Student Data Privacy Agreement
1. Purpose and scope
Typiq is a touch-typing course. This agreement covers the optional teacher dashboard at typiq-app.com/dashboard/ and the browser or desktop app used by students with a class code or a personal student code. It applies to the free pilot and to any paid licence (Classroom or School).
2. Data Typiq collects about students
| Data | Why | Where it lives |
|---|---|---|
| A personal student code (8 characters, generated by Typiq) | Lets the student sign in without an email or password and links practice results to the teacher's class | Typiq server, EU |
| Typing results: lesson, words per minute, accuracy, practice time, date | The progress the teacher sees per student and per class | Typiq server, EU |
| Student name, as typed by the teacher | So the teacher can tell students apart in the dashboard | Encrypted in the teacher's browser with a key derived from the teacher's password. Typiq stores only the encrypted value and never receives the key, so Typiq cannot read the name. |
| A nickname the student may type on the sign-in screen | Shown only on that computer | That computer only; never sent to Typiq |
Typiq does not collect student email addresses, dates of birth, photos, location, device identifiers for advertising, or free-text content from students. The desktop app itself works offline; without the dashboard, no student data leaves the classroom.
3. Ownership and permitted use
- All student data is and remains the property of the School. Typiq acts under the School's direction, as a "school official" with a legitimate educational interest under FERPA (34 CFR 99.31(a)(1)), under the School's direct control regarding the use and maintenance of education records.
- Typiq uses student data only to provide the dashboard and the course to the School. No advertising, no behavioural profiling, no sale, rental or sharing of student data, no use for product improvement that identifies a student, no secondary use of any kind.
- Typiq does not create student profiles for any purpose other than the service, and does not use student data to target advertising on any site or service.
4. Consent for students under 13 (COPPA)
Where a student is under 13, the School provides consent on behalf of the student's parents, as permitted by the FTC's COPPA Rule for operators that collect personal information from students solely for the use and benefit of the school. On request, Typiq gives the School a description of the data collected so that the School can inform parents; the School may review or delete a student's data at any time in the dashboard, and may ask Typiq to do so.
5. Security
- All traffic between the app, the dashboard and Typiq's servers is encrypted (HTTPS/TLS).
- Student names are encrypted end to end in the teacher's browser (AES-GCM with a per-class key wrapped to each authorised teacher's public key). A lost teacher password cannot be recovered by Typiq; the School's other authorised teachers or admin keep access to the class key.
- Teacher accounts use individual credentials; a student code can be signed in on one computer at a time.
- Servers are hosted by Hetzner Online GmbH in Germany (EU), with daily backups kept for 14 days.
6. Sub-processors
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting of the dashboard and database | Germany (EU) |
| Resend Inc. | Transactional email to teachers (never to students) | USA |
| Stripe Inc. | Optional online payment of invoices; no student data | USA |
| SmartBill SRL | Invoicing; no student data | Romania (EU) |
Typiq gives the School 30 days' notice before adding a sub-processor that would handle student data.
7. Retention and deletion
- Student data is kept only for the duration of the pilot or licence.
- The School's admin can delete any student, any class, or the whole school account (including every student record) at any time from the dashboard, without contacting Typiq.
- On written request, Typiq deletes the School's student data from production within 10 business days. Twelve months after a pilot or licence ends without renewal, Typiq deletes the students and their results automatically (the teacher accounts stay, empty). Backups expire within a further 14 days.
- On request, Typiq exports the School's data in CSV format (the dashboard also does this per class).
8. Data breach notification
If Typiq becomes aware of an unauthorised disclosure of the School's student data, it notifies the School's contact within 72 hours, describes the data affected and the steps taken, and cooperates with the School's own notification duties under state or provincial law. Typiq does not contact parents directly unless the School asks it to.
9. Rights of parents and eligible students
Requests from parents or eligible students to inspect, correct or delete data are handled by the School; the dashboard gives the School the tools to do so, and Typiq assists within 10 business days where a request needs Typiq's action.
10. Term, termination and audits
- This agreement runs for as long as the School uses the dashboard and ends automatically with the deletion described in section 7.
- On reasonable notice, Typiq answers the School's written questions about its practices and provides the documentation available in this agreement and at typiq-app.com/en/privacy-policy.html.
- Where a state law (for example New York Education Law §2-d, Illinois SOPPA or California SOPIPA and AB 1584) requires additional terms, the School may attach its state exhibit, which then prevails over this template for that School.
11. Contact
SIBSTIL DOORS SRL, Str. Oștirii nr. 6, Sc. B, Et. 7, Ap. 73, Sibiu, Romania · Trade register J32/358/2009 · VAT ID RO25411699 · support@typiq-app.com