How we handle your account, data, and privacy

You can sign in to TypeMaster Pro with email and password or with Google. Passwords are never stored in our database in plain text — authentication is handled by our backend platform, which stores only salted password hashes.

We support password reset over email and check new passwords against the HaveIBeenPwned breached-password list to discourage reusing compromised credentials. Sessions are issued as short-lived tokens that refresh automatically while you're active.

Administrative actions inside the product are gated by a separate role table and server-side role checks — not by anything the browser can change.

The TypeMaster Pro web app is built with TanStack Start and runs on Cloudflare's edge network. Our database, authentication, storage, and server-side functions are provided by Supabase, a managed Postgres platform.

All traffic between your browser and our servers is encrypted in transit using TLS. Data stored in our managed database and storage buckets is encrypted at rest by the underlying platform.

The data we hold about you is the data you create by using the product:

• Your account: email address and a display name.
• Your typing activity: lessons completed, session scores (words-per-minute, accuracy), per-key statistics, and progress through courses.
• Your settings and preferences (keyboard layout, theme, sound).
• Billing metadata when you subscribe (plan, status, renewal dates) — we do not store full card numbers; see the Payments section.
• Basic technical logs needed to operate the service (request metadata, error reports).

We do not sell your personal data, and we do not use the content of your typing sessions to train third-party models.

We rely on a small number of vendors to operate the product. Each handles a specific function:

• Cloudflare — application hosting and edge delivery.
• Supabase — managed Postgres database, authentication, storage, and server functions.
• Google — optional OAuth sign-in.
• Paystack — subscription payments and billing.

If we add or change a subprocessor that handles personal data, this page will be updated.

Subscriptions are processed by Paystack. Card details are entered on Paystack's PCI-DSS compliant payment pages and are never transmitted to or stored on TypeMaster Pro servers. We receive only a payment reference and the status of your subscription.

Billing webhooks from Paystack are verified with a signed secret before any subscription change is applied to your account.

We use the minimum cookies and browser storage required to keep you signed in and to remember your preferences (such as keyboard layout and theme). We do not use third-party advertising trackers.

We keep your account data and typing history for as long as your account is active so your progress and statistics stay available. If you delete your account, we remove your personal profile and typing history from our active systems within a reasonable period, except where we are required to retain limited records (for example, invoice and tax records related to payments).

You can export or request deletion of your account data by emailing us from the address on your account. We aim to respond within a reasonable timeframe consistent with applicable privacy laws.

For day-to-day changes, you can update your profile and preferences in your account settings once signed in.

Security is shared between us, our platform providers, and you:

• Our platforms (Cloudflare, Supabase, Paystack) provide encrypted hosting, managed databases, and PCI-compliant payments.
• TypeMaster Pro writes the application code, configures access rules around your data, and verifies webhooks and admin actions on the server.
• You are responsible for choosing a strong, unique password, keeping access to your email and Google account secure, and signing out on devices you don't control.

If you believe you've found a security issue in TypeMaster Pro, please report it privately through our contact page. Please give us a reasonable opportunity to investigate and remediate before any public disclosure.