Privacy policy

The Typoly publisher identified in the Legal Notice is the controller for the processing described here.

The publisher is Roch Junior NICOLAS, a French sole trader (entrepreneur individuel, EI). The service is operated under the name Typoly. Entrepreneur’s address: 10 RUE DU FAUBOURG DU SOLEIL, 30100 ALÈS, France. SIREN: 109 400 002. SIRET: 109 400 002 00019. Registration: 109 400 002 R.C.S. Nîmes, registered on September 2, 2026. APE code: 58.29C — Application software publishing. Declared activity: publishing, operating and selling software, applications, websites and online digital services.

Privacy requests may be sent to contact@typoly.app or by post to the establishment address above.

For questions or requests concerning your data, contact the publisher directly at contact@typoly.app. This is the data controller’s contact, not a representation that a data protection officer has been appointed.

This policy covers the Typoly website, macOS app, accounts, correction service, payment records, updates, support, and security operations. Data comes from users, their device/app, payment provider, authentication provider, website infrastructure, and correction providers.

It does not cover third-party sites or services that publish their own notices.

Required account, payment, and correction data must be provided to deliver paid service. Without it, Typoly cannot create the account, process payment, calculate credit, or return a correction.

Typoly does not monitor or record everything a user types. Only text that the user expressly asks Typoly to correct is captured and transmitted. A text fingerprint identifies a retried request, and the encrypted result is recoverable for ten minutes after storage without duplicate processing. Expired results are scheduled for deletion every minute. This recovery window does not guarantee that every copy and backup is erased at that exact instant.

Server-side operational metrics are separate from local history. They do not contain original or corrected text, email addresses, IP addresses, or authentication tokens and are available only through the protected private administrative dashboard.

Request deletion in the Typoly account settings. You must verify your password again or sign in again with Google, depending on your account’s sign-in method. A two-factor authentication code is also requested when required. Deleting the cloud account makes its credits unavailable on all Macs, subject to mandatory rights. Clear local history separately on each Mac. If you need help, contact contact@typoly.app.

Deletion removes the account and directly linked cloud balances, reservations, usage records, and correction metrics.

Ordinary sign-out ends the current session. It does not delete the account, credits, or sessions on other Macs. Encrypted local history remains in the Mac user profile after sign-out.

Some records are not deleted immediately. Stripe orders and events, credit lots, refunds, disputes, and supporting records may be retained with the user identifier detached where needed for accounting, tax, fraud prevention, and legal claims. HMAC fingerprints for an already-awarded trial may also be retained without the account to prevent repeated promotional awards.

Backups have a separate lifecycle from the active database. Typoly’s database is backed up every hour on the OVH server, and each backup is copied, encrypted, to Google Drive storage. These copies are kept for 30 days, then deleted; Google then permanently erases removed files within 30 days. Data erased from the active database may therefore remain in these encrypted copies until they expire; it is not reused except to restore service after an incident.

When Typoly changed hosting provider on 5 October 2026, a frozen, encrypted copy of the database was kept as a safeguard, together with the former Supabase project, which is paused and receives no new data. Both copies will be deleted no later than 5 January 2027.

Typoly sends correction text through its backend to one of two infrastructure routes presented as Fast and Very Very Fast. These routes use inference providers, including Crusoe, that process the text to produce the correction.

If the requested route has insufficient capacity or an incident occurs, the backend may transmit the text to the other provider. The app indicates the switch, which is recorded as operational metadata; only the provider that returned the correction determines the cost. Capacity counters contain opaque identifiers and volumes, never correction text.

Typoly does not use correction text to train its models. The publisher confirms Zero Data Retention for corrections at the inference providers. Local history and the ten-minute encrypted technical recovery are described separately above. HTTPS/TLS protects data in transit.

Zero Data Retention concerns text processed by inference providers. It does not mean that accounts, billing records, operational metadata or history stored on your Mac disappear. For information about recipients and safeguards applicable to your processing, contact contact@typoly.app.

Data may be made available only as needed to:

• OVH SAS: hosting of the API, authentication, database, credits, payments and technical logs, in France (Roubaix);
• Google: authentication when you choose Google sign-in, with processing for your Google account described in its privacy policy, and storage of encrypted database backups (Google Drive);
• Cloudflare: website hosting and protection, delivery of website files, application downloads and updates and, with your consent, optional audience and performance measurement of the home page and guides using Web Analytics;
• Vercel: former host of the website, downloads and updates, and former provider of Analytics and Speed Insights, which are no longer loaded by the website;
• Resend: account emails (confirmation, password recovery) and information messages;
• IONOS: hosting the contact@typoly.app mailbox for support correspondence and attachments;
• Stripe: payments, refunds, fraud controls, invoices and tax where enabled;
• Inference providers, including Crusoe: correction inference through the selected route;
• Supabase: former database host until 5 October 2026; the project is paused, receives no new data and will be deleted no later than 5 January 2027;
• DataFast (JustShipIt Pte. Ltd.): former home page audience measurement tool, used after consent until 14 October 2026; it is no longer loaded by the site;
• professional advisers, authorities, or counterparties where law or a corporate transaction requires.

The public agreements of OVHcloud,Vercel, Supabase Pte. Ltd., and Resend describe their obligations and subprocessors. IONOS incorporates its processing agreement in the terms for new contracts from 19 July 2022. Stripe describes its own purposes in its privacy policy.

Cloudflare's data processing agreement describes its obligations as a processor and the safeguards applicable to data transfers.

Typoly operates from France while using suppliers that may process data outside the user's country. Where required, transfers will rely on an adequacy decision, approved contractual clauses, the EU-US Data Privacy Framework where valid and applicable, or another lawful mechanism, with supplementary safeguards where necessary.

Typoly’s primary database is hosted in France, by OVH in Roubaix. This does not mean all processing, support, logs or subprocessors are exclusively European: Cloudflare, Vercel, Stripe, Resend, Google and inference providers may process data outside the European Union, including in the United States. Supplier agreements describe applicable contractual clauses and other transfer safeguards; you can request relevant information at contact@typoly.app.

Depending on location, users may request access, correction, deletion, restriction, portability, objection, withdrawal of consent, or review of a decision. Users may close an account, clear local history, change macOS permissions, and object to direct marketing at any time. Consent withdrawal does not affect earlier lawful processing.

Typoly will verify requests proportionately, respond within the applicable period, explain any refusal, and provide an appeal where required. Authorised agents may act where local law permits. Users may complain to the CNIL or their competent local privacy regulator.

Email: contact@typoly.app. Postal address: 10 RUE DU FAUBOURG DU SOLEIL, 30100 ALÈS, France. Typoly does not currently offer telephone support.

Typoly generates text suggestions and may automatically apply rate limits or fraud controls. It does not intend to make solely automated decisions producing legal or similarly significant effects. If that changes, Typoly will provide the required logic, significance, consequences, and human-review rights before the processing begins.

Typoly uses access controls, encrypted transport, authenticated requests, billing idempotency, and supplier controls designed to protect data. No security measure is infallible. Users should keep the app updated and report suspected incidents.

Typoly is restricted to people aged 18 or older and is not intended for minors.

When a user needs to be informed of a security incident affecting their personal data, Typoly contacts them at the email address associated with their account.

An erasure request can involve the active database, exports and data held by suppliers; backup copies have a separate lifecycle. When an incident occurs, Typoly assesses the affected data and people and protective measures, and applies risk-based notification requirements.

The “Last updated” date will change when this policy changes. Material changes will be notified in-app, by email, or before the affected processing begins where required. Earlier versions will be archived.