Privacy Policy for Typeping
As of: September 2, 2026 – draft aligned with Typeping's current technical implementation
**Courtesy translation.** This is a non-binding English translation of the German "Datenschutzerklärung". Only the German version is legally binding; in case of any discrepancy, the German text prevails. The German original is available at https://typeping.tv/datenschutz.
This Privacy Policy explains how personal data is processed when using the Typeping website, the Typeping smartphone app, the Typeping TV app and related services. It applies to users in the European Economic Area and is based on the General Data Protection Regulation (GDPR) and Austrian data protection law.
This description reflects the services currently implemented in the repository.
1. Controller
Typeping
Paschinger Straße 12/1
4060 Leonding
Austria
Email: privacy@typeping.tv
Website: https://typeping.tv
"Typeping", "we" or "us" below refers to the controller named above.
2. Overview of Typeping
Typeping makes it possible to connect a TV with a smartphone or web browser and to transmit input and remote-control commands to the TV. This includes in particular registration and login, pairing and managing devices, the short-term transmission of text input and commands, push notifications, and managing a free or paid plan.
3. Data processed, purposes and legal bases
3.1 Visiting the website and technical provision
When you visit the website, the hosting provider processes technically necessary connection and log data, in particular IP address, date and time, resource requested, referrer, browser type, operating system, and status/error codes. This processing serves to deliver the website and ensure stability, IT security and abuse prevention.
The legal basis is our legitimate interest in a secure and functional offering under Art. 6(1)(f) GDPR. We do not ourselves retain additional web server logs outside the systems provided by Cloudflare. Cloudflare logs that we can configure are retained for a maximum of 30 days. Security-related data may be processed longer in individual cases where necessary to investigate a specific incident or to enforce legal claims.
The website and the web worker are provided via Cloudflare. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, California 94107, USA. Cloudflare processes in particular IP address, routing and traffic data, browser and system information, and security events. Cloudflare operates a global network, so requests may be processed at locations distributed worldwide. Cloudflare acts as a processor with respect to the website and traffic data we control. Cloudflare may be independently responsible for its own security and network metadata.
3.2 Account, registration and login
When registering with an email address, we process in particular:
• email address, encrypted or hashed login credentials, and an internal user ID;
• display name, time of account creation and login status;
• technical session data and security logs.
When signing in via Google or Apple, we receive — depending on your selection and consent — a provider identifier, email address and, where applicable, name or profile information. We do not receive your password with the respective third-party provider. The privacy policies of Google or Apple additionally apply.
This processing is necessary for establishing and performing the usage contract (Art. 6(1)(b) GDPR). We process security logs on the basis of our legitimate interest in preventing unauthorized access (Art. 6(1)(f) GDPR).
We use Supabase for authentication, database, realtime functionality and edge functions. Our contracting partner is Supabase, Inc., 970 Toa Payoh North #07-04, Singapore 318992. Typeping's production project is set up in the AWS region `eu-central-1` (Frankfurt am Main, Germany), where the primary project data is stored and predominantly processed. Supabase and its subprocessors may nevertheless process data outside the EEA for support, security and provisioning. We enter into the data processing agreement offered by Supabase, including standard contractual clauses.
3.3 Device connection, pairing and remote control
To provide the core functions, we process:
• randomly generated installation and device identifiers;
• device type, device name, platform, time of registration and last activity;
• pairing code, pairing status, linked devices and times of connection/disconnection;
• session ID, status and expiry time of an input session;
• target app or package identifier and type of input field, where transmitted by the TV system;
• remote-control commands and text entered for transmission.
Text you enter is stored briefly in the Supabase database for transmission. Once retrieved, the command is marked as delivered. A cleanup routine running every 15 minutes removes the text content as soon as delivery occurred at least one minute ago. Expired or closed sessions and any remaining commands are deleted after one hour. The text is not used for advertising, profiling, or content analysis. In particular, avoid transmitting passwords, health data, payment data or other especially sensitive information.
