Privacy policy

The Typoly publisher identified in the Legal Notice is the controller for the processing described here.

The publisher is Roch Junior NICOLAS, a French sole trader (entrepreneur individuel, EI). The service is operated under the name Typoly. Entrepreneur’s address: 10 RUE DU FAUBOURG DU SOLEIL, 30100 ALÈS, France. SIREN: 109 400 002. SIRET: 109 400 002 00019. Registration: 109 400 002 R.C.S. Nîmes, registered on September 2, 2026. APE code: 58.29C — Application software publishing. Declared activity: publishing, operating and selling software, applications, websites and online digital services.

Privacy requests may be sent to contact@typoly.app or by post to the establishment address above.

For questions or requests concerning your data, contact the publisher directly at contact@typoly.app. This is the data controller’s contact, not a representation that a data protection officer has been appointed.

This policy covers the Typoly website, macOS app, accounts, correction service, payment records, updates, support, and security operations. Data comes from users, their device/app, payment provider, authentication provider, website infrastructure, and correction providers.

It does not cover third-party sites or services that publish their own notices.

Joining is optional. Roch Junior NICOLAS, EI, processes your email and the date and version of your consent through Resend to send launch updates, based on consent. An email and agreement are required to join. Withdraw consent using the unsubscribe link in emails or contact@typoly.app. The form does not collect correction text.

An HMAC of the IP address is used by the shared request limiter to prevent abuse. Expired counters are cleaned up after two days on subsequent calls.

Email addresses collected for the waitlist are retained for no more than three months after the launch announcement, then deleted from that list. Joining the waitlist does not subscribe the person to an ongoing newsletter.

Consent evidence is separate from the mailing list and includes the relevant email address, consent version and date. Withdrawal stops the relevant messages; it does not automatically erase evidence needed to establish earlier consent or handle a complaint. You may request access or erasure at contact@typoly.app, subject to lawful retention grounds.

Required account, payment, and correction data must be provided to deliver paid service. Without it, Typoly cannot create the account, process payment, calculate credit, or return a correction.

Typoly does not monitor or record everything a user types. Only text that the user expressly asks Typoly to correct is captured and transmitted. A text fingerprint identifies a retried request, and the encrypted result is recoverable for ten minutes after storage without duplicate processing. Expired results are scheduled for deletion every minute. This recovery window does not guarantee that every copy and backup is erased at that exact instant.

Server-side operational metrics are separate from local history. They do not contain original or corrected text, email addresses, IP addresses, or authentication tokens and are available only through the protected private administrative dashboard.

Request deletion in the Typoly account settings. You must verify your password again or sign in again with Google, depending on your account’s sign-in method. A two-factor authentication code is also requested when required. Deleting the cloud account makes its credits unavailable on all Macs, subject to mandatory rights. Clear local history separately on each Mac. If you need help, contact contact@typoly.app.

Deletion removes the Supabase account and directly linked cloud balances, reservations, usage records, and correction metrics.

Ordinary sign-out ends the current session. It does not delete the account, credits, or sessions on other Macs. Encrypted local history remains in the Mac user profile after sign-out.

Some records are not deleted immediately. Stripe orders and events, credit lots, refunds, disputes, and supporting records may be retained with the user identifier detached where needed for accounting, tax, fraud prevention, and legal claims. HMAC fingerprints for an already-awarded trial may also be retained without the account to prevent repeated promotional awards.

Backups have a separate lifecycle from the active database. Supabase documents access to daily backups for 7 days on Pro, 14 days on Team and up to 30 days on Enterprise; point-in-time recovery and exports are separate mechanisms. These plan limits are not a claim about every copy of Typoly data. See the backup documentation.

Typoly sends correction text through its backend to one of two infrastructure routes presented as Fast and Very Very Fast. These routes use inference providers, including Crusoe, that process the text to produce the correction.

If the requested route has insufficient capacity or an incident occurs, the backend may transmit the text to the other provider. The app indicates the switch, which is recorded as operational metadata; only the provider that returned the correction determines the cost. Capacity counters contain opaque identifiers and volumes, never correction text.

Typoly does not use correction text to train its models. The publisher confirms Zero Data Retention for corrections at the inference providers. Local history and the ten-minute encrypted technical recovery are described separately above. HTTPS/TLS protects data in transit.

Zero Data Retention concerns text processed by inference providers. It does not mean that accounts, billing records, operational metadata or history stored on your Mac disappear. For information about recipients and safeguards applicable to your processing, contact contact@typoly.app.

Data may be made available only as needed to:

• Supabase — authentication, database, credit and usage records;
• Google — authentication when you choose Google sign-in; processing for your Google account is described in its privacy policy;
• Vercel — website/API hosting, update delivery on updates.typoly.app, operational logs, Analytics and Speed Insights;
• Resend — waitlist registration and launch updates;
• IONOS — hosting the contact@typoly.app mailbox for support correspondence and attachments;
• DataFast (JustShipIt Pte. Ltd.) — home page audience measurement, after consent; its data processing agreement also lists its subprocessors;
• Stripe — payments, refunds, fraud controls, invoices and tax where enabled;
• Inference providers, including Crusoe — correction inference through the selected route;
• professional advisers, authorities, or counterparties where law or a corporate transaction requires.

The public agreements of Vercel, Supabase Pte. Ltd., Resend and DataFast — JustShipIt Pte. Ltd. describe their obligations and subprocessors. IONOS incorporates its processing agreement in the terms for new contracts from 19 July 2022. Stripe describes its own purposes in its privacy policy.

Typoly operates from France while using suppliers that may process data outside the user's country. Where required, transfers will rely on an adequacy decision, approved contractual clauses, the EU-US Data Privacy Framework where valid and applicable, or another lawful mechanism, with supplementary safeguards where necessary.

Typoly’s primary Supabase database is in AWS eu-west-1, Ireland. This does not mean all processing, support, logs or subprocessors are exclusively European. DataFast reports using infrastructure outside the EU, including the United States. Supplier agreements describe applicable contractual clauses and other transfer safeguards; you can request relevant information at contact@typoly.app.

Depending on location, users may request access, correction, deletion, restriction, portability, objection, withdrawal of consent, or review of a decision. Users may close an account, clear local history, change macOS permissions, and object to direct marketing at any time. Consent withdrawal does not affect earlier lawful processing.

Typoly will verify requests proportionately, respond within the applicable period, explain any refusal, and provide an appeal where required. Authorised agents may act where local law permits. Users may complain to the CNIL or their competent local privacy regulator.

Email: contact@typoly.app. Postal address: 10 RUE DU FAUBOURG DU SOLEIL, 30100 ALÈS, France. Typoly does not currently offer telephone support.

Typoly generates text suggestions and may automatically apply rate limits or fraud controls. It does not intend to make solely automated decisions producing legal or similarly significant effects. If that changes, Typoly will provide the required logic, significance, consequences, and human-review rights before the processing begins.

Typoly uses access controls, encrypted transport, authenticated requests, billing idempotency, and supplier controls designed to protect data. No security measure is infallible. Users should keep the app updated and report suspected incidents.

Typoly is restricted to people aged 18 or older and is not intended for minors.

When a user needs to be informed of a security incident affecting their personal data, Typoly contacts them at the email address associated with their account.

An erasure request can involve the active database, exports and data held by suppliers; backup copies have a separate lifecycle. When an incident occurs, Typoly assesses the affected data and people and protective measures, and applies risk-based notification requirements.

The “Last updated” date will change when this policy changes. Material changes will be notified in-app, by email, or before the affected processing begins where required. Earlier versions will be archived.