Proof of Type☾︎

Privacy Policy

Last updated: October 2026

Proof of Type (“we”, “the Service”) is a place to publish writing that was verifiably typed by a human. This page explains what we collect to do that, what is public, who helps us run the Service, and how to delete your data. The short version: your posts are public, the way you type is used only to verify that a human typed them, and we do not run ads, sell data, or use third-party tracking.

1. Your account

You sign in with Google or Apple. Our authentication provider, Supabase, receives from them your email address, your name, your account identifier with that provider, and (from Google) a link to your profile picture. We use your email only to run your account and to send the emails described below; it is never shown to other users. Your profile also holds a username, a display name and the colour you choose.

2. What is public

Posts and comments are public, and so is your profile: username, display name, colour, who you follow and who follows you, and which posts you like. Each post also shows its typing score and speed. Public posts can be viewed, linked, embedded on other websites and indexed by search engines. Drafts are private to you.

3. How we verify that a human typed a post

While you type in our editor, your device records the timing of your keystrokes (when each key goes down and comes up) and, on a physical keyboard, which key it was, along with how each character got into the text (typed, autocorrected, and so on). This is sent with the post so our server can check it was typed live by a person rather than pasted or generated. From it we compute the public score and speed, and a one-way fingerprint of the timing pattern used to catch replayed recordings. The raw timing data and the fingerprint are stored with the post but are locked to our server: they are never shown on the site or available to other users, and are used only for verification and to improve it.

When a post fails verification we keep a short technical record: the check that failed, numeric measurements (such as speed and counts), your browser’s user agent and your account id. It never includes your text or keystrokes.

With every post we also store your browser’s user agent and a shortened IP address (only the first two parts, e.g. 203.0.x.x), to investigate abuse. These are never public.

4. Passkeys and the iOS app

To confirm a person is present when posting, we ask for Face ID, Touch ID, Windows Hello, a device PIN or your phone. That check happens on your device: we never receive your fingerprint, face or PIN. We store the passkey’s public key, its identifier, a usage counter, the make and model of authenticator it reports, and whether your browser said it was under automated control when you set it up. We also log each passkey setup attempt, to limit abuse.

In our iOS app, posts are additionally signed with a key created by Apple’s App Attest service on your device. We store that key’s public half and Apple’s attestation receipt, which tell us the post came from the genuine app on a real Apple device. They contain no personal information.

5. Email

We send a daily summary of likes, replies, new followers and new posts from people you follow, only on days something happened. You can turn it off in Settings or with the unsubscribe link in every email. Emails are delivered by Resend, which receives your email address and the email’s content.

6. Reports and blocks

If you report a post or account, we store who reported it, what was reported, the reason and any note you add, and send it to our moderation inbox. The person you report is not told who reported them. Your list of blocked accounts is private to you.

7. On your device

The site keeps your sign-in session, theme, colour, sound setting and whether this device has a passkey in your browser’s local storage. We do not use advertising or tracking cookies.

8. Who helps us run the Service

We do not sell or rent personal data, show ads, or use third-party analytics or tracking. We use:

  • Supabase: database and sign-in. Everything described above is stored there.
  • Vercel: hosts the website and runs our server code; it processes each request, including your IP address, as part of serving it.
  • Resend: delivers our emails.
  • Google and Apple: sign-in, and Apple App Attest in the iOS app.
  • Google Fonts: the site loads a typeface from Google’s servers, so Google receives your IP address and browser details when the page loads.

We may disclose data if required by law.

9. How long we keep it, and deleting it

We keep your data while your account exists. Deleting a post removes it, its replies and its likes. You can delete your account at any time in Settings. Your profile, posts and comments are hidden from everyone immediately. For 30 days you can sign back in and restore the account; after that we permanently delete it: your posts and comments (and replies beneath your posts), likes, follows, drafts, typing data, passkeys, device keys, email settings, reports and blocks, your profile, and your sign-in record. Routine backups held by our database provider expire on their own schedule.

10. Your choices

You can change your username and colour, delete any post, turn off email, block people, and delete your account, all from the app. To request a copy of your data or to ask anything about this policy, write to human@proofoftype.com.

11. Changes

If we change what we collect or how we use it, we will update this page and the date at the top.

12. Contact

human@proofoftype.com. See also our Terms & Conditions.