This processing is necessary to perform the usage contract (Art. 6(1)(b) GDPR). Security and abuse checks are based on Art. 6(1)(f) GDPR.
3.4 Push notifications with Firebase Cloud Messaging
If you allow notifications, we process a device-specific push token and information about the target device. Typeping uses Firebase Cloud Messaging (FCM), a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. FCM and affiliated Google companies process in particular Firebase installation identifiers, push tokens, technical device information and delivery information. You can revoke the permission at any time in your device's system settings.
This processing serves the notification you requested and the provision of the input feature (Art. 6(1)(b) GDPR). Where a notification provides only optional convenience, we rely on your consent under Art. 6(1)(a) GDPR. Push tokens rejected by FCM as no longer registered are deleted immediately. Tokens that are not refreshed are automatically removed after 180 days. Otherwise, deletion occurs together with the associated device or account.
3.5 Firebase Analytics
Typeping uses Google Analytics for Firebase, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. This service may process in particular pseudonymous app and installation identifiers, device and operating system information, approximate location based on IP address, language, app version, and usage events. On the web, a `page_view` event with the full page address, path and page title is sent when the page loads. In the mobile app, an `app_open` event is triggered on launch. The code does not transmit text input as an analytics parameter.
The purpose is the statistical evaluation and improvement of Typeping. The legal basis is your prior, voluntary consent (Art. 6(1)(a) GDPR; additionally § 165(3) of the Austrian Telecommunications Act (TKG) 2021 for access to information stored on your device). Analytics is disabled by default in the app and website and is only activated after you select "Allow analytics" or "Accept all". Declining has no effect on core functionality. You can withdraw your choice at any time in the privacy settings; further collection is then disabled.
The retention period for event-based analytics data depends on the setting in the associated Google Analytics property. This setting is not part of the repository and must be checked in the Firebase/Google Analytics dashboard and entered here. The Typeping code does not implement a custom user ID, advertising events, or BigQuery export. Whether Google Signals or data-sharing settings are enabled in the dashboard must be checked before publication.
3.6 Firebase Crashlytics
With your prior, voluntary consent, we use Firebase Crashlytics from Google Ireland Limited to detect crashes and technical errors and to improve app stability. This may process in particular crash stack traces, error messages, time of the error, app and operating system version, device model, CPU architecture, memory status, root/jailbreak status, Firebase installation ID, Crashlytics installation ID, and session identifier. According to Google, crash stack traces and associated identifiers are generally retained for 90 days before deletion from active and backup systems begins.
The current code does not store names, email addresses, or text input as custom Crashlytics keys. The legal basis is your prior consent under Art. 6(1)(a) GDPR and, where applicable, § 165(3) TKG 2021. Crashlytics is disabled by default, is activated together with optional analytics, and is disabled again for further collection upon withdrawal.
3.7 Typeping Premium and Stripe Managed Payments
Premium subscriptions are offered exclusively via Stripe Managed Payments as a web-based checkout. No other payment platforms are used for Typeping Premium. Stripe Managed Payments is currently in public preview; the checkout is only activated once Typeping has been approved for the service and the Managed Payments terms have been accepted in the Stripe Dashboard.
Under Stripe Managed Payments, Stripe acts as the merchant of record, i.e. the legal seller and payee vis-à-vis the customer. The checkout and receipts indicate this with "Sold through Link". According to current Stripe information, the merchant-of-record service is provided by Sold through Link, LLC, a Stripe company in the USA. Depending on location and processing activity, Stripe Technology Company Limited, One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland; Stripe Payments Europe Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland; and other regulated Stripe entities may also be involved from a data protection perspective. The contact address for Stripe Legal in the USA is 354 Oyster Point Boulevard, South San Francisco, California 94080, USA. Further information is available in Stripe's privacy policy at https://stripe.com/privacy.
