Privacy Policy

This Privacy Policy was last revised on October 29, 2026.

Thank you for your interest in Ratatype! The full text of the Privacy Policy follows below, but first, the main points in plain words. Ratatype offers a free version of the service and a paid version, Ratatype Plus, which removes promotional banners, lifts the daily exercise limits and speeds up page loading.

Whichever version you use, we never sell your personal data and we do not share it with third parties for any purpose not described in this Policy.

In the free version we show only our own banners about Ratatype products and services. They are not targeted: they are shown to users who have not purchased Ratatype Plus (except students in classes, who are not shown any banners), and we do not use your personal data for this purpose. No third-party advertising is shown on the site. We advertise Ratatype through Google Ads and measure purchases made after following one of our ads. Children's personal information is not used for marketing.

If you have a question about privacy, send it to [email protected] and we will reply.

And now, the full legal text.

This policy is split into sections. For your convenience, links to each of those sections is as follows:

General
Information we collect
How we use and share information
How we secure your data
Data retention
Data subject rights
Children's Privacy
International data transfer
Links to other sites
Privacy Policy updates
Contact us

1. General

Ratatype ("Ratatype", "we", "us", "our") explains in this Privacy Policy how we collect, use and share your personal information when you use Ratatype sites, including all regional and language versions, and related services (together, the "Service"). This Policy is the same for all Ratatype sites, regardless of domain or language.

This Policy explains how we collect, use and share your personal information when you use the Service. If you do not agree with the terms of this Policy, please do not use the Service. Your use of the Service is also governed by our Terms of use.

2. Information we collect

The amount of personal data we collect depends on how exactly you use Ratatype (with or without an account; as a student, a teacher or an individual user).

Personal information you provide

Contact details. Name (it may be any name, including a made-up one, and it need not be unique; this is the name displayed on certificates), email address, profile picture.
Account data. Password, account type (individual user, student or teacher), registration method (email or Google), registration date.
Service usage data. Selected course and keyboard layout, typing speed, accuracy, exercises and lessons completed, certificates obtained, the dates on which exercises and tests were completed, the date of last activity on the site.

Payment information

Payment information that our payment service providers collect to process your payments when you buy a Ratatype Plus subscription, certificates or Ratatype Plus licences for classes, including your name, payment card details and billing information. We do not store payment card numbers in our systems. Information that you provide in connection with your purchases is processed by our third-party payment processors in accordance with their terms of service and privacy policies.

Data provided by a teacher about students

A student's name and email address (added manually, through synchronisation with Google Classroom, or through the student's own registration via a link) and a password (automatically generated or set by the teacher).

Messages we exchange with you

For example, when you contact our support service with questions, feedback or other messages, we keep the content of that correspondence.

Marketing data

If you have agreed to receive mailings from Ratatype (practice reminders, news, offers), we keep your preferences for receiving such messages and information about how you interact with them. You can opt out of mailings at any time in your account settings or by using the "unsubscribe" link at the bottom of the email.

Data collected automatically

IP address, device and browser type, time zone, session data (including the temporary storage of test progress via a cookie for unregistered users), and data about your interaction with the site through cookies (see the "Cookies" section for details). If you arrived at the site from our Google Ads advertisement, we also receive data about that visit and about your purchase of a subscription (see Section 3, "Advertising", for details).

Google Analytics

We use Google Analytics, which is a web analytics tool that helps us understand how users engage with our website. Like many services, Google Analytics uses first-party cookies to track user interactions, as in our case, where they are used to collect information about how users use our site. This information is used to compile reports and to help us improve our site. These reports disclose website trends without identifying individual visitors. You can opt out of Google Analytics by installing Google’s browser add-on available here.

We do not collect or process special categories of personal data (for example, data concerning health, racial or ethnic origin, religious beliefs, or biometric data for the purpose of identifying a person).

We use and share your information for the following purposes:

Providing and maintaining the Service. On the basis of performance of our contract with you, we create and maintain your account and learning progress, personalise the course and keyboard layout to your needs, detect and fix technical errors, and analyse feedback in order to improve the product.

Communicating with you. Ratatype will use the email address you provide to send you the following types of messages:

Mandatory messages, sent on the basis of performance of the contract, which are necessary for your account to function and from which you cannot unsubscribe: registration confirmation, password reset emails, payment notifications, replies to your support requests, and notifications of requests to join a class.
Optional messages, sent on the basis of your consent: learning tips, practice reminders and progress reports; announcements of changes to the Service or of new Ratatype products, services and offers.

You can opt out of optional messages at any time by clicking "Unsubscribe" in the email or by switching off the "Receive news" checkbox in your account settings. Because we send these messages on the basis of your consent, you can withdraw it at any time; this does not affect the lawfulness of processing carried out before the withdrawal.

Processing transactions. On the basis of performance of the contract, we process payments for Ratatype Plus subscriptions, certificates or teacher licences through the Stripe payment system. We do not store your full card details on our own servers.

Teaching in classes. On the basis of performance of the contract with the teacher or school, and of our legitimate interest in providing an educational service, we process the data of students added by a teacher.

