Privacy
What this app knows about you.
Almost nothing, and this page says exactly what. It is written so a parent can read it in five minutes and a school technology director can answer their own questions from it.
Last updated: [PUBLICATION DATE] · Applies to nolooktyping.com and the app at /play/
- The short version
- What is stored on your computer
- What you type into it
- The optional account
- What leaves your computer, and when
- Sound and the spoken words
- Cookies, ads and trackers
- Your controls
- Children and parents
- For schools and districts
- If you are in the UK or Europe
- How long things are kept
- Changes, and how to reach us
1 · The short version
The app runs in your browser. Your practice stays there.
No Look Typing is a web page that teaches typing. Everything it learns about you — your speed, your accuracy, which keys you miss, which finger is slow — is written to your own browser's storage on your own computer. By default none of it is sent anywhere, and there is no account to make.
There is one optional feature that changes that: if you want your progress on a second computer, you can make an account. Then a copy of your progress is stored on our server so it can follow you. What that account holds is listed in full in section 4.
- No advertising. There are no ads anywhere and no ad networks.
- No analytics. There is no tracking script, no pixel, no session recorder, no crash reporter.
- No third-party services in the app. The app at
/play/loads no code, fonts, images or data from anyone else's servers. The marketing pages, including this one, do load a web font from Google — see section 5, because that is a real exception and we are not going to hide it. - No email address, no real name, no age, no school is ever required, and none is stored on our server even if you make an account.
- Nothing is sold, shared or handed to anyone. There is nobody to hand it to.
2 · On your computer
Everything the app remembers, it remembers locally.
The app uses your browser's localStorage. That is a small
box of text that belongs to this website and lives on your machine. It is
not a cookie, it is not sent with requests, and no other website can read
it. These are the entries the app creates:
| Entry | What is in it |
|---|---|
keyquest.save.v1 |
All of it: every player on this computer and their whole record — speed, accuracy, per-key and per-finger statistics, day-by-day history, levels passed, badges, the coach's notes, and any settings. (The name is historical; the app used to be called something else, and renaming the entry would erase everybody's progress.) |
keyquest.save.v1.broken |
Only appears if a saved file could not be read back. The unreadable copy is kept rather than thrown away, in case it can be rescued. |
keyquest.save.v1.probe |
A single character written and immediately deleted, to find out whether storage works at all (it does not, in some private windows). |
tbf.user, tbf.token,
tbf.profile |
Only if you sign in. Your username, the session token that keeps you signed in, and which player on this computer the account belongs to. Signing out removes the token. |
nolook.handoff |
If you took the typing test on the front page, the two results are left here so the app can pick them up instead of asking you to guess your speed. The app deletes it as soon as it reads it. |
The offline copy
The app installs a service worker, which keeps a copy of the app's own files (the page, the stylesheet, the scripts) in your browser's cache so it opens with no internet at all — on a school Chromebook on bad wifi, for instance. That cache holds program files, not your data, and it never contacts the accounts server.
How to get rid of all of it
Clearing site data for nolooktyping.com in your browser removes everything above, permanently, with no involvement from us. Inside the app, Settings has a DELETE button for each player, which states the hours and best speed about to be destroyed before it does it.
The other side of this promise: because your progress lives only in that browser, clearing your browsing data, reimaging a school laptop, or switching browsers loses it. The app periodically offers you a progress code to copy somewhere safe. That is not a formality — it is the backup.
3 · Text you type in
Three boxes let you type free text. Nothing checks what you put in them.
- Your name. When you first open the app it asks who is playing. A first name is plenty; it is only a label on a list of players on this computer, and any word works.
- Your interests. These are used to build a short story for you to type, generated on your own machine by a sentence grammar in the app. No language model, no server, no lookup.
- Your own text. You can paste up to 2,000 characters — homework, an email, anything — and practice on that instead.
All three are stored exactly like the rest of your progress: on your computer. If you sign in for an account, they are part of the backup that is uploaded, because the backup is the whole record. So do not paste anything into the app that you would mind having stored.
The app also asks your age band and how you type now, to
pick a starting plan. That answer is a category (for example
10to14), not a birthday, and it is stored with the rest of
your progress.
4 · The optional account
A username and a password. That is the entire list.
An account exists for one reason: so a child who practices at school and at home does not have two half-records. It is optional, the app works completely without it, and signing out never deletes anything.
What the server stores
| Held | What it is |
|---|---|
| Username | Whatever you chose. Three to sixteen
characters, letters, numbers, - and _.
