Privacy Policy

This Privacy Policy explains how CodeTypeLearn (“CodeTypeLearn,” “we,” “us,” or “our”) collects, uses, discloses, and safeguards your personal data when you use the typing-tutor service available at codetypelearn.dev and its subdomains (the “Service”). It also describes the rights you have over your data and how to exercise them. By using the Service, you agree to the practices described here.

We designed CodeTypeLearn to collect as little personal data as possible. The only piece of directly identifying information we require is the email address associated with your social login — everything else is typing-practice data used to run your profile and the leaderboards.

1. Who we are & scope

CodeTypeLearn operates the Service and acts as the data controller for the personal data described in this policy. This policy covers the website, the authenticated app, the public leaderboards and share cards, multiplayer races, the AI coding tutor, and billing. It does not cover third-party sites you reach by following links from the Service; those services have their own privacy policies.

2. Information we collect

2.1 Identity data (from your social login)

You sign in with Google, GitHub, or Microsoft. We receive from your chosen provider your name, email address, a stable provider user ID, and (where available) your avatar URL. We do not receive or store your password with the provider. We never request access to your repositories, contacts, calendar, documents, or mailbox — only your basic profile and email.

2.2 Typing & progress data

As you practice, we record performance data tied to your account: words-per-minute, accuracy, the snippet and language practiced, your selected keyboard layout, completion timestamps, and the derived progression values we use for gamification (experience points, level, rating, streaks, achievements, and daily-challenge results).

2.3 Anti-abuse signals

To keep the leaderboards fair, each ranked run includes a compact, aggregated typing signature (for example, inter-keystroke timing summaries and the count of auto-indented characters) that we use to distinguish genuine human typing from automated or forged submissions. These signals describe how you typed the practice snippet; we do not log your keystrokes outside of a practice session, and we do not capture anything you type elsewhere on your device.

2.4 Billing data

If you subscribe to the paid plan, payment is processed by Stripe, Inc. We receive from Stripe your subscription status, plan, and billing metadata needed to grant access. We never receive or store your full card number — card data is handled entirely by Stripe.

2.5 AI tutor prompts

When you ask the in-app AI tutor to explain a snippet or concept, the relevant code context and your question are transmitted to our AI provider (Anthropic) to generate a response. We send only what is needed to answer; we do not send your email, billing data, or unrelated profile data to the AI provider.

2.6 Multiplayer races

When you create or join a race, we process your public handle and live progress for the other participants to see. If you invite friends by email, the email addresses you enter are used solely to send that one invitation and are not added to any marketing list. If you invite by handle, we deliver the invite to that user's in-app inbox.

2.7 Cookies & device data

We set a small number of strictly functional cookies (see Section 5) and our servers record standard log data: the connecting IP address (as reported by our CDN), request timestamps, and user-agent string. This is used for security, abuse prevention, and debugging.

3. How we use your data

• Authenticate you and keep you signed in.
• Run your profile, progress tracking, achievements, and daily challenges.
• Populate public leaderboards, share cards, and multiplayer races.
• Detect, investigate, and prevent fraud, bot submissions, and abuse.
• Process subscriptions and manage access to paid content.
• Provide the AI tutor and respond to your questions.
• Provide support and respond to your requests.
• Comply with legal obligations and enforce our Terms of Service.
• Maintain the security, integrity, and reliability of the Service.

We do not sell your personal data, and we do not use it for third-party advertising.

4. Legal bases for processing (EEA/UK)

If you are in the European Economic Area or the United Kingdom, we rely on:

• Performance of a contract — to provide the Service you signed in for (accounts, progress, billing).
• Legitimate interests — to keep leaderboards fair, prevent abuse, secure the Service, and improve it, balanced against your rights.
• Legal obligation — to retain billing records and respond to lawful requests.
• Consent — where we ask for it explicitly (for example, any optional product communications); you may withdraw consent at any time.

5. Cookies

We use only functional cookies required to operate the Service. We do not use advertising or cross-site tracking cookies.

• Authentication/session cookies — keep you signed in after social login.
• ct_gid — a random per-browser identifier that lets anonymous visitors keep their own practice stats before they sign in. It contains no personal data.
• ct_access — set only in locked-down preview environments when you open an access link; it is never used on the public site for ordinary visitors.

6. How we share data

We share personal data only with service providers (processors) that help us run the Service, and only to the extent needed:

• Amazon Web Services — hosting, database, email delivery, and content delivery (data stored in AWS's Asia Pacific (Sydney) region).
• Google, GitHub, Microsoft — identity providers, for the sign-in you choose.
• Stripe — payment processing for paid subscriptions.
• Anthropic — AI model provider, for the coding tutor.

We may also disclose data where required by law, to enforce our Terms, to protect the rights, safety, and security of our users and the Service, or in connection with a merger, acquisition, or sale of assets (with notice to you where required).

7. What is public

Leaderboards, share cards, and public profiles display your chosen handle (or a neutral generated player name) together with your typing stats. We never display your email address or your real name on any public surface. You control your handle, and you can change it.

8. Data retention

We keep your account data for as long as your account is active. When you delete your account, we delete or anonymize your personal data within 30 days, except where we must keep it longer — billing records are retained for up to 7 years to meet financial and tax obligations, and security logs are kept for up to 12 months. Aggregated or de-identified statistics that can no longer be linked to you may be retained indefinitely.

9. Security

Data in transit is encrypted with TLS. Data at rest is encrypted using managed, industry- standard encryption (including KMS-managed keys for sensitive stored data). Access to production data is restricted and authenticated. No system is perfectly secure, but if a breach occurs that is likely to create a risk to your rights, we will notify affected users and the relevant authorities as required by applicable law (in many jurisdictions, within 72 hours of becoming aware).

10. Your rights

Depending on where you live, you may have the right to access, correct, delete, export (data portability), restrict or object to processing, and withdraw consent. If you are in the EEA/UK, you also have the right to lodge a complaint with your local data protection authority.

California residents (CCPA/CPRA): you have the right to know what personal information we collect, to delete it, to correct it, and to opt out of its “sale” or “sharing” — we do not sell or share personal information as those terms are defined, and we do not discriminate against you for exercising your rights.

To exercise any right, email us at support@codetypelearn.dev. We will verify your request and respond within the timeframe required by law (generally within 30 days).

11. International transfers

The Service is hosted in Australia, and our processors may process data in other countries. Where personal data is transferred across borders, we rely on appropriate safeguards (such as standard contractual clauses) where required by applicable law.

12. Children

The Service is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you in the app or by email. Your continued use of the Service after an update means you accept the revised policy.

14. Contact us

For privacy questions, data requests, or complaints, contact us at support@codetypelearn.dev. See also our Terms of Service.