The short version
- You can practise offline without sending anything to our servers. Your progress stays on your device.
- Online features use an anonymous account created automatically. You choose your own display name.
- Google sign-in is optional. We receive only your name, email address and profile picture, and use them for sign-in and account linking. We never sell them or use them for ads.
- Ranked runs record keystroke timings for anti-cheat checks. We delete them within 12 months.
- Payments are handled by Stripe. We never see or store your card number.
- No advertising cookies and no third-party advertising trackers.
- Ask for a copy, a correction or deletion at typingtolearnadmin@gmail.com.
Who we are and how to reach us
The data controller for https://typingtolearn.com, the web app and the Typing to Learn desktop app (together, the "Service") is:
- Service provider
- Typing to Learn - Created by Parinya Pathomthong
- Address
- PR Apartment,175/3-4 Dindaeng, Bangkok 10400, Thailand
- Privacy contact
- typingtolearnadmin@gmail.com
- LINE Official Account
- @typingtolearn
- Data Protection Officer (DPO)
- [DPO or privacy lead name and contact — please fill in]
"We", "us" and "our" mean the provider above. "You" means a user of the Service, including a parent or guardian acting for a minor.
What we collect, by source
We collect only what the Service needs. Each type of data below exists only if you use the feature it belongs to.
1. Data that stays on your device
Completed lessons, medals, speed and accuracy statistics, your most-missed keys, sound and theme settings, and any text you paste in to practise are kept in your browser's storage (localStorage) or in the desktop app's data folder. None of it is sent to us unless you turn on cloud sync (section 2) or submit a ranked result (section 4).
2. Your account and cloud sync
- Anonymous account: the first time you use an online feature we create a random user ID and a sign-in token that is stored on your device.
- Display name: the name you choose for leaderboards, race rooms and certificates, with the account creation date and the date you last changed it.
- Sync data (Plus and Pro): one copy of your progress, statistics and settings, up to 512 KB, linked to your account.
- Account status: your current plan, any access granted to you, and whether the account is suspended.
3. Google sign-in
If you choose to sign in with Google, we receive your name, email address, profile picture and Google account ID through OAuth, requesting only the openid, email and profile scopes. See Google user data for exactly how we use them.
4. Online play, ranks and anti-cheat data
- Results: speed (WPM), accuracy, duration, keystroke counts, errors and backspaces, rating points, rank, season and match outcomes.
- Keystroke timing logs: for ranked runs and certificate runs we record the sequence of keys pressed inside the test and the time between them, plus how many times the test window lost focus. Our server replays the log to recompute your result and to detect bots, macros and auto-typers.
We only record keystrokes typed inside a test our server issued. We never record typing outside the app, passwords, or text you type in other programs.
5. Payments
Card subscriptions (auto-renewing) and PromptPay passes (one-time) are processed by Stripe. We receive and keep your Stripe customer ID, the email used for receipts, plan and billing interval, amount, start and end of your access, trial end date, payment method type, transaction references and payment status. We never see or store your card number, expiry date or CVC.
6. School and organisation license activation
When a license key is activated in the desktop app, the app sends the key, a machine fingerprint (a one-way salted hash of a hardware identifier that cannot be turned back into the original), the computer name, operating system and the time of the last sync. We use these to count devices under the agreement and to stop keys being used beyond their seats.
7. Interest form and messages
When you fill in a form on our website we keep your name, email, phone number (optional), organisation, role, message, the offer you picked, your consent, the time you sent it, and the page and campaign labels on the link you used, when available. We use those labels to understand which campaigns lead to inquiries. When you contact us by email, LINE, Facebook or TikTok, we receive what you send plus whatever profile details that platform shows us.
8. Technical data
Our servers and content delivery network log ordinary connection data such as IP address, browser or app type, time, requested page and error codes, for security, abuse prevention and troubleshooting.
