Privacy

TypingStreak works without an account and without tracking cookies. This page lists exactly what is stored, where, and how to remove it.

In your browser

Your lesson progress, statistics, test history, settings and keyboards are saved in your browser's own storage on this device. They are not sent anywhere unless you sign in. Clear them with Statistics → Reset all data or by clearing this site's data in your browser.

With an account

• Your username, and your password stored only as a scrypt hash (never the password itself).
• Your email address and name, kept private: the email is only used for password reset links, the name only on your certificates.
• Typing exam certificates: the name, result and date as issued. Anyone with a certificate's ID or link can see these, so share it only with people who should check it. Deleting your account deletes your certificates.
• The speed-test and race results you send, your XP, friends and chosen race vehicle.
• If you join a class: a short progress summary (lessons passed, speed, accuracy, practice time, weak keys) that only that class's teacher can see.
• Personal API keys and sign-in sessions, stored only as hashes.

Sign in with Google, GitHub or Discord

TypingStreak asks only for your account id, display name and verified email address. The email is never shown to anyone and is only used to send you a password reset link when you ask for one. TypingStreak does not receive your contacts, files or posts, and it never posts anything for you.

Cookies

One cookie keeps you signed in, plus two short-lived ones during a sign-in. There are no advertising, analytics or tracking cookies.

Other services

Fonts you pick that don't come with TypingStreak or your computer load from Google Fonts or jsDelivr, which then see your IP address, as with any web request. Visits are counted with Cloudflare Web Analytics, which uses no cookies and does not identify you: it sees the page address, your browser type and country, like any web request. Emails (sign-up codes, password resets, security notices) are sent through Resend, which receives only the address and the email itself. New passwords are checked against known data leaks with Have I Been Pwned: only the first 5 characters of a scrambled fingerprint of the password are sent, never the password. Nothing else on TypingStreak loads from other companies.

Deleting your data

Signed in, open Account → Delete my account: your account, online results, sign-ins, API keys, friends and class memberships are deleted. You can also unlink Google, GitHub or Discord at any time under Account → Ways to sign in.

Backups

To protect against data loss, the server keeps a daily copy of its database for 7 days. Anything you delete is gone from the live site at once and from the last backup within 7 days.