Privacy Notice
Last updated: 2026-11-08 · Version 2026-11-08
This notice explains what personal data NT Labs LLC (“we”) collects when you use Boost Type, why, who we share it with, how long we keep it, and what rights you have. For the plain-language explanation of the keystroke data in particular, read What we record when you type.
1. Who is responsible for your data
The controller is NT Labs LLC, 3000 SW 35th Place, Apt E309A, Gainesville, FL 32608 (United States). Privacy contact: [email protected]. We have not appointed a data protection officer.
EU/UK representative. [EU/UK REPRESENTATIVE: not yet decided]. If we are required to have an EU or UK representative under GDPR Art. 27 / UK GDPR, its details will be listed here and on the contact page.
Payments: we sell Pro and our payment provider, Stripe, hosts the checkout and processes your payment details, billing address and tax ID on our behalf. Stripe also uses payment data as an independent controller for its own fraud-prevention and legal purposes (see Stripe’s privacy policy). We receive your billing country and postcode (to calculate tax), your tax ID if you give one, the card brand and last four digits, and your invoices; we never receive or store full card numbers.
2. What we collect, why, and our lawful basis
| Data | Where it comes from | What we use it for | Lawful basis (EU/UK GDPR) |
|---|---|---|---|
| Account: email address, password hash (never the password itself), preferred settings (theme, test options, keyboard layout), accepted-terms record, age confirmation | You | Create and secure your account, sign you in, send service emails, remember your preferences, prove you accepted the Terms | Contract (Art. 6(1)(b)); legal obligation / legitimate interests for proof of acceptance |
| Typing data: for each run, the key pressed, the time of each key event, the text the test showed, the result and statistics derived from them | Recorded inside the typing box as you type | Calculate your speed and accuracy, find your weak keys, letter pairs and habits, build practice text, show your history and charts | Contract (Art. 6(1)(b)): this is the service you asked for |
| Billing: Stripe customer and subscription identifiers, plan, status and billing period, billing address and tax ID, invoices and tax records (full card details stay with Stripe) | You and Stripe | Take payment, manage your subscription and trial, issue invoices, calculate tax, handle refunds and disputes | Contract; legal obligation (tax and accounting law) |
| Consent and preference records: when and which version of the Terms, Privacy Notice, checkout terms and any withdrawal-right waiver you accepted; marketing-email choice | You | Show we obtained consent and honor your choices | Legal obligation and legitimate interests (defending claims); consent for marketing |
| Emails: the messages we send you, delivery status and, for service emails, whether they bounced | Us and our email provider | Verification, password resets, receipts, trial and renewal reminders, price-change and legal notices, optional tips and product news | Contract and legal obligation for service emails; consent for tips and product news |
| Technical and security data: IP address, browser and device type, request logs, error reports | Your browser | Keep the service secure, limit abuse and rate-limit requests, find and fix faults | Legitimate interests (Art. 6(1)(f)): running a secure and reliable service |
| Usage measurement: cookieless counts of page views and feature use, including the campaign parameters (utm_*) of the link that brought you here, recorded first-party with the visit and not shared with third parties | Your browser, without storing anything on your device | Understand which parts of the service are used so we can improve it | Legitimate interests |
| Support messages and anything you tell us when you write to us | You | Answer you and fix problems | Contract and legitimate interests |
We do not require you to give us any data beyond an email address and password to use the free plan. Typing data is generated only when you take a test or practice session while signed in or when you save results.
3. Keystroke data
We record the key you press and the time of each press and release only inside the typing box on text we supply. We do not run any key listener anywhere else on the service, and we cannot see what you type in other tabs, windows or applications. We use the data only to compute your statistics and practice recommendations. We do not use it to identify or authenticate you, to match accounts, to detect account sharing or to fraud-score. We do not sell it, we do not give raw keystrokes or per-person timing profiles to any third party or analytics tool, and we do not use session-replay software. Details, retention and deletion are in What we record when you type.
Races and leaderboards (only if you take part). Leaderboards list only people who chose a public name and switched leaderboards on; they show that name and your best results. In a race, the other racers see your public name (or “guest” with four characters) and your live progress. When you finish a race, a curve of how far through the text you were over time is kept, without any link to you, and may be replayed as a racer to fill a quiet race for people at a similar level; it contains no keystrokes, text or timing of individual keys. To keep rankings fair, results that would appear on a leaderboard or change a rating are checked for plausibility using statistics of that run alone (overall speed, how even the rhythm is, whether keys are released) and your own previous best. These checks never compare your typing with anyone else's and are not used to identify you; a result they hold back stays in your own statistics.
4. Who we share data with
We use service providers (“processors”) to host the service, store the database, send email, take payments, record errors and count page views. They may use personal data only on our instructions and under a data processing agreement. The current list, with what each receives and where, is on the Subprocessors page. We may also disclose data if required by law or to protect rights and safety, and to a successor if the business is sold (we will tell you and the same commitments will bind the successor). We do not sell personal data and do not share it for cross-context behavioral advertising.
