Privacy Policy

1. Who we are

League of Keyboards is an online competitive typing game operated by Stone Pit Sons Software Ltd. Şti. (kuruluş aşamasında), based in İstanbul, Türkiye.

For privacy questions contact privacy@leagueofkeyboards.com. Company registration details will be published here once the registration is complete.

2. Data we collect

Account: you can play with just a username. We then create an anonymous account with no email or password: we store your username and a random account id, and a sign-in cookie in your browser keeps you signed in. If you sign in with Google or Discord we also receive your name, email, avatar and provider id.

Bot check: when you submit a username to create an anonymous account, or ask for an email sign-in link, Cloudflare Turnstile may check that you are not a bot. Its script loads only at that moment, not when you just view the page. For this check it processes your IP address and browser signals.

Gameplay: keystroke timelines, scores, WPM/accuracy, match and challenge data.

Ghost replays: your finished runs (keystroke timing and score) may be shown to other players as a ghost opponent. A ghost is a replay of a past run, never a live player: it is labelled as a ghost and shows your username.

Usage & analytics: events such as page views and gameplay actions, via PostHog (EU-hosted).

Technical: IP address, device/browser information, approximate location and server logs. As an online competitive game we log this to run rankings, prevent cheating and secure accounts. Rate limits count requests per IP address (for IPv6, per /64 network) in short-lived counters that expire within minutes.

Cookies: see the Cookies section below.

3. Why we process it

To provide the game, accounts, leaderboards and rankings; to run anti-cheat and fair play; for analytics and product improvement; for security and abuse prevention; and to meet legal obligations.

4. Legal bases

Performance of a contract (providing the service you request); our legitimate interests (security, anti-cheat, analytics); your consent (analytics/cookies where required); and legal obligations.

5. Sharing & processors

We use third-party processors under data processing terms: PostHog (EU-hosted analytics), Supabase (database, authentication, storage), Vercel (hosting), Upstash (cache/leaderboard), Resend (email delivery) and Cloudflare (Turnstile bot check).

Advertising: the site may show ads served by Google AdSense in clearly labelled areas (below the result screen, at the edges of wide screens, at the bottom of some pages) — never inside the typing area or during a match. Ads load only after you accept cookies in our consent banner. Google and its partners may then use cookies to serve and measure ads, including ads based on your visits to this and other sites; you can turn off personalised ads at https://adssettings.google.com and read how Google uses data at https://policies.google.com/technologies/partner-sites. Visitors from the EEA/UK see Google's own consent message before any ad. Premium (ad-free) members never see ads.

In the future we may add Sentry (error monitoring); this policy will be updated accordingly.

We do not sell your personal data.

6. International transfers

Analytics data is hosted in the EU. Some processors may process data outside your country. The transfer mechanisms and safeguards we rely on, and the complete processor list, are not finalized yet; they will be published here once they are.

7. Retention & deletion

We keep data while your account is active.

You can delete your account yourself at any time: open account settings with the gear icon next to your name at the top of the page and choose “Delete account permanently”. Deletion is immediate and cannot be undone. Your sign-in account, username, profile, runs (including keystroke timelines), rank and leaderboard entries are deleted at once. Leaderboards use a short cache, so your name may stay visible there for up to 15 more seconds. Reports you sent or that were filed about you are kept for moderation, but without any link to your account.

An anonymous account has no email or password. If you clear your browser data or lose the device, we cannot recover it.

Specific retention periods for other data will be published here once they are set.

8. Your rights

You can delete your account yourself (see section 7). You may also request access, rectification, erasure, restriction, objection and portability of your data. Contact privacy@leagueofkeyboards.com. Turkish users also have the rights described in our KVKK notice.

9. Children

League of Keyboards is not intended for children under 13. By choosing a username you confirm that you are at least 13. See our Terms of Service.

10. Changes & contact

We may update this policy; the “last updated” date reflects the latest change. Questions: privacy@leagueofkeyboards.com.