Advertising. We do not show third-party advertising on the site. The free version shows only Ratatype's own banners about our products and services (for example, Ratatype Plus). The banners are not targeted: they are shown to users who have not purchased Ratatype Plus (except students in classes, who are not shown any banners), regardless of their personal data or activity on the site. We advertise Ratatype through Google Ads and use Google Ads conversion tracking to measure the effectiveness of these campaigns: if you arrive at the site from one of our ads and buy a subscription, Google receives information about that purchase through cookies and similar technologies (including an ad-click identifier). We use this data solely to measure the results of our campaigns and not to show targeted advertising on the Ratatype site. You can manage cookies in the cookie settings on the site, and your Google advertising preferences on the Ads Settings page. Ratatype does not respond to "Do Not Track" signals from browsers.

Analytics. On the basis of legitimate interest, we use Google Analytics to understand how visitors use the site and to improve the product.

Service providers. On the basis of performance of the contract and our legitimate interest in providing the Service, we work with the following companies: Hetzner, for server hosting; Cloudflare, for the CDN and site protection; Google, for bot protection (reCAPTCHA), sign-in with a Google account, synchronisation of classes with Google Classroom, site tag management through Google Tag Manager, and handling of support requests through Google Workspace. These providers have access only to the information necessary and are obliged to use it solely to perform their functions.

Security and legal compliance. On the basis of our legitimate interest in protecting the Service, and of a legal obligation, we protect accounts against fraud. We disclose personal information only in response to legally valid requests. Unless the law expressly prohibits it, we will notify you of receiving such a request before disclosing the information. If we are asked to preserve certain data pending an official warrant, we limit ourselves to the minimum necessary and delete the preserved copies if no official warrant is received within the prescribed period.

De-identified data. We may de-identify your personal information and use this aggregated data for any purpose, for example to understand educational trends, improve the product or produce public statistics. Such information is not considered personal data because it does not allow a specific person to be identified, so the requirement for a legal basis does not apply to it.

Business transfers. On the basis of our legitimate interest, personal information may be one of the assets transferred to a new owner in the event of a merger, acquisition or sale of Ratatype's assets. We will notify you in advance if this would result in your data being transferred or a change to the Privacy Policy that applies.

4. How we secure your data

We take technical and organisational measures to protect your personal information against unauthorised access, use or disclosure. However, no method of data transmission or storage over the internet is 100% secure, so we cannot guarantee absolute security.

Data transmitted between you and the Ratatype site is encrypted through a secure HTTPS (TLS) connection. Network protection and traffic filtering are provided through Cloudflare, and we monitor the availability of the Service ourselves on an ongoing basis.

We make daily backups of the database, which are kept for 20 days in a Hetzner Online GmbH data centre (Germany) certified to the international information security standard ISO/IEC 27001.

We follow the principle of least privilege when giving employees access to users' personal data. All employees who have such access are obliged to keep this information confidential. No one at Ratatype views the contents of your account, except where necessary to resolve your support request. In the event of a data breach, we will take the necessary steps to remedy its consequences, notify affected users in accordance with applicable law, and notify the Information Commissioner's Office (ICO) within 72 hours if the breach poses a risk to your rights and freedoms.

5. Data retention

We keep your personal information for as long as necessary to provide the Service to you, as a rule until your account is deleted. We may keep certain information for longer where necessary to comply with legal obligations (for example, tax law requirements for payment records), to protect our legitimate interests, to resolve disputes or to prevent abuse.

You can delete your account yourself in your profile settings or by contacting us at [email protected].

After an account is deleted, your data is removed from the active database but may remain in backups until their full rotation cycle ends, which takes up to 20 days.

If you take a typing speed test without registering, session data is stored temporarily in a cookie and is deleted when you close the browser.

We may keep de-identified and aggregated information indefinitely, because it does not allow a specific person to be identified.

6. Data subject rights

We give these rights to all Ratatype users, regardless of country of residence, even if the applicable law of your country does not expressly require it. You have the following rights in relation to your personal information, in addition to any other rights provided by the law of your country:

The right to be informed of the categories of personal data we collect, use and share; we describe this in this Policy.
The right of access: to view the information we hold about you and to find out with whom we have shared it.
The right to rectification: to require the correction of inaccurate or incomplete information.
The right to erasure (the "right to be forgotten"): to require the deletion of your personal information, including test results, all learning data or your entire account.
The right to restrict processing: to restrict the manner and purpose in which your information is used.
The right to object to the processing of your information in certain cases.
The right to data portability: to receive the information you provided in a format that can be transferred to another party.
The right to withdraw consent: where we process information on the basis of consent, you may withdraw it at any time; this does not affect the lawfulness of processing before the withdrawal.
The right not to be subject to automated decisions: to object to a decision made solely by automated means (without human involvement) that has legal or similarly significant effects for you.
The right to lodge a complaint with the competent data protection authority of your country. If you are in the United Kingdom, this is the Information Commissioner's Office (ICO); if you are in the EU, find the authority for your country in the list of EEA supervisory authorities. If you want to complain directly to us about how we process your personal data, we will acknowledge receipt of your complaint within 30 days.

