Privacy Policy
This Privacy Policy describes how MangoTyping handles information when you visit mangotyping.fun, create or use an account, use Google sign-in, practise typing, submit a support or bug report, or make an optional donation. MangoTyping is an independent typing-practice project.
For questions, access or deletion requests, privacy complaints, or security concerns, email support@mangotyping.fun. Do not send passwords, full payment credentials, or another person's private information.
1. Information we collect
- Account and profile data: username, email address, password hash (not the original password), profile image when provided, account identifiers, and account creation or security-related timestamps.
- Google sign-in data, when you choose it: Google’s sign-in credential is sent to our server for verification. We may receive and store the Google account's stable identifier, verified email, and profile name or picture if available. We use this information to authenticate you, associate the Google account with a MangoTyping account, and optionally show the profile image. MangoTyping does not receive your Google password and this sign-in flow does not ask for access to Gmail, Google Drive, contacts, or other Google content APIs.
- Typing and service activity: typing-test sheet or mode, words-per-minute and raw speed metrics, accuracy, errors, duration, per-second statistics, timestamps, and saved test history. Results are associated with an account when they are saved as account history; guest activity is not intentionally linked to an account unless submitted or saved while signed in.
- Donation and transaction data: amount, order/payment identifiers, status, timestamps, and account association when relevant. The payment provider handles payment credentials. MangoTyping does not intentionally store full payment-card numbers, CVV/CVC codes, UPI PINs, or banking passwords.
- Support, bug reports, and privacy requests: the message and any attachments you choose to submit, details needed to investigate an issue, and the type, status, and handling history of a privacy request. Please avoid including secrets or other people's private information.
- Technical and security information: IP address or similar request metadata used for abuse prevention, rate limits, authentication, incident investigations, operational logs, and audit records.
2. How we use information
We use information to create and authenticate accounts; deliver typing tests, printable sheets, games, lessons, and saved history; show account profiles; maintain security, rate limits and fraud prevention; process and reconcile voluntary donations; send verification codes and account notices; respond to support and privacy requests; diagnose bugs; maintain and improve the service; and meet applicable legal obligations.
We do not sell personal information and do not use MangoTyping data for targeted advertising. We do not use Google sign-in to read Gmail, Google Drive, contacts, or other personal Google content.
3. Cookies and browser storage
MangoTyping uses an HTTP-only authentication cookie for signed-in sessions, with security attributes set by the server. HTTP-only cookies cannot be read directly by page JavaScript. The site may use browser storage for non-sensitive preferences such as interface settings. Authentication passwords and bearer tokens are not intentionally stored in browser localStorage. Your browser may also store standard technical information necessary to load the site.
4. Service providers and sharing
We share information with service providers only as needed to run the feature or infrastructure they supply, and with authorities or other parties where required or permitted by law, to protect users, prevent fraud, enforce terms, or address security incidents.
- Google Identity Services provides optional Google sign-in. Google's own terms and privacy policy apply to Google's service: Google Privacy Policy.
- Razorpay may process credentials and payment details if you choose to donate. See Razorpay's privacy information.
- Neon provides the PostgreSQL database infrastructure used for application records. See Neon's privacy policy.
- Vercel hosts and delivers the website and deployment infrastructure, and may process request and operational data for these purposes. See Vercel's privacy policy.
- Email/SMTP and support services may process messages necessary to send verification codes or account notices. If a third-party support channel is enabled, reports or attachments sent to it may be processed by that provider.
Providers process data under their own systems and policies. MangoTyping is not responsible for the independent privacy practices of external services. A provider's use of data is subject to its own terms and applicable agreements.
5. International processing
Some providers may store or process information in countries other than where you live. Where applicable law requires safeguards for international transfers, the appropriate safeguards should be applied to the relevant processing.
6. Retention and deletion
We retain information for as long as reasonably necessary to provide the service, maintain accounts and saved history, handle support and security incidents, reconcile transactions, resolve disputes, and meet legal obligations. Verification codes and other temporary authentication data are designed to expire. Backups and provider systems may retain information for limited periods according to their retention cycles. Transaction or security records may be retained where needed for legal compliance, accounting, fraud prevention, payment disputes, or investigation.
You can request account deletion through Settings if your account has a password, or contact support@mangotyping.fun for assistance. The current self-service flow requires password confirmation and an emailed verification code, so Google-only accounts without a password need support assistance. The application deletes account-linked typing history and donation records during successful account deletion. Some audit or security records may remain without direct account linkage, and payment providers or other independent processors may retain their own transaction records under their policies or legal obligations. Backups may persist for a limited period under provider retention cycles.
7. Children and younger users
MangoTyping is a general typing-practice service and does not use children's personal information for targeted advertising or behavioural profiling. Where applicable law requires verifiable consent or authorisation from a parent or lawful guardian, that consent must be obtained before the relevant personal data is processed. The website does not currently provide an automated, verified in-app parental-consent flow. A parent or lawful guardian should contact support@mangotyping.fun before a child creates an account where such consent is required; do not create the account until the required consent has been arranged. If we learn that personal data is being processed without consent required by law, we will restrict the processing and review appropriate deletion or other remedial action.
8. Security
We apply reasonable technical and organisational safeguards appropriate to the service, including password hashing, server-controlled authentication cookies, CSRF and origin checks for mutations, rate limiting, access controls, security headers, validation, encrypted storage for configured secrets, audit logging, and payment-signature checks. No internet service can guarantee absolute security. Keep your account credentials private and report suspected security issues promptly.
9. Your choices and rights
Depending on the law that applies to you, you may be able to request access to, correction of, or deletion of your personal information, withdraw consent where processing relies on consent, or make a complaint. Use the Privacy & Data section in Settings to submit an access, correction, deletion, consent-withdrawal, or grievance request and track its status, or email support@mangotyping.fun. You can also download an account-data export from Settings. Password-based accounts can be deleted from Settings after confirming the password and an emailed verification code. Google-only accounts without a password cannot use that self-service deletion flow yet and should contact support for assistance. We may ask for information needed to verify a request and may retain information where the law permits or requires it.
10. Third-party links
The website may link to external provider policies or services. Opening an external link takes you to a service operated under its own terms and privacy practices. See our Third-party Services Notice for a summary of provider roles.
11. Changes to this policy
We may update this policy when the service, providers, processing, or applicable law changes. The date and version above identify this revision. Where applicable law requires renewed acceptance or notice for a material change, we will take the required steps.