Privacy Policy

This Privacy Policy explains how Pexels360 Solutions LLP ("Pexels360", "we", "us"), the operator of TypeLords (typelords.com), collects, uses, stores, and shares your personal information when you use our service.

We're a small team. We try to collect as little as possible, keep what we collect secure, and never sell it.

1. Who we are

Pexels360 Solutions LLP
Goa, India
GSTIN: 30ABAFP8471F1ZF
Contact: ping@typelords.com

Pexels360 is the Data Fiduciary for purposes of India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Data Controller for purposes of the EU General Data Protection Regulation ("GDPR") where applicable.

2. Age requirement

TypeLords is intended for users 18 years of age and older. We do not knowingly collect personal information from anyone under 18. By creating an account, you confirm that you are at least 18 years old.

If we learn that we have inadvertently collected personal information from a person under 18, we will delete that account and the associated data promptly. If you believe a minor has registered, write to ping@typelords.com and we will act within 30 days.

3. What we collect

Information you give us

• Account information — your name, email address, and country (auto-detected from your IP at signup, editable from the console).
• Authentication data — if you sign in with Google, we receive your Google email, name, and profile picture URL; we do not access anything else from your Google account. If you sign in with email, we send a one-time code to verify the address.
• Profile information — your chosen avatar (from our preset set) and any profile-privacy preference you toggle.
• Payment information — your name, email, billing country, and the amount paid for any stage unlock. We do not see or store your card or bank details. Payments are processed by PayU (India) or PayPal (international); they handle your financial information directly under their own privacy policies.
• Support correspondence — anything you send us by email at ping@typelords.com.

Information we generate from your use

• Activity results — for each completed typing run across TypeWars, TypeLegends, TypeAcademy, TypeCareers, TypeTest, TypePractice, and TypeH2H: words-per-minute, accuracy, consistency, duration, correct/incorrect character counts, and the timestamp of the run.
• Progression data — your current rank stage, current level, total activities completed, TL Coin balance, certificates earned, and any stage unlocks you have purchased.
• Session data — a server-side session token (hashed before storage) with a sliding 30-day expiry, used to keep you signed in.
• Anti-cheat telemetry — for each completed typing run we capture per-keystroke timing metadata, run-level events (paste, blur, etc.), and a coarse device fingerprint (browser, OS, screen size, timezone, language, platform). This data is examined for cheating signals; if no signals fire, nothing is persisted. If one or more signals fire, the telemetry and device fingerprint are stored for admin review under our anti-cheat program. We do not collect IP addresses, geolocation, or canvas/audio fingerprints for this purpose.
• Referrals — if you arrived via a referral link, we record which existing user referred you. If you invite others, we record the invitations you generate.

Information collected automatically

• Country — we infer your country from your IP at signup to set the default for invoicing and language preferences. We do not retain raw IP addresses.
• Conversion events — we use Google Ads conversion tracking to measure the effectiveness of any advertising we run. This places a small number of cookies set by Google. See Section 6 for details.

4. How we use your information

• To create and operate your account.
• To run the typing activities — generating passages, recording results, ranking participants, awarding TL Coins, advancing your rank journey, issuing certificates.
• To process and complete stage-unlock payments and issue invoices.
• To send you transactional emails: a welcome email on signup, a notification when you reach a new rank, and a confirmation when you unlock a new stage. We do not send marketing emails.
• To detect and review cheating attempts via the anti-cheat program described above. Confirmed cheats may result in certificate revocation and account suspension.
• To analyse aggregate, non-identifying usage patterns so we can improve the product.
• To comply with legal obligations (e.g. tax record-keeping for payments).

5. Legal basis for processing

For users covered by the DPDP Act (India), we process your data on the basis of your consent given at signup, except where another lawful ground applies (e.g. compliance with tax laws).

For users covered by the GDPR (EU/EEA/UK):

• Contract — operating your account, running the typing activities, processing payments.
• Legitimate interests — anti-cheat detection, aggregate analytics, security, fraud prevention.
• Consent — Google Ads conversion tracking and any future non-essential cookies.
• Legal obligation — retention of payment records.

6. Cookies and similar technologies

We use cookies only where necessary to provide the service or where you have consented. Categories:

• Essential — your session cookie. Without it you cannot stay signed in. No consent is required for essential cookies.
• Conversion tracking — Google Ads conversion tag. This sets cookies controlled by Google and is used to measure ad effectiveness. If you are in the EU/EEA/UK and we have not obtained your consent, this tag does not fire for you.

We do not use analytics cookies, advertising-network cookies (beyond the conversion tag above), social-media tracking pixels, or cross-site behavioural tracking.

7. Sharing your information

We never sell or rent your personal information. We share it only with the following categories of service providers, and only as needed for them to do their job for us:

• Vercel (USA) — application hosting.
• Neon (USA/EU) — managed PostgreSQL database.
• Cloudflare (USA, global) — DNS and CDN.
• Resend (USA) — transactional email delivery (welcome, rank earned, stage unlocked, support replies).
• PayU (India) — Indian payment processing.
• PayPal (USA/global) — international payment processing.
• Google (USA) — Sign-In with Google and (where consented) Google Ads conversion measurement.
• Anthropic (USA) — generation of typing passages (your activity results are never sent to Anthropic).

We will disclose your information if required by a valid legal process (court order, government order, applicable law) and only to the extent strictly required.

8. International data transfers

Some of the service providers above are located outside India and the EU. Where personal data is transferred to such providers, we rely on the providers' own appropriate safeguards (e.g. EU Standard Contractual Clauses, equivalent contractual protections) and process data only as needed to operate the service.

9. How long we keep your data

• Account and activity data — for as long as your account exists. Delete your account by writing to ping@typelords.com.
• Session tokens — up to 30 days from last use, after which they expire automatically.
• Suspect-signal telemetry — up to 12 months after the signal is reviewed, then purged.
• Payment records and invoices — 8 years, as required by Indian tax law.
• Email logs— per our email provider's retention (Resend, currently a rolling window of recent deliverability data).

When you delete your account, your name, profile, runs, journey, coins, and referrals are removed. Payment and invoice records are retained as required by law, with personal identifiers minimised where possible.

10. Your rights

Subject to applicable law, you have the following rights over your personal information:

• Access — request a copy of the personal data we hold about you.
• Correction — fix anything inaccurate. Most profile fields are directly editable from your console; for anything else, email us.
• Deletion — close your account and erase your personal data, subject to retention obligations we are legally required to honour.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent — at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Object — to processing based on legitimate interests (where GDPR applies).
• Lodge a complaint — with the Data Protection Board of India (under DPDP), or your local data protection authority (under GDPR).

To exercise any of these rights, email us at ping@typelords.com from the address associated with your account. We will respond within 30 days.

11. Security

We use industry-standard measures to protect your data: encrypted transport (HTTPS everywhere), encrypted storage at rest in our database, hashed session tokens, bcrypt-hashed admin credentials, 2FA on admin access, and least-privilege service credentials. We never have access to your card or bank details — those go directly to the payment processor.

No system is perfectly secure. If a personal data breach materially affects you, we will notify you and the Data Protection Board of India (and your supervisory authority under GDPR, if applicable) without undue delay.

12. California residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, including the right to know what personal information we collect, the right to delete personal information, the right to correct inaccurate personal information, and the right to opt out of any "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined under the CCPA. To exercise your rights, email ping@typelords.com.

13. Changes to this policy

We update this policy when our practices change. The "Last updated" date at the top reflects the most recent revision. Material changes will be communicated by email to active users.

14. Contact

Questions, concerns, or requests: ping@typelords.com.