In your account settings you can view your information yourself, change your email address, password, name and mailing preferences, and delete individual test results. To export a copy of your data, or to delete your entire account or all learning and test data, contact us at [email protected]; we will respond to your request within one month.

To verify your identity, your name and the email address with which the account is registered are usually sufficient; for certain sensitive requests we may ask for additional information. These rights are not absolute: we may refuse to act on a request if we cannot verify your identity, if the request infringes the rights of third parties or applicable law, or if it interferes with the provision of a service that you have ordered.

7. Children's Privacy

Ratatype can be used by children in two ways: through an account created by a teacher as part of a class, or through self-registration as an individual user.

Students in classes. If a teacher or school creates an account for a student (manually, through synchronisation with Google Classroom, or by sending the student a registration link), the teacher or school is responsible for obtaining the consent of the child's parents or legal guardian to the collection of the child's personal data. We collect only the student's name (which need not be their real name) and, optionally, an email address; this does not affect the functionality of the account. If you want to register a student without an email address, write to us at [email protected] and we will explain how to do it. This Policy contains all the notices that COPPA requires for each school, so no separate notice to parents from the school is needed.

A teacher can also prevent students from changing their name, email address or profile picture themselves within the class. A teacher who manages a class has extended access to a student's account: they can see and change the student's email address, reset or view their password, and sign in to the student's account on the student's behalf to help with learning or to resolve technical problems.

By default, members of the same class can see each other's learning results (for example, the leaderboard or learning progress). A teacher can hide students' results from one another when creating or configuring the class, in which case only the teacher sees the results.

Individual registration. We do not knowingly collect personal data from children under 13 (in the US) or under 16 (in the EU/UK) without the consent of a parent or legal guardian. If you are a parent or legal guardian and you learn that your child has registered with Ratatype without your consent, contact us at [email protected] and we will delete the account and the related data.

Advertising and marketing. There is no targeted advertising on the site: we do not show advertising based on users' personal data or behaviour, whether they are children or adults. Students added to a class by a teacher are not shown any advertising, including Ratatype's own banners. These banners are shown in the same way to all other users of the free version, including children who have registered on their own. Children's personal information is never used for marketing.

Parents' rights. Parents or legal guardians can review and correct a child's personal data, or request its deletion, by contacting [email protected].

Removing a student from a class. When a teacher removes a student from a class, the student is taken off the class list, but the account itself is not deleted. A student's account and data can be deleted entirely in the student's profile settings or by contacting us.

Who owns a student's data. The data of an account created by a teacher or school for a student belongs to the school or teacher as the customer of the service for the class. In relation to this data, Ratatype acts on the instructions of the school or teacher and does not use it for advertising or marketing aimed at a particular student. We may de-identify and aggregate learning data for any purpose; this is consistent with the "De-identified data" section above.

This Policy takes into account the requirements of the Children's Online Privacy Protection Act (COPPA, US), the Family Educational Rights and Privacy Act (FERPA, US) in respect of students' education records, and the child protection requirements of the GDPR in the United Kingdom and the EU.

8. International data transfer

Ratatype's main servers are located in Germany (the hosting provider is Hetzner), within the European Union. This means that your personal data is mostly stored and processed in the EU.

At the same time, some Ratatype features involve transferring data to the United States: the Stripe payment system processes payments globally, including in the US; Google services (sign-in with a Google account, synchronisation with Google Classroom, reCAPTCHA bot protection, analytics through Google Tag Manager/Analytics, Google Ads conversion tracking, and handling of support requests through Google Workspace) may also process data on servers in the US; and the Cloudflare network, which provides the CDN and site protection, may likewise process traffic through servers in various countries, including the US. All of these partners are certified under the Data Privacy Framework (including the UK Extension for the United Kingdom), which is recognised as an adequate mechanism for transferring personal data to the US. The certifications can be verified: Stripe, Google, Cloudflare.

9. Links to other sites

The Ratatype site may contain links to third-party resources, for example Google Classroom, the Stripe payment system or other sites. Ratatype does not control these sites and is not responsible for their content or data-handling practices. This Privacy Policy applies only to data collected by Ratatype itself. We recommend that you read the privacy policies of third-party sites before sharing your data there.

10. Privacy Policy updates

We may update this Privacy Policy to reflect changes in our data-handling practices or legal requirements. The date of the latest update is stated at the beginning of this document.

If we make material changes, we will notify you by email or by a prominent notice on the site before the changes take effect. By continuing to use Ratatype after the changes take effect, you agree to the updated Policy.

11. Contact us

Ratatype Ltd is the controller of your personal data for the purposes of the UK GDPR. Ratatype Ltd is registered as a data controller with the Information Commissioner's Office (ICO) of the United Kingdom, registration number ZB989364, at the following address:

Ratatype Ltd
c/o Italian Accountants Ltd, Unit 2 Bedford Mews
London, N2 9DF
United Kingdom

If you have any questions or comments about this Privacy Policy or our data-handling practices, or you want to exercise any of the rights described above, contact us at [email protected].