Privacy Policy

Last updated: April 2026

WPM.GG is a small, independently run project. This policy explains what data is collected when you use the site, why, and what happens to it.

What we collect

• Leaderboard entries: If you submit a score, your chosen username and WPM score are stored persistently on our servers.
• Account data: If you create an account, we store your username and a bcrypt-hashed password. Your account is associated with your typing stats, WPM history, achievements, ELO rating, battle results, daily challenge entries, and any customizations (username color, title). This data is stored on our servers and is not shared.
• Email address (optional): You may optionally link an email address to your account for password reset purposes. If provided, it is stored on our servers and used only to send password reset links. It is never shared or used for marketing.
• Server access logs: Standard web server logs record your IP address, the pages you visit, and timestamps. These are used for rate limiting, abuse prevention, and basic diagnostics. Logs are not sold or shared.
• Test tokens: When you start a test, a short-lived token is generated in server memory to validate your score submission. It expires after 10 minutes and is deleted on use.

What we don't collect

• The text you typed during a test (beyond what's needed to validate accuracy at submission time)
• Browser fingerprints, device identifiers, or cross-site tracking data
• Payment information of any kind

Advertising - Google AdSense

WPM.GG displays ads served by Google AdSense. Google may use cookies and similar technologies to serve ads based on your prior browsing activity across sites. This is standard AdSense behavior governed by Google's own privacy policy. You can opt out of personalized advertising through Google's Ad Settings or by using a browser extension like uBlock Origin.

WPM.GG does not have access to the data Google collects for ad personalization.

Analytics

WPM.GG uses Umami, a privacy-focused analytics tool, to collect anonymous aggregate usage data (page views, session counts). Umami does not use cookies and does not collect personally identifiable information. It is self-hosted and the data stays within our own infrastructure.

Third-party services

• GitHub Gist: Test paragraphs are loaded from a public GitHub Gist. Your browser makes a direct request to GitHub's servers. No identifying data is sent to GitHub by WPM.GG.
• Chart.js (jsDelivr CDN): The results chart uses Chart.js loaded from jsDelivr. This is a static asset request - no personal data is transmitted.
• Resend: Transactional emails (email verification, password reset) are delivered through Resend. Only your email address and the content of the email are transmitted to Resend for delivery. Resend's privacy policy governs their handling of this data.
• Cloudflare: WPM.GG is proxied through Cloudflare for DDoS protection and CDN caching. Cloudflare may log request metadata. See Cloudflare's privacy policy for details.

Local storage

WPM.GG stores your session token, username, theme preference, and personal best score in your browser's localStorage. This data never leaves your device except as part of authenticated API requests to WPM.GG.

Data removal

Registered users can permanently delete their account from the Account Settings section of the stats page. Deletion removes your account, password, email, stats, match history, ELO, and achievements. Leaderboard entries posted under your username are also removed. This action is immediate and cannot be undone.

Guest leaderboard entries can be removed by contacting the site owner via the bug report button on any page. Since guest entries are pseudonymous, ownership cannot be verified, but removal requests are honored in good faith.

Changes to this policy

If this policy changes materially, the "last updated" date at the top will reflect it. We won't notify you by email unless your email is linked to your account and the change directly affects how your data is used.