Nothing requires it to be your name and nothing checks. |
| Password hash | Your password put through scrypt with a random salt. The password itself is never stored and cannot be read back out. |
| Recovery code hash | The same treatment for the recovery code shown to you once at sign-up. |
| Session tokens | Random values that keep you signed in, so your password is not sent on every sync. They expire after 60 days, a maximum of ten are kept, and changing your password invalidates all of them. |
| One save blob | A copy of your progress, exactly as described in section 2 — including anything you typed into the boxes in section 3. The server stores it and never looks inside it. |
| Two timestamps | When the account was made, and when it was last saved. |
What the server does not store
No email address. No real name. No age. No school, class or district. No phone number. No payment details, because there is nothing to pay for. No analytics of any kind. No log of your requests — the accounts service is written not to log them.
The first name you typed when you started is a label on your own machine and is not part of what is uploaded when you sync.
The cost of holding no email address: if you forget your password we cannot mail it to you, and we cannot warn you about anything by email either. That is why you are shown a recovery code once at sign-up and told to keep it. It is a genuine trade and we would rather state it than pretend it away.
Keeping accounts from being broken into
To stop somebody guessing passwords or filling the disk with junk accounts, the accounts service counts recent failures and requests in memory. Those counters are keyed partly by IP address: six wrong passwords for the same account from the same address locks that pair out for five minutes, more than forty requests a minute from one address is refused, and one address can create six accounts a day. These counters are held in memory only, are pruned as they age, and are gone when the service restarts. They are never written to disk.
A wrong username and a wrong password produce exactly the same error, and the server does the same work either way, so nobody can use it to find out whether a particular child has an account.
5 · Over the network
What actually leaves your computer.
- While you practice: nothing, unless you are signed in. The typing engine, the coach, the lessons, the charts and the sound all run in your browser.
- If you are signed in: your save blob is sent when the app loads and again about four seconds after you stop doing things. Nothing else is sent, and nothing is sent per-keystroke.
- Loading the pages. Getting a web page at all means your browser connects to our server, and any web server necessarily sees the IP address it is answering, along with the ordinary details of the request — which page, which browser. This is how the web works and we are not going to claim otherwise. How long those server records are kept is in the retention policy.
- Nothing to any third party, on any page. These pages used to
load a web font from Google, which meant Google's servers were told your
IP address and that a page here had been opened — from the privacy
policy itself. That is gone. Every page on this site, and the app at
/play/, now loads only from us, and the site uses whichever typefaces your computer already has. - Nothing else. There is exactly one place in the app's code that makes a network request, and it is the accounts API.
Where the data is
The account records sit on a single server operated by us, hosted with [HOSTING PROVIDER] in [COUNTRY / REGION]. They are stored as ordinary files, one per account, readable only by the account holder's own credentials through the API. There is no third-party database, no cloud analytics platform and no processor other than the hosting company that runs the machine.
6 · Sound and speech
The noises are made in your browser. The voice is your device's own.
Every sound the app makes is synthesised in the browser with WebAudio as it plays. There are no audio files, so nothing is downloaded and nothing is streamed.
The spelling practice says a word out loud. It does that by asking your
browser to speak, using the browser's own built-in speech feature
(speechSynthesis) — the same one that reads pages aloud.
We send it a word and a sentence and it speaks them. Be aware that
on some devices and browsers the built-in voices are provided by the
operating system and may be processed by the device maker's service rather
than entirely on the machine. That is outside our control and
outside our code; if it matters to you, the practice works without sound,
and your operating system's voice settings control which voice is used.
Nothing about that word or sentence goes to us.
8 · Your controls
Everything you can do, and where the button is.
- See everything held on the server. Settings → DOWNLOAD MY DATA. It asks for your password, then hands you a file containing your username, both timestamps and your entire save blob — that is the whole record.
- Delete the account. Settings → DELETE MY ACCOUNT. It asks for your password and then removes the account record and its sessions from the server. Your copy on that computer is left alone.
- Stop syncing without deleting. Sign out. The local copy is untouched.
- Delete one player on this computer. Settings has a delete button per player, which offers you their progress code first.
- Delete everything on this computer. Clear site data for nolooktyping.com in your browser.
- Move your progress by hand. Settings gives you a progress code — your player name and your record as one block of text — which you paste into another computer. It never touches our server. Treat it as private: anyone with it has that record.
Both of the first two need your password as well as an open session, so that somebody walking past an unlocked laptop cannot delete a child's year of work.
If a button will not work for you, write to hello@nolooktyping.com and we will do it by hand. We will need to be satisfied you are the account holder or their parent or guardian; since we hold no other identifying information, in practice that means knowing the username and answering from a position only its owner could hold.
9 · Children and parents
This app was built for a 13-year-old. He is the reason it exists.
No Look Typing is made by a father and his son, and the son is the first user. Children use it, so it is built to hold as little about a child as it possibly can while still doing its job.
- No child needs to give an email address, a real name, an age, a school or anything else to use it.
- Everything works with no account. An account is offered, not pushed, and the app tells you what it is for.