For checkout, subscription and payment, Stripe processes in particular:
• name, email address, billing address, country and, where applicable, tax ID;
• payment information such as card number, expiry date, bank or wallet data — Typeping does not receive complete payment data;
• IP address, device, browser, cookie and Link account data;
• selected plan, product, amount, currency, tax amount and transaction time;
• subscription status, term, renewal, cancellation, refund and fulfilment status;
• data for fraud prevention, chargebacks, disputes and transaction-related support inquiries.
Under the current requirements of Stripe Managed Payments, a Premium subscription requires a Link account through which the customer can manage their subscription and payment method. Stripe or Sold through Link, LLC processes the data required for sale, payment processing, tax calculation and remittance, fraud prevention, dispute resolution and transaction-related support under its own data protection responsibility. Stripe cookies and similar technologies may be used within the hosted checkout. The Stripe/Link privacy information and contract terms shown directly in the checkout additionally apply.
Typeping receives from Stripe only the data required to activate and manage Premium, in particular the Stripe customer and subscription identifier, selected plan, status, term, renewal and expiry date, and information on cancellation, refund or chargeback. This data is transmitted to the Typeping backend via Stripe webhooks. Complete card, bank or wallet data is not stored by Typeping.
Processing by Typeping is necessary to perform the Premium usage contract (Art. 6(1)(b) GDPR). Where we must retain billing data due to statutory bookkeeping, evidentiary or cooperation obligations, this is based on Art. 6(1)(c) GDPR. Fraud and abuse prevention, to the extent not carried out by Stripe under its own responsibility, is based on our legitimate interest under Art. 6(1)(f) GDPR. We generally retain tax- and accounting-relevant records in Austria for seven years, unless a longer obligation or pending proceeding applies. Status and entitlement data is otherwise retained only as long as necessary for the subscription, refunds, or the defense or enforcement of legal claims.
3.8 Support and communication
If you contact us at service@typeping.tv or privacy@typeping.tv, we process your contact details, the content of your message, technical information you voluntarily provide, and our reply. This processing serves to handle your request and, where applicable, to perform the contract (Art. 6(1)(b) GDPR), or is based on our legitimate interest in support and documentation (Art. 6(1)(f) GDPR). We generally delete support cases six months after final processing, unless statutory retention obligations, abuse prevention, or legal claims require longer storage.
3.9 Local storage on your device
Typeping stores technically necessary settings locally on your device or in your browser, such as an installation identifier, session information, onboarding status and your privacy choice. This data is necessary for login, security, and the settings you have chosen. Where local storage is not strictly necessary, it only takes place with your consent. You can delete local app data via your operating system or browser settings; this may reset login and settings.
4. Recipients and processors
Personal data is only disclosed to parties that need it for the purposes described. These may include:
• Cloudflare, Inc. for the website, worker, DNS, delivery and protection against attacks;
• Supabase, Inc. for authentication, database, realtime and edge functions in the primary Frankfurt region;
• Google Ireland Limited and affiliated companies for Firebase Analytics, Crashlytics and Cloud Messaging;
• Apple Distribution International Ltd. and affiliated Apple companies for optional Sign in with Apple and app distribution, but not for Premium payments;
• Sold through Link, LLC and the Stripe entities involved, for the exclusive Premium checkout, merchant-of-record services, payments, taxes, fraud prevention, disputes and transaction-related support;
• IT, support, security, legal and tax service providers;
• authorities and courts, where we are legally obliged to disclose data.
We enter into agreements under Art. 28 GDPR with processors bound by our instructions. Information on the main subprocessors can be requested via privacy@typeping.tv.
