Privacy Policy

The short version

KeyTopia is free, carries no advertising, and sells nothing to anyone. There are no tracking pixels and no advertising networks. We do count which pages get read and which games get opened, in a way that cannot follow you between sites or recognise you on your next visit.

Every keystroke you make is written to your own browser first, so practice never waits on a network call and keeps working offline. What syncs to our servers is the outcome of a session, not the text you typed. Signing in is what makes a mastery map survive a lost laptop, and it is the only reason we hold an email address at all.

• Reading this site, taking the typing test and browsing the guides needs no account and no cookie banner.
• Saving progress needs one free account, held by a grown-up. Learners get profiles, not logins.
• We never collect a child's email address, real name, photograph, location or contact details.
• You can export or delete everything at any time, from inside the app or by emailing us.

Who is responsible for your data

KeyTopia is an independent project. For the purposes of the UK and EU General Data Protection Regulation, the operator of keytopia.app is the data controller for the information described on this page. You can reach a human at contact@keytopia.app, and we aim to answer every privacy question within thirty days.

Where a school deploys KeyTopia to a class, the school is the controller for its pupils' records and KeyTopia acts as a processor on the school's instructions.

What we collect, and why

We have tried to keep this list short enough that you can actually read it.

• Account details. An email address, and a Google account identifier if you sign in that way. We need it to prove the account is yours and to send sign-in links. There is no password, so there is no password for anyone to steal.
• Explorer profiles. The display name, avatar, age band and accessibility settings you choose for each learner. Names for children are generated from a safe word list by default.
• Learning records. Finished lesson and session results: which lesson, when, words per minute, accuracy, consistency, and a per-key mastery summary. This is what draws your map and what makes the adaptive engine adaptive.
• Classroom records. If you join a class with a code, the class you belong to and the results you post to its board.
• Technical logs. Our host records the ordinary web-server details of a request: IP address, browser user agent, URL and timestamp. These are used to keep the service up and to spot abuse, and are not joined to your learning records.

What we never collect

Some of what a typing tutor could technically capture, we deliberately do not.

• The raw text of what you typed. Individual keystrokes and their timings stay in your browser. Only the aggregate statistics leave it.
• Anything you type in the Copy desk mode. Text you paste in to practise with is yours, stays local, and is never uploaded.
• Payment details, because there is nothing to buy.
• Precise location, contact lists, microphone or camera access.
• Advertising identifiers and cross-site trackers. The visit counting described below is deliberately built so that it cannot become one.

Legal bases for processing

Under UK and EU data protection law we rely on two bases. Performing our contract with you covers your account, your profiles and your learning records, because without them the product cannot do the one thing it promises. Our legitimate interest in running a secure, working service covers server logs and abuse prevention.

We do not process your data for marketing, and we do not rely on consent for anything, which is why there is no cookie banner to dismiss.

Cookies and browser storage

KeyTopia sets no advertising or analytics cookies. It uses your browser's local storage to hold your profiles, settings and practice history so the app can start instantly and work offline, and it stores a session token so you are not asked to sign in on every visit. Both are strictly necessary for the service to function.

Clearing your browser data for this site removes the local copy. If you are signed in, your synced records remain in your account and return when you sign in again.

How we count visits

We look at which pages are read and which parts of the app are opened, because otherwise we are guessing about what to build next. Both tools that do this are set up so that they measure the visit and not the visitor.

Google Analytics runs in its consent mode with storage denied, permanently and for everybody. That means it writes no cookie, is given no identifier, and stores nothing on your device, so it cannot tell your second page from somebody else's first, cannot recognise you when you come back, and cannot follow you to another site. It receives the address and title of the page, where you arrived from, and the country and device type its servers work out from your IP address.

Vercel, who host the site, count visitors from a hash of your IP address, your browser and a secret that is regenerated every day and never kept. That produces an honest count of how many people read a page without anything being stored on your device and without the count surviving into tomorrow.

Neither is joined to your account, your profiles or your learning records, and neither ever sees the text you type. This is why there is still no cookie banner: there is no consent to ask for when nothing is stored and nobody is identified.

Who else touches your data

KeyTopia uses a small number of service providers, listed in full below. Each is bound by a data processing agreement, none is permitted to use your data for its own purposes, and we do not sell or share personal data with anyone else. We have never received a government request for user data. If that changes and we are permitted to say so, we will.

