Privacy

You can complete typing, dictation, transcription, and Career practice without creating a contact identity. Scores, error summaries, timestamps, streaks, and your optional nickname stay in this browser unless you explicitly use a shared feature.

Publishing a ranked attempt, entering Daily Arena, creating a team, custom test, assessment, or multiplayer room starts an anonymous Supabase session only when needed. Shared authorization still uses the authenticated role, RLS, and server-authoritative RPCs. No contact details or credentials are requested.

Leaderboards and team rosters show a nickname, never contact details or an auth UUID. Team, custom-test, and assessment management links contain a high-entropy secret in the URL fragment. The database stores only a SHA-256 digest, and creating a new link revokes the previous one.

Treat a management link like a key: anyone who has it can attempt recovery for that specific resource.

Product analytics load only after you explicitly allow them. Events contain feature metadata, not typed text, answers, contact details, auth UUIDs, or capability tokens. Ad slots are reserved outside active exercises and never autoplay audio.

Use Progress → Privacy to export or delete local practice data. The same panel can delete shared results and workspaces owned by the current device identity; it does not delete the auth record itself, so the action remains a product-data deletion rather than an identity-administration flow.

Friend challenge entries expire automatically after 30 days.

Dictation and transcription clips are static files generated during development from original narrations written for TypingArena. Source and license records ship with each clip (see the repository's docs/LICENSES.md).