Why we use it and our lawful bases
The PDPA requires a lawful basis for every use of personal data. This table shows ours.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Provide lessons, online races, sync and certificates you ask for | Account, display name, results, sync data | Contract (section 24(3)) |
| Sign you in, link accounts and carry purchases across devices | Google data, user ID | Contract (section 24(3)) |
| Take payments, manage subscriptions and issue receipts | Payment data, email | Contract (section 24(3)) |
| Keep accounting and tax records | Payment records | Legal obligation (section 24(6)) |
| Detect cheating, keep rankings fair, decide on suspensions | Results, keystroke timing logs | Legitimate interest (section 24(5)) |
| Keep the Service secure and prevent license misuse | Technical data, machine fingerprint | Legitimate interest (section 24(5)) and the license contract (section 24(3)) |
| Reply to your form and send the offer you asked for | Form data | Consent (section 19) and steps before a contract at your request (section 24(3)) |
| Send news, promotions or marketing offers | Email, phone | Consent (section 19), which you can withdraw any time |
| Answer questions and give support | What you send us | Legitimate interest (section 24(5)) |
If you do not provide data a contract needs, for example you do not sign in with Google, we cannot sell you a paid plan, but you can still practise offline and use the free plan. We do not make automated decisions with legal effects on you. Our result checker may flag unusual runs for review, and any suspension is decided by a person.
Google user data
This section covers only the data we receive when you choose to sign in with Google.
What we access
Your name, email address, profile picture and Google account ID, through the openid, email and profile scopes. We do not request access to Gmail, Google Drive, contacts, calendar or any other Google data, and we cannot post or act on your behalf.
How we use it
- To authenticate you and link your anonymous account to your Google account, so your progress, ranks and purchases follow you to every device.
- To show the name and picture of the signed-in account on the app's Account screen, so you can see which account you are using.
- To use your email as the customer email in Stripe for receipts and subscription management, and to contact you about your account or payments when necessary.
How we store it
It is stored in the Supabase authentication service, our data processor, encrypted in transit, with access limited to administrators who need it. We keep it while your account is active and delete it when you ask us to delete your account (see Deleting your account and data).
How we share it
We do not sell, rent or trade Google user data. We share your email with Stripe only when you buy a plan, and with the processors listed in this policy only as needed to run the Service, or when the law requires it. Your Google name and email never appear on leaderboards or certificates, which use only the display name you choose.
What we never do
- Use Google user data for advertising, including targeted, interest-based or retargeting ads.
- Sell it to data brokers, advertisers or anyone else.
- Use it to determine creditworthiness or for lending.
- Use it to develop or train generalised artificial intelligence models.
- Let people read it, unless you agree, it is needed for security (such as investigating abuse), it is required by law, or it has been aggregated and anonymised.
Limited Use disclosure
Typing to Learn's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You can disconnect the app from your Google account at any time in your Google Account permissions. Disconnecting does not delete data we already hold. To have it deleted, see Deleting your account and data.
What other people can see
- Leaderboards and race rooms: your display name, rank, points and results.
- Certificates: anyone with the verification code or QR code can see the display name, speed, accuracy, test length, language, rank and issue date. Your email is never shown.
If you do not want to be identified, do not use your full real name as your display name.
Sharing and processors
We do not sell personal data. We share it only with service providers that process it for us under contracts that require security and confidentiality.
| Provider | Role | Data involved |
|---|---|---|
| Supabase | Database, user accounts and server functions | Account data, results, keystroke logs, sync data, payment records, licenses, form entries |
| Stripe | Card and PromptPay payments, subscriptions | Email, payment data (card details are held by Stripe only) |
| Sign-in (Google Sign-In) | Authentication data during sign-in | |
| Cloudflare | Website hosting, content delivery and attack protection | Technical data such as IP address |
We may also disclose data when required by law or by a competent authority, to protect the rights and safety of users or ourselves, or in a merger or transfer of the business, where the new owner must honour this policy. If we ever add a third-party analytics tool, we will update this policy first and ask for consent where the law requires it.
International transfers
Some processors store or process data outside Thailand. Our main database is hosted in [Supabase region, e.g. Singapore — please fill in]. Stripe, Google and Cloudflare may process data in the United States, the European Union, Singapore or other countries where they operate. We transfer data under sections 28 and 29 of the PDPA, relying on the need to perform our contract with you and on each provider's standard contractual clauses or other appropriate safeguards.
How long we keep data
| Data | Retention |
|---|---|
| Data on your device | Until you clear browser data, reset progress or uninstall the app |
| Account, display name, Google data, sync data | For the life of the account; deleted within 30 days of a deletion request |
| Anonymous accounts with no Google link and no purchase | Deleted after 24 months without online activity |
| Google-linked accounts that are inactive | 36 months after last use, with at least 30 days' notice by email before deletion |
| Results and ranks | For the life of the account |
| Keystroke timing logs | 12 months from the run; if flagged or disputed, until the review ends and no longer than 24 months |
| Certificates | For the life of the account, or until you ask us to revoke them |
| Payment and accounting records | 5 years from the end of the accounting period, or longer if tax law requires [confirm with your accountant / tax adviser] |
| License activation data | For the license term plus 12 months |
| Interest forms and messages | 24 months from our last contact, or until you withdraw consent |
| Server technical logs | Up to 90 days, unless needed to investigate a security incident |
At the end of each period we delete the data or make it impossible to identify you. We may keep aggregated statistics that cannot identify anyone to improve the Service.