• Supabase, database, authentication and file storage. Account email address, profile records, lesson and session results, class membership. Hosted in the region shown on the account page.
• Vercel, website hosting, content delivery and visitor counts. Standard web-server request data: IP address, user agent, requested URL, timestamp. For visitor counts these are turned into a one-way hash that changes every day and is then discarded, so the same person cannot be recognised tomorrow.
• Google Analytics, page and feature counts. The page being viewed, its title, the site you arrived from, and coarse device and country information derived from your IP address. It runs without cookies or any identifier, so it counts visits rather than people.
• Resend, transactional email delivery. Account email address, and delivery metadata for sign-in links.
• Google, optional sign-in provider. Only if you choose to sign in with Google: your email address and account identifier. KeyTopia requests nothing else from your Google account.

Where your data is held

Data is stored in the region shown on your account page. Some of our providers operate in the United States, so your information may be transferred outside the UK and the European Economic Area. Where that happens, the transfer is covered by the UK International Data Transfer Addendum or the European Commission's Standard Contractual Clauses.

How long we keep it

Your account and its learning records are kept for as long as the account exists, because their whole purpose is to show progress over years rather than weeks. Delete a profile and its records go with it. Delete your account and everything is removed from live systems immediately and from backups within thirty days.

Server logs are kept for a short operational window, typically thirty days, then discarded.

Children

KeyTopia is built to be used by children, and the design assumption is that a child should never have to hand over anything about themselves to learn to type.

A child never creates an account, never enters an email address and never chooses a public name. A parent, guardian or teacher signs in, and the child gets a profile under that account. There is no chat, no messaging, no friend requests and no public leaderboard, so there is no route by which a stranger can contact a child through KeyTopia. Racing opponents are computer-controlled.

Because we knowingly collect no personal information from a child, there is nothing for a child to be identified by. If you believe a child has entered personal information anyway, for example by typing a real name into a profile field, email us and we will remove it.

Schools

A teacher signs in with a school email address and creates a class. Pupils join with a code, and the seat is bound to the device rather than to an identity, so no pupil email addresses are required or wanted.

What reaches a class board is the finished result of an exercise: which lesson, the score, the accuracy. The text a pupil typed is not uploaded. Schools acting as controllers can request a data processing agreement, a copy of a pupil's records or their deletion at the address below.

Your rights

Wherever you live, you can ask us to show you what we hold, correct it, delete it, hand it over in a portable format, or restrict what we do with it. Most of this is a button inside the app rather than a request you have to make: Settings, then Data.

If you are in the UK or the EEA you also have the right to object to processing and the right to complain to your data protection authority, which in the UK is the Information Commissioner's Office. If you are in California, you have the right to know, delete and correct, and the right not to be discriminated against for exercising them. We do not sell or share personal information as those terms are defined by the CCPA, and we have no financial incentives to disclose.

To exercise any of these, email contact@keytopia.app from the address on the account.

Security

Traffic is encrypted in transit with TLS and data is encrypted at rest. Accounts are protected by one-time sign-in links or your Google account rather than by a password we store. Access to a record is enforced at the database with row-level security, so one account cannot read another's data even if the application layer is wrong.

No system is perfect. If we ever suffer a breach affecting your personal data, we will notify affected users and the relevant regulator without undue delay, and within seventy-two hours where the law requires it.

Deleting everything

Settings, then Data, removes profiles and history from the device and from your account. Deleting the account itself removes the email address, every profile under it and all of their records.

Clearing your browser's site data removes only the local copy. If you want it gone from our side too, delete the account first.

Changes to this policy

This policy was last revised on 19 August 2026. If we change it in a way that materially affects how your data is handled, we will say so in the app before the change takes effect rather than quietly editing this page.

Contact

Questions, requests and complaints: contact@keytopia.app. A real person reads it.

Sub-processors, in full

Every third party that ever holds KeyTopia data, and exactly what each one holds.

Supabase

Database, authentication and file storage. Account email address, profile records, lesson and session results, class membership. Hosted in the region shown on the account page.

Vercel

Website hosting, content delivery and visitor counts. Standard web-server request data: IP address, user agent, requested URL, timestamp. For visitor counts these are turned into a one-way hash that changes every day and is then discarded, so the same person cannot be recognised tomorrow.

Google Analytics

Page and feature counts. The page being viewed, its title, the site you arrived from, and coarse device and country information derived from your IP address. It runs without cookies or any identifier, so it counts visits rather than people.

Resend

Transactional email delivery. Account email address, and delivery metadata for sign-in links.

Google

Optional sign-in provider. Only if you choose to sign in with Google: your email address and account identifier. KeyTopia requests nothing else from your Google account.