Privacy notice

Status: Draft, pending owner and legal approval. Not in force.

# TTYper privacy notice

Status: Draft, pending owner and legal approval. Not in force.

This draft describes what the TTYper software does today. It is not legal advice and nobody has signed it off. Text in square brackets is a decision the owner has yet to make.

## Read this first

- **Telnet is not encrypted.** Anyone on the network path can read or change what you type and see. That is why Telnet connections are anonymous guests only: no sign-in, no email, no SSH key linking, no private history, no exports, no saved custom text, and no ranked results. Use SSH for anything beyond a quick try.
- **Ranked play and accounts need SSH.** Ranked results, leaderboards that rate you, saved progress and private data need an account on an SSH connection. Guests, and everyone on Telnet, race casual only.
- **New accounts are hidden.** Your profile, leaderboard entries and replays stay private until you choose otherwise.

## Who runs the service

[Operator name and registered address: owner to supply.] Questions and requests: [contact address: owner to supply].

## What we collect, and why

| Data | When | Why |
|---|---|---|
| Typing results: speed, accuracy, duration, date, per-key skill figures computed from the run, achievements | Every run on an account | To coach you and show your progress |
| Guest results: the same run figures, linked to your session by a one-way hash of a guest identifier, not to a person | Every run as a guest, Telnet included | To show your progress during the session and let you carry it into an account |
| Session records: transport (SSH or Telnet), terminal capability tier, server region, connect and disconnect times | Every session, guests included | To run and operate the service |
| Race results, ratings and downsampled replays | When you race | To rate players and show races. Replays are off by default |
| Email address | When you sign in by email code | To send you a one-time code. We keep a keyed hash of the address to recognise you. Until the email is sent, the address also sits encrypted in the delivery queue. It goes to our email provider (below) for delivery |
| Network hash (a one-way hash of your network prefix, not your address) | Only with an email-code request | To limit abuse of code requests. It is deleted with the code |
| SSH public key (the full key, its fingerprint, the name you give it and when it was last used) | If you link a key | To recognise you when you connect |
| Telnet claim code and the guest progress it carries | If you ask for one on Telnet | To let you continue the same progress over SSH. The code is not a secret you type to sign in |
| Handle, settings, visibility choices | Account | To run your account |
| Saved custom text, sealed with encryption | Only if you save one, and only when the operator has switched saving on | To let you practise your own text. Custom text you only type once is discarded when the session ends |
| Operator and security records: audit events, moderation cases | When an operator acts on an account or a result | To keep the service safe and accountable |

We do not log raw keystrokes or custom text, we do not infer sensitive traits from how you type, and we do not sell or share typing data for advertising. Per-key timing is not stored beyond the figures the service computes from a run. A run on custom text is not kept at all, and neither is its text, unless you explicitly save the text; it is never ranked.

## How long we keep it

| Data | Kept for |
|---|---|
| Guest sessions and guest results | 30 days |
| Race replays | 30 days |
| Run summaries, skill figures, achievements, race results | Until you delete your account |
| Saved custom texts | 30 days from the last save, at most 20 per account |
| Login codes, with their network hash and queued address | Valid for 10 minutes, deleted within 24 hours |
| Export files | 24 hours |
| Other abuse network hashes | 30 days (longer only for an active enforcement case) |
| Security and audit records | 365 days |
| Closed moderation cases | 365 days after they close |
| Deletion tombstone: a one-way identifier that proves an account was erased, so a restored backup can erase it again | 365 days [provisional: owner and legal to confirm] |

## Export

Account export is not available yet and stays off until public launch. When it is on, you can ask for a JSON export (settings, aggregates, run summaries, skill states, achievements, race results) or CSV exports of runs and per-key statistics. We build the file in the background and encrypt it. The download link is single-use and short-lived (15 minutes, and a new one can be requested), and the file itself is deleted after 24 hours. Telnet cannot request exports.

## Deletion

You can delete your whole account.

- Account deletion starts with a seven-day cooling-off period. You can cancel during it. After it ends, an operator completes the deletion. Your sign-in keys are revoked first, then your account data is erased.
- Race results stay in other players' history without your name. Security and audit records, and abuse hashes, stay for the periods above.
- [The in-terminal export and deletion screens are not connected yet. Until they are, requests go to the contact address above. Owner to confirm the wording at launch.]

## Backups

The database is backed up, encrypted, to object storage on Hetzner in Germany. A row you delete can survive in a backup for up to 35 days [planned figure, owner to confirm]. If a backup is ever restored, erasures made after it was taken are replayed before the service reopens, so deleted accounts do not come back.

## Who else handles your data

- Hetzner hosts the server and the backup and export storage.
- Resend delivers sign-in emails. It receives your address and the one-time code for that purpose. Its own policy covers what it does next.
- The service does not run advertising or analytics trackers. [Owner to confirm before launch.]

## Moderation

Operators can invalidate a result, restrict ranked access or suspend an account. Invalidation and ranked restriction carry a reason for assisted input, implausible speed, replayed results, shared accounts, sanction evasion or repeated abuse. A person decides: automated checks alone cannot restrict an account. You can appeal; see the acceptable-use draft.

## Children

[Minimum age: owner and legal to decide before launch.]

## Changes and approval

This notice is a draft. When approved it will carry a version and date, and material changes will be announced in the service.