes to this policy

We update this policy when the way we handle data changes, for example when Google sign-in or the paid plan launches. We will tell you about material changes in advance by email or with a notice when you sign in. The current version is always on this page.