5. International transfers
We serve users worldwide and some providers are in or access data from the United States and other countries. Where personal data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, we rely on the EU-US Data Privacy Framework (where the recipient is certified), Standard Contractual Clauses or the UK International Data Transfer Agreement/Addendum, plus supplementary measures where needed. You can ask for a copy of the safeguards at [email protected].
6. How long we keep data
| Data | Kept for |
|---|---|
| Account data | While your account is open. After you delete the account we purge it within 30 days. |
| Raw keystroke events (key and timing of each press) | 90 days after the run, then deleted. The derived statistics for each run are kept while your account is open. |
| Statistics, run summaries and practice history | While your account is open; deleted with it. |
| Backups | Deleted data can remain in encrypted backups for up to 35 days until they roll off, and is not restored to live use. |
| Server and security logs (incl. IP address) | Up to 30 days, unless needed to investigate abuse or an incident. |
| Billing, invoice and tax records | 10 years, because tax and accounting law requires it. These are retained even after account deletion. |
| Consent and acceptance records; withdrawal and cancellation records | For the life of your account plus 3 years, to show what you agreed to. |
| Privacy-request log | 3 years, to show we handled requests properly. |
| Deletion record (a one-way hash of your email and the date) | Up to 3 years, so that we do not email you again after you unsubscribed or deleted your account and can prove we deleted. |
| Free-trial record (a one-way hash of your email and the date) | Kept after account deletion, only so the free trial goes to first-time subscribers once. It cannot be turned back into your email. |
| Support correspondence | 2 years after the matter is closed. |
7. Your rights
Depending on where you live, you can: access your data; correct it; delete it; restrict or object to some processing (including processing based on legitimate interests); receive your data in a portable format; withdraw consent at any time (for example for marketing email) without affecting earlier processing; and not be subject to decisions based solely on automated processing with legal effects. We make no such decisions.
- Self-service. From your account you can download a copy of your data (JSON/CSV), delete your runs, delete your account, and change email preferences.
- By email. Write to [email protected]. We may need to confirm it is you. We respond within one month (extendable by two months for complex requests, as GDPR allows) and, for US state-law requests, within 45 days (extendable once by 45 days).
- Complaints. You can complain to your data protection authority (in the EU, the authority where you live or work; in the UK, the Information Commissioner’s Office at ico.org.uk), but we would appreciate the chance to put things right first.
8. United States state privacy rights, including California
In the 12 months before the date of this notice we collected the categories of personal information listed in section 2: identifiers (email, IP address), commercial information (subscription records), internet or electronic activity (use of the service and the typing data described above), and inferences limited to your typing statistics. We collected them from you and your browser, and disclosed them for business purposes to the processors listed on the Subprocessors page.
- We do not sell or share personal information as those terms are defined in the CCPA/CPRA and similar state laws, and we have no actual knowledge of selling or sharing the data of anyone under 16.
- We do not use or disclose sensitive personal information (including biometric information) for purposes that would require a right to limit. Keystroke timing is not used to identify you.
- We honor the Global Privacy Control signal. We do not run advertising trackers, so there is nothing to opt out of.
- Residents of California and other states with privacy laws may request access, deletion, correction and portability, and may appeal a refusal, using the methods in section 7. We will not discriminate against you for exercising a right.
- Do Not Track. We do not track you across other sites, so we treat Do Not Track signals the same as any other browser.
- California “Shine the Light”: we do not disclose personal information to third parties for their direct-marketing purposes.
9. Children
Boost Type is for people aged 16 and over. We do not knowingly collect personal data from anyone younger. If you think a child under 16 has an account, write to [email protected] and we will delete it.
10. Security
We protect data with encryption in transit, password hashing, restricted access to production systems, separate environments and the use of hosted checkout so card data never reaches our servers. No system is perfectly secure. If a breach affects your personal data, we will tell the supervisory authorities and you as the law requires. To report a vulnerability, email [email protected].
11. Email
We send service emails (verification, password reset, receipts, trial and renewal reminders, price and legal-term changes, security alerts) because they are part of the service; you cannot opt out of those while you have an account. We send tips and product news only if you opted in (the box at sign-up is unticked by default) and you can change this at any time in your account or with the unsubscribe link in each such message. Optional emails you request, such as a weekly progress report, can be switched off in your account. If you ask us to tell you when Pro is available, we send that one email and nothing more.
12. Cookies and similar technologies
We use only strictly necessary cookies and device storage (to keep you signed in, protect forms, and remember your theme and test settings), and cookieless analytics that do not store or read anything on your device. We therefore do not show a cookie banner. The full list is on Cookies and local storage.
13. Automated processing
Practice text is generated automatically from your typing statistics. This is a personalization feature and it does not produce legal or similarly significant effects. There is no automated decision-making about eligibility, pricing or account status based on your typing data.
14. Changes to this notice
This is version 2026-11-08. If we make a material change we will email you and show a notice in the app before it takes effect (at least 30 days ahead where the change reduces your protection or adds a new purpose). Earlier versions are available on request from [email protected].
This notice should be read with the Terms of Service and the Subscription Terms, which describe billing and your free trial.