Privacy policy
Policy version 2026-09-29-r1 · Effective 2026-09-29
- Operator
- Yamami Lab
- Contact
- support@type-stride.com
This notice explains the current pre-release implementation. It is not a promise that every type of learning data is cloud-synchronised or encrypted. Operator review must resolve deployment-specific log, backup, provider and retention details before broad public use.
1. Purpose and responsibility
Information is used to provide the learning functions you choose, authenticate accounts, preserve selected results, display opted-in rankings, prevent misuse and respond to service questions or technical reports. This support feature does not sell submitted information, add advertising analytics or send reports to an AI provider. Research participation or a different purpose is not silently inferred from ordinary practice or from a support request.
2. What stays in the browser and what is sent
| Function | Current handling |
|---|---|
| Guest practice, Learn, Write and Custom Text | Guest history and settings, Learn progress, Write responses/Timeline, pasted Custom Text and onboarding are stored locally. Signing in does not automatically upload Learn/Write text. Local storage is not encrypted by this app. Anyone with access to your unlocked browser profile may be able to access local data. |
| Account and Practice / Check | Registration and recovery use a verified email address, display name, internal account ID and password hash. Signed-in completed Practice/Check summaries, selected preferences and aggregate key/pattern information may be synced. Guest history is attached only after separate confirmation. New account creation also records your Terms agreement and Privacy/storage acknowledgement, the versions and content hashes of the documents, and the server-recorded UTC time. This record uses your internal account ID; it does not separately collect your IP, browser identity, password, email address or writing text. |
| Challenge / server Flow | When you choose these modes, scored input and relative timings are sent after the run for validation; summaries and integrity hashes are retained instead of the raw trace. Pending submissions and their exports can still contain the trace. Public or member-visible boards use a separate opt-in alias. Operational administrators may review private run summaries. |
| Immediate Insights | The session pace plot is derived from existing in-memory events after the run. This version does not add persistent raw-event storage or replay of earlier runs. |
| Updates | The browser checks a small same-origin release file at safe idle points. No learning records are sent in that request. The current tab may remember a dismissed release in session storage. Normal server access logs can still record the request and IP address. |
3. Contact and bug reports
The form sends only the fields you submit: request type, subject, message or reproduction steps, expected/actual behaviour, and a reply email when supplied. A random request ID supports retrying the same submission without another copy. The form does not automatically read your account ID, saved history, answers, passwords, screenshots or clipboard.
For bug reports, an optional unchecked box adds the app version, a general page category, browser family/major version, rounded viewport size and theme. The information is shown before submission. It excludes full URLs, query strings and fragment tokens. Choosing not to include it does not stop you from submitting a report.
Connections necessarily expose network metadata to the server. The support application uses a keyed hash of the connection IP for rate limiting rather than saving the raw IP in the support record. Provider or web-server logs may separately retain IP addresses and request metadata.
4. Cookies, security and providers
Account/Admin cookies support authentication. An enabled support form uses a separate Secure, HttpOnly, SameSite cookie for request verification, with an approximately one-day lifetime. A one-hour form token helps prevent cross-site submission. These cookies are not marketing identifiers.
The application is deployed on CORESERVER. Authorised administrators can access the support inbox. Support content is encrypted at rest using AES-GCM; the key is stored separately from the web-served directory but on the same server. This protects accidental exposure of individual data files, not a server takeover. Existing account DB data and downloaded backups are not made encrypted by this release. Replies sent from a mail account are also handled by the relevant mail provider.
Disclosure may be necessary where required by applicable law or to protect the service in accordance with law. No new third-party tracking, CAPTCHA provider, support SaaS or automatic report email is introduced by these forms.
5. Retention and deletion
Browser data remains until removed by you or the browser, or affected by the relevant mode's storage limits. Server learning summaries remain subject to account controls and capacity limits; there is no new timed deletion rule for all learning data in this release.
Support requests expire 90 days after receipt. Expired requests are removed when the support inbox is accessed or a new report is accepted, or when the administrator runs the expiry command. This is not a daily scheduled purge. Marking a request resolved does not restart its retention period.
Support-rate entries expire within one day and are pruned on subsequent rate checks. No password or learning answer is placed in the support record automatically. If you type sensitive information into a report, that text is part of the report, so check it carefully.
Deleting a learner account does not automatically erase a separately submitted support request, exported files, other browser profiles or existing backups. Ask about support deletion using your receipt and the supplied reply address. Backup copies and mailbox correspondence have separate retention that the operator must define and explain before broad release; deletion from the live inbox does not instantly remove those copies.
Your registration-confirmation record is kept with your live account and is included in the account export. Deleting the live account removes that record with it; previously created backups and downloaded exports follow separate retention. Existing accounts receive no fabricated acceptance record. The timestamp records the server accepting your confirmation, not proof that you read or understood every word.
6. Your choices and requests
You can use guest practice, choose whether to join a ranking, decline optional diagnostic details and stop using the service. See Help & data safety for export and local-storage limits. Use Contact or the published contact address to request access, correction, deletion, restriction or an explanation of handling, as applicable. Identity checks may be needed; do not disclose passwords or verification links. Anonymous bug reports without a reply address may be difficult to match to a later request.
7. Notice changes
The notice version and operator-confirmed effective date appear above. A new app-version banner is separate from a privacy notice and is not consent to a new data use. No retroactive record of acceptance is created for existing accounts by adding this page.