Privacy Policy

Last updated: 26 July 2026

This Privacy Policy explains what information Keyboardo ("we", "us") collects when you use keyboardo.com, why we collect it, how long we keep it, and the choices you have. We have tried to keep it plain and specific. Using Keyboardo without an account requires no personal information at all.

Information we collect

If you create an account, we store the username and email address you provide and a securely hashed version of your password (hashed with Argon2id — we never store or see your actual password). Your email address is used to sign you in, to send account and security notifications, and to let you recover access if you forget your password.

When you complete a typing test while signed in, we store a summary of that test — words per minute, accuracy, consistency, character counts, duration and the time it was taken — so we can show your history, statistics, personal bests and leaderboard standings. We do not store the raw log of your individual keystrokes: it is used briefly to confirm the result is genuine and is then discarded, never written to our database.

Cookies and local storage

Keyboardo sets one essential cookie, "kb_sess", which keeps you signed in and protects forms against cross-site request forgery. It is strictly necessary for the site to work, so it is set without a consent prompt; it holds only a random session identifier and no personal data.

Your browser's local storage holds your preferences (theme, language and test settings), any results you save before creating an account, and your chosen theme. This information stays on your device. You can clear it at any time through your browser, and creating an account lets you optionally import the results you saved while anonymous.

Traffic measurement

We count our own page views, so we can tell whether the site is growing and which pages are actually useful. This is done entirely on our own server, after the page has already been sent to you. There is no third-party analytics service, no Google Analytics, no tracking script, no tracking pixel and no JavaScript involved. For each page view we record exactly this and nothing else: the date and time; which of thirteen page categories was viewed — for example "leaderboard", "profile" or "privacy", never which profile or the full address you asked for; a category for where you came from, worked out from the referring site and limited to a fixed list such as "Google", "Reddit", "direct" or "other"; whether the request looks like a desktop, a mobile, a tablet or a search-engine crawler; a two-letter country code, but only when our network provider already includes it in the request (we never look your location up, and it is recorded as "unknown" when it is not supplied); and the short cookieless value described in the next paragraph. The one exception is a request for a page that does not exist: for those we also record the address that was asked for, so we can repair broken links. Anything after a "?" is removed before that address is written down, so a mistyped link can never put a one-time token in our records.

No cookie is set for measurement, and nothing is stored on or read from your device. To count someone who reads three pages as one visitor rather than three, we combine your IP address, your browser's user-agent string and a secret random value we generate fresh each day, hash the three together, and keep only the first 16 characters of the result. Your IP address itself is never written to a file and never reaches our database — it exists in memory for the fraction of a second it takes to compute that value, and is then gone. The day's secret is destroyed at the start of the next day and cannot be reconstructed, so the values recorded yesterday can never be linked to the values recorded today: not by us, not by a court order, and not by anyone who obtains a copy of our data. Recognising a returning visitor is impossible here by design, and that is the point rather than an oversight.

The raw per-request lines are written to a plain text file kept outside the public web directory, and are deleted after 3 days. The daily visitor values are deleted after 2 days, together with the secret that produced them. What survives is aggregate counts only — for example "412 views of the leaderboard from Google on 12 May" — with no record of any individual person or session: daily totals per page, source, device and country for 400 days, the broken-link report for 180 days, and a single row of daily headline totals that we keep indefinitely so that one year can be compared with another.

You can opt out, and it takes effect immediately. We honour the "Do Not Track" and "Global Privacy Control" signals: if your browser or privacy extension sends either one — several send GPC by default — nothing is recorded for your requests at all, not even an anonymous count. You can also opt out permanently in any browser by setting a cookie named "kb_no_analytics" to any value for this site; while it is present no measurement line is written. Opting out costs you nothing: every part of Keyboardo works exactly the same either way.

Password-reset requests

When someone requests a password reset, we log the IP address the request came from alongside the one-time reset link. This exists solely to investigate abuse, such as floods of reset requests. The record is short-lived: it is deleted together with the reset token once the token is used or expires (reset links are valid for one hour), by a daily housekeeping job — so at most about a day later — and no separate copy is kept. Apart from this and short-lived rate-limiting counters, which are retained for at most 48 hours, we do not keep logs of visitors' IP addresses; the traffic measurement described above never writes one down at all.

Account deletion and data retention

You can delete your account at any time from your settings. Deletion is immediate but staged: your account is instantly hidden and removed from every leaderboard, and after a 30-day grace period it and all associated data — results, statistics, preferences, achievements and streaks — are permanently erased. During the grace period your username and email stay reserved so no one else can take them. Deletion is final; an account cannot be recovered once it has been purged.

Advertising

Keyboardo may show advertising to help cover its running costs. When advertising is enabled we use Google AdSense. Google and its partners may use cookies and similar technologies to serve ads based on your prior visits to this and other websites, which can include personalized advertising.

You can control or opt out of personalized advertising through Google Ads Settings at adssettings.google.com, and learn more from Google's advertising and privacy information at policies.google.com/technologies/ads. In many regions you can also opt out of third-party ad-serving cookies at youradchoices.com or youronlinechoices.eu. We do not use Google Analytics or any other third-party analytics or tracking service, and never have: the only measurement we perform is the first-party page counting described under "Traffic measurement" above.

When advertising is enabled and you are in the European Economic Area, the United Kingdom or Switzerland, we ask for your consent before any advertising or measurement cookie is set, using a consent management platform certified by Google. You can decline personalized advertising and still use every part of Keyboardo, and the same consent tool lets you review, change or withdraw your choice at any time.

Your choices and rights

From your account settings you can change your email and password, and delete your account entirely. Your profile page shows the data we hold about your typing: your statistics, personal bests, activity and achievements. You can switch off traffic measurement as described above. If you have a question about your data or want to exercise a privacy right available to you, contact us using the details below.

Children

Keyboardo is a general-audience typing test. It is not directed at children, and we do not knowingly create accounts for or collect personal information from anyone under 13 (or under 16 where local law sets that age). If you believe a child has created an account, contact us at the address below and we will delete the account and its data promptly.

Contact

For any privacy question or request, email [email protected].

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "last updated" date at the top of this page. Continued use of Keyboardo after an update means you accept the revised policy.