Data retention policy

How long anything is kept.

Holding a child's information forever, just because a server has room, is not a decision anyone should make by accident. So here is the schedule, with the actual numbers and the reasoning for each one.

Last updated: [PUBLICATION DATE] · Schedule in effect from [EFFECTIVE DATE]

1 · The rule we work to

Hold as little as possible, for as short as the product allows.

Two things follow from that, and they run through everything below:

Most of what the app knows is never held by us at all. Your progress lives in your own browser. We cannot read it, cannot delete it and never receive it — unless you choose to make an account.
What we do hold has an expiry. An account nobody uses is deleted automatically. Nothing here is kept indefinitely, and nothing is kept because it might be useful one day.

This page is part of our privacy notice and should be read with it. Section 4 there lists exactly what an account holds.

2 · The schedule

Everything held, and for how long.

What	Where it is	How long	What deletes it
Your progress — every player on the machine, their statistics, history and settings	Your own browser, on your own device	Until you remove it. We have no copy and no access.	Deleting the player in Settings, or clearing site data for nolooktyping.com. Also lost if the browser or the machine is wiped.
The offline copy of the app's own files	Your browser's cache	Until replaced by a newer version or cleared	Clearing site data. Contains program files, not your data.
Account record — username, password hash, recovery code hash, save blob, two timestamps	Our server	18 months after the account was last used, then deleted automatically	Any sign-in or sync resets the clock. DELETE MY ACCOUNT deletes it immediately.
Session tokens (what keeps you signed in)	Our server	60 days from issue, and only the ten most recent are kept	Expiry, signing out, changing your password (which clears all of them), or deleting the account.
Anti-abuse counters — failed sign-ins and request rates, keyed partly by IP address	Our server, in memory only	Minutes to hours. Lockouts last five minutes; rate windows are one minute and one day; entries are pruned as they age.	Aging out, or the service restarting. Never written to disk.
Accounts API request logs	Nowhere	Not kept. The accounts service is written not to log requests.	—
Web server records for serving the pages, which include IP addresses	Our server	[LOG RETENTION — PROPOSED: 14 DAYS]	Automatic rotation.
Backups of account files	[BACKUP LOCATION — TO CONFIRM]	[BACKUP RETENTION — PROPOSED: 30 DAYS, ROLLING]	Rotation. A deleted account disappears from backups within the same window.

3 · The account rule

Eighteen months, and why that number.

18 months with no sign-in and no sync, then the account is deleted

15 months: the app starts warning, on any device still signed in

0 days if you press DELETE MY ACCOUNT — it goes straight away

What counts as using it

Signing in, or the app syncing your progress in the background while you practise. Both update the account's timestamp, so anybody who opens the app even once inside eighteen months keeps everything. You do not have to do anything special, and you do not have to remember this page.

Why eighteen months and not six, or forever

The product is about the long run. The charts show a month of speeds, ten weeks of practice days, the speed you started at against the speed you are at now, and whether a problem the coach fixed has come back. Deleting somebody's account after a few quiet months would throw away the thing that makes it worth doing.
A school year plus a summer is twelve months. A child who stops in June, is off all summer, and comes back the following spring must not find their record gone. Eighteen months clears that comfortably.
Eighteen months of complete silence is an abandoned account. There is no honest purpose in keeping a child's typing record for a second year after the last time anyone opened it, and "storage is cheap" is not a reason.

The consequence of collecting no email address, stated plainly. We cannot warn you that your account is about to be deleted, because we have no way to contact you. The warning appears in the app, on any device still signed in, from three months out — and if nobody signs in anywhere in eighteen months, nobody will ever see it.

That is a real cost and we are choosing it deliberately. The alternative is holding an email address for every child who uses a free typing app, forever, so that we can send one message. Losing an unused typing record is a smaller harm than that, and anyone who wants a permanent copy can keep a progress code, which never expires and never involves us.

4 · Deletion

What "deleted" actually means here.

When an account is deleted — by you, or automatically — the account file is removed from the server and every session token for it is invalidated and removed. There is no "deactivated" state, no archive, and no soft-delete flag we could reverse. The record is gone and cannot be restored, by us or by anyone.

The only remaining copy is in backups, which roll over on the schedule in the table above, after which no copy exists anywhere.

Your own device is not touched by any of this. Deleting the account stops the syncing; the progress on your computer stays exactly where it is until you remove it yourself.

5 · If we ever stop

What happens to stored accounts if the service closes.

This is run by two people and could one day stop. If it does:

We will say so on this site at least [NOTICE PERIOD — PROPOSED: 60 DAYS] before anything is switched off, and the app will say so on screen.
Every account holder will be able to download their data with the button they already have, and every player can copy a progress code.
All account records will be deleted within [WIND-DOWN WINDOW — PROPOSED: 30 DAYS] of the shutdown date, and backups purged within the backup window after that.
Account records would not be sold or transferred as an asset. If the app itself ever changed hands, accounts would be deleted rather than handed over, and people would be told first. [CONFIRM THIS COMMITMENT BEFORE PUBLISHING]

6 · Sooner, if you want

You never have to wait for the schedule.

Delete the account now: Settings → DELETE MY ACCOUNT. It asks for your password and then it is done.
Take a copy first: Settings → DOWNLOAD MY DATA hands you everything the server holds, as a file.
Delete a player from the computer: Settings has a delete button per player.
Remove everything on the device: clear site data for nolooktyping.com.
Ask us: [CONTACT EMAIL]. A parent, guardian, or a school acting for a student can ask, and we will not demand more information about a child in order to delete the little we hold.

7 · Changes

If this schedule changes.

If any period on this page changes, the date at the top changes with it, and a change that would delete things sooner will be announced in the app before it takes effect — with enough time to download a copy first.

Questions about anything on this page: [CONTACT EMAIL].