Privacy

You can use the whole trainer without signing up, and if you do, there is no copy of anything on our side. Your lessons, per-key statistics, run history, streak and settings live in your browser’s local storage. No account, no server record, nothing to ask us to delete — clearing your browser data is the deletion.

The trade is that it is tied to that one browser. Clear it, or switch machines, and it is gone.

• Who you are: your name, email address, and — if you signed in with Google — the profile picture Google supplies. If you set a password, we keep a bcrypt hash of it and never the password itself.
• What you typed: one record per finished run — the date, mode, speed, accuracy, consistency, duration and keystroke count. Not the text, and not the keys in order. A record that a run happened and how it went, not a transcript.
• How you type: per-key speed and accuracy statistics, your position in the course, and your streak. This is what makes the next lesson adapt.
• Your settings: theme, layout, language, sound, target speed, and any custom practice text you saved.
• Sessions: a hashed sign-in token per device, up to ten, with the browser it came from and when it was last used. Signing out removes that device’s.

• No analytics and no trackers. There is no Google Analytics, no advertising pixel, no session recorder, no third-party script watching you type. You can check this in the network tab.
• No keystroke logging. The engine works on timings and hit-or-miss per key, in your browser. The words you typed are not sent anywhere, including the custom text you paste in — that stays on your device unless you save it to your account, and then only as your own saved lesson.
• No payment details. Keyshand is free and takes no money, so there is no card number to lose.
• No selling, ever. Your data is not sold, rented or handed to advertisers. There is no business model here that would make that tempting.

One cookie: kh_refresh, set when you sign in. It keeps you signed in and does nothing else — it is not readable by JavaScript, it is stored on our side as a hash rather than as itself, and it is replaced every time it is used. Signing out deletes it.

Everything else the site remembers — your theme, your progress, whether you were signed in last time — is local storage in your own browser, not a cookie, and never sent to us.

If you use the Google button, Google gives us three things about you: your email address, your name, and your profile picture. That is the whole of it. We cannot read your mail, your contacts or your files, and we never receive your Google password.

Loading that button means your browser talks to Google, so Google can see that you visited the sign-in page. You can avoid that entirely by using an email and password instead.

We email you for one reason: a six-digit code, when you ask to verify your address. Verifying is optional, and skipping it costs you nothing but the ability to recover the account if you forget the password.

There is no mailing list, no newsletter and no marketing email. If that changes, it will be something you opt into, not something you find yourself in.

Three companies, each doing one job, none of them given your data for their own use:

• Vercel serves the website.
• Render runs the server that answers it.
• MongoDB Atlas stores the database.

Their servers may be outside your country, which means your data may be processed elsewhere. Beyond those three, nobody — we do not share your data with anyone, and the only exception would be a legal order we are actually obliged to obey.

You can, on your account page. So can an administrator of this site — the panel shows accounts, when they were created, when they were last active, and their totals, which is what running a service requires. It does not show anybody your password, because nobody has it.

For as long as the account exists. There is no archive: deleting your account from the account page removes the account, every run and all your progress from the database in the same operation. It is immediate and it is not reversible.

You can also take it with you first — the account page exports your full run history as a CSV, which is yours to keep.

Keyshand is a typing trainer and is genuinely useful to children, but an account is not intended for under-13s. If a child has made one, write to us and we will remove it.

If what the software does changes, this page changes with it, and the date at the top moves. It describes the software as it is today, not as it might be — if you are reading it to decide something, the date is the part to check.