Security
- All traffic is encrypted with HTTPS/TLS.
- The database uses Row Level Security: users can read only their own rows, and the app cannot write directly. Every change goes through server functions that check permissions.
- Administrator access is limited to what is necessary, and administrator actions are logged for audit.
- Card data never passes through our systems, and licenses are digitally signed to prevent forgery.
If a personal data breach is likely to put your rights at risk, we will notify the Office of the Personal Data Protection Committee within 72 hours of becoming aware of it, and tell you without undue delay where the risk is high, as the PDPA requires.
Your rights under the PDPA
- Access your personal data and get a copy (section 30).
- Data portability: receive it, or have it sent to another controller, in a commonly used machine-readable format (section 31).
- Object to processing based on legitimate interest, or for direct marketing (section 32).
- Erasure: have it deleted, destroyed or anonymised (section 33).
- Restriction of its use (section 34).
- Rectification so it is accurate and up to date (section 35).
- Withdraw consent at any time, without affecting processing done before (section 19).
- Complain to the Office of the Personal Data Protection Committee (PDPC) if you believe we have broken the law (section 73). Contact details are at www.pdpc.or.th.
Some rights have legal limits. For example, we must keep payment records for tax purposes even if you ask us to delete your account. If so, we will tell you why.
How to use your rights
- Send a request by email to typingtolearnadmin@gmail.com or on LINE at @typingtolearn, saying which right you want to use.
- Verify it is you. Write from the email of your linked Google account, or tell us your display name. If needed we may ask you to confirm from the Account screen in the app, to prevent impersonation.
- Get the result. We acknowledge within 7 days and complete the request within 30 days of receiving everything we need. If it will take longer, we will tell you why.
You can change your display name yourself on the app's Account screen, and clear on-device data by resetting progress in Settings or clearing site data in your browser. Using your rights is free, unless a request is clearly repetitive or excessive.
Deleting your account and data
You can ask us to delete your account and the data linked to it at any time.
- Cancel any renewing subscription from the Account screen in the app (Manage billing), so you are not charged again.
- Email typingtolearnadmin@gmail.com with the subject "Delete my account", from the email of your linked Google account, or tell us your display name if you never linked Google.
- Within 30 days we delete your account, display name, Google data, sync data, results, keystroke logs and certificates, and confirm through the channel you used.
- Payment records that the law requires us to keep are retained until the period ends, unlinked from the deleted account.
To remove data stored on your device, reset progress in the app, clear the site's data in your browser, or uninstall the desktop app.
Children
The Service is intended for users aged 13 and over. Users under 20 are minors under Thai law and should have a parent's or guardian's consent before signing in with Google or buying a plan, and every purchase must be made or approved by a parent or guardian. Students using a school license are under the school's supervision, and the school is responsible for any consent required. If a parent learns that a child has given us data without consent, please contact us and we will delete it. [Minimum age and parental consent terms — to be reviewed by legal counsel]
Cookies and local storage
We do not use advertising cookies or cross-site tracking cookies. We use only storage the Service needs to work:
- App localStorage: progress, statistics, settings and the sign-in token of your online account.
- Cloudflare essential cookies: may be set to tell people from bots and to block attacks.
- Stripe cookies: set on Stripe's checkout pages for fraud prevention, under Stripe's Privacy Policy.
Because this storage is strictly necessary, it does not require consent. If you block storage in your browser, the app cannot remember your progress.
Changes to this policy
We may update this policy when the Service or the law changes, and will update the "Last updated" date above. For significant changes, such as using data for a new purpose, we will tell you in the app or by email at least 15 days in advance, and ask for fresh consent where the law requires it.
Contact us
Send privacy questions to typingtolearnadmin@gmail.com, or see other channels on our contact page. Related documents: Terms of Service and Refund and Cancellation Policy. If the Thai version of this policy (ฉบับภาษาไทย) and this English version differ, the Thai version prevails.