- If an account is made, the server holds a made-up username, a password hash, a recovery-code hash, session tokens and a blob of typing statistics. Nothing about that identifies a child to us, and it is never given to anyone else.
- There is no messaging, no chat, no leaderboard against strangers, no profile page and no way for one user to find or contact another.
- There is nothing to buy and no way to spend money.
If you are a parent
You can see everything held about your child and have it erased using the two buttons in section 8, from your child's own device, or by writing to hello@nolooktyping.com. You do not need to give a reason and we will not ask for more information about your child in order to delete what little we have.
If you would rather your child never sends anything anywhere at all, simply do not make an account. That is the default, and the app is complete without it.
This section describes what the software does. It is not a legal opinion about any particular law.
10 · For schools and districts
What a technology director needs, in one place.
What is collected
With no account (the default): nothing reaches us. The
app is a static web page. All student work product — keystroke
statistics, per-key accuracy, session history — is written to
localStorage in the browser profile on the device and stays
there.
With an optional account: a self-chosen username, a scrypt password hash, a recovery-code hash, session tokens, one opaque save blob of typing statistics, and two timestamps. No email, no name, no age field, no student ID, no school or district identifier, no IP address stored with the record.
What does not exist
- No rostering integration. No Clever, no ClassLink, no Google Classroom, no LTI, no SIS import, no CSV upload of student lists. There is no mechanism by which a class list could reach us.
- No teacher or admin dashboard, and therefore no place where one person can see another person's data. A student who wants to show a teacher their week uses a button that writes a plain-text summary to their own clipboard. It goes wherever they choose to paste it and nowhere else.
- No advertising, no ad networks, no behavioral profiling, no sale or disclosure of information, and no use of anything a student types for any purpose other than showing it back to them.
- No third-party trackers or analytics in the app. The app loads only its own files from our own server. (The marketing pages load a Google web font; see section 5.)
- No AI training. Nothing typed is used to train anything. There is no model in this product.
- No payment processing and no accounts payable relationship required to use it.
Where the data lives
On the device, in the browser profile, unless a student creates an account. Account records are files on a single server operated by us at [HOSTING PROVIDER] in [COUNTRY / REGION], transferred over HTTPS. There are no sub-processors other than that hosting company.
Deletion
- Device data: clear site data for nolooktyping.com, or reimage the machine. Nothing of ours survives it and nothing of ours needs to be asked.
- Account data: the student's own DELETE MY ACCOUNT button, or a written request to hello@nolooktyping.com naming the username.
- Bulk deletion: write to hello@nolooktyping.com with the usernames. Since accounts carry no school identifier, we cannot find "all accounts at your school" ourselves — a direct consequence of not collecting that, and a limitation worth knowing before you deploy it at scale.
- Automatic deletion: unused accounts are deleted on the schedule in the retention policy.
Access, offline and network
The app is one HTML page plus scripts and works offline after first load
via a service worker. It needs no plugins, no extensions and no installed
software. If your network blocks everything except an allowlist, the app
needs nolooktyping.com; the account sync uses
nolooktyping.com/tbf/ on the same host. It uses no
WebSockets and no other ports.
Paperwork
If your district requires a signed data privacy agreement, a state student-data-privacy addendum, a security questionnaire or an entry in a registry, write to hello@nolooktyping.com. [STATUS OF DPA / SDPC PARTICIPATION — TO BE COMPLETED]
11 · Outside the United States
If you are in the UK or Europe.
The site is reachable from anywhere, so people outside the United States use it. What that means in practice:
- If you never make an account, we hold nothing about you at all beyond the ordinary server records described in section 5.
- If you make an account, the only things held are listed in section 4, and you can download or delete all of it yourself at any time from the app.
- The server is in [COUNTRY / REGION], so using an account may mean your progress is stored outside your own country.
- To ask about anything held, or to have it corrected or erased, write to hello@nolooktyping.com.
[LAWFUL BASIS, DATA CONTROLLER IDENTITY, EU/UK REPRESENTATIVE AND TRANSFER MECHANISM — FOR LEGAL REVIEW]
12 · Retention
How long any of this is kept.
Written out in full, with the numbers and the reasoning, on its own page: how long we keep things. The short answer is that data on your computer stays until you clear it, and an account that nobody uses is deleted automatically.
13 · Changes and contact
If this page changes.
If what the software does changes, this page changes with it, and the date at the top changes. If a change ever means something new is collected or something is sent somewhere new, the app will say so on screen rather than leaving it to a page nobody opens.
Questions, requests, or anything that looks wrong here: hello@nolooktyping.com.
No Look Typing is made by [NAME OF THE PERSON OR ENTITY RESPONSIBLE], contactable at [POSTAL ADDRESS IF REQUIRED].