5. Data transfers to third countries
Although the primary Supabase project data is located in Frankfurt, Cloudflare, Google, Stripe, Sold through Link, Supabase and their subprocessors may process data outside the European Economic Area, in particular in the USA or Singapore. Where no adequacy decision under Art. 45 GDPR applies, transfers take place on the basis of appropriate safeguards under Art. 46 GDPR, in particular the European Commission's Standard Contractual Clauses, supplemented by necessary additional measures. For certified US recipients, the EU-US Data Privacy Framework may additionally apply. Copies of the relevant safeguards can be requested via privacy@typeping.tv.
6. Retention period
We store personal data only as long as necessary for the respective purpose or as required by law. Unless a more specific period is stated above, the following principles apply:
• account data: until the account is deleted, plus technically necessary deletion and backup periods;
• active device links: until the device is disconnected or the account is deleted;
• pairing codes: valid for ten minutes and automatically deleted at the latest one hour after expiry;
• input commands: delivered text content is removed by the quarter-hourly routine once delivery occurred at least one minute ago;
• input sessions and remaining commands: one hour after the session expires or is closed;
• technical Cloudflare and Supabase logs that we can configure: a maximum of 30 days, unless a specific security incident or legal claim requires longer storage;
• inactive Typeping accounts: deleted after 24 months without login; before deletion we notify the email address on file and allow continuation by logging in again;
• contract and billing data: for the statutory retention periods;
• proof of consent: for the duration of the consent and thereafter until any legal claims lapse;
• backups: a maximum of 30 days; deleted data may remain in access-restricted backups until this backup cycle expires and is not reprocessed for production use.
7. Requirement to provide data
Account, device and session data is required to use the respective Typeping feature. Without this data, we cannot provide the feature. Analytics and Crashlytics are voluntary; Typeping otherwise remains usable without consent.
8. Automated decision-making
We ourselves do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. The technical activation of Premium features merely follows the subscription status confirmed by Stripe. Stripe may use automated risk assessments under its own responsibility for payment and fraud checks; further information is available in Stripe's privacy policy.
9. Your rights
Subject to the statutory requirements, you have in particular the right to:
• access to the personal data we process about you (Art. 15 GDPR);
• rectification of inaccurate data (Art. 16 GDPR);
• erasure (Art. 17 GDPR);
• restriction of processing (Art. 18 GDPR);
• data portability (Art. 20 GDPR);
• object to processing based on legitimate interests (Art. 21 GDPR);
• withdraw consent at any time with effect for the future (Art. 7(3) GDPR).
To exercise your rights, contact privacy@typeping.tv. Where we have reasonable doubts, we may request proof of identity.
You also have the right to lodge a complaint with a data protection supervisory authority. For a controller based in Austria, the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, https://www.dsb.gv.at, is generally competent. You may also contact the supervisory authority of your habitual residence or place of work.
10. Account deletion
You can delete your own account in the smartphone app under "Account → Permanently delete account" and in the web app under "Account & Subscription → Permanently delete account". Alternatively, you can contact privacy@typeping.tv. Deleting the account deletes your profile, device links, mobile devices, push tokens, sessions and input data. TV installations shared with other accounts remain in place for those other accounts. Billing records that must be retained by law remain stored under a restricted-access hold for the required period. An ongoing Stripe Managed Payments subscription must be cancelled via the associated Link account before deleting the Typeping account. Deleting the Typeping account does not automatically end the subscription managed by Sold through Link.
11. Security
We take appropriate technical and organizational measures, in particular encrypted transmission, access restrictions, tenant-scoped database rules, short-lived pairing codes, and separation of public from privileged credentials. However, no internet-based service can guarantee absolute security.
12. Minors
Typeping may only be used by persons who are at least 18 years old. Typeping is not directed at children or adolescents. If we become aware of data belonging to a person under 18, we review and delete it, unless another legal basis or statutory obligation applies.
13. Changes to this Privacy Policy
We update this Privacy Policy when Typeping, the providers we use, or the legal situation changes. The current version is available at https://typeping.tv/data-privacy and in the app's account area. We inform you of material changes in an appropriate manner.