Privacy Policy

Device Information is collected automatically when you visit our Sites or use our applications. It is derived from request headers, browser cookies, and other information your device or web browser provides as part of a network request.

We primarily capture device information via log files from our infrastructure providers.

We collect:

• IP address
• Locale information as provided by the browser
• Other information provided automatically by your device or browser as part of your network request

We use device information to:

• Protect our Sites against abuse and fraud (IP address, locale)
• Serve content appropriate to your country or region (locale)
• Diagnose issues, monitor stability, and improve our services

We do not share device information with third parties except as needed to operate our Sites.

Our hosting and CDN providers (Cloudflare and Digital Ocean) may, in the course of fulfilling your request, collect additional device information. You can view the Cloudflare privacy policy and the Digital Ocean privacy policy.

Our checkout provider (Shopify) may also collect device information when you make a purchase. You can view the Shopify privacy policy.

We use only cookies and similar technologies that are strictly necessary to operate our Sites — for example, to keep you signed in, remember items in your cart, and protect against fraud. We do not set cookies for behavioural advertising, retargeting, or A/B testing, and we do not use third-party analytics cookies on our storefront. Because we do not place non-essential cookies, we do not display a cookie consent banner.

We collect order information during the checkout process when you place an order with us. We may collect this information even if you do not complete the order or later cancel it.

We collect:

• Name
• Company (if provided)
• Shipping and billing address
• Email address
• Phone number

Payment is processed by Shopify Payments (which also supports Apple Pay). We do not see, store, or process your full payment card number.

We use order information to:

• Fulfill your order, including shipping and customer support
• Screen for fraud and protect our customers
• Comply with applicable tax and trade laws

We share order information only as needed to fulfill your order. Recipients include Shopify (our e-commerce and checkout platform), our shipping and fulfillment partners, and the relevant carriers.

Our shipping and fulfillment partners change from time to time depending on your destination and current logistics. They receive only the information needed to ship and deliver your order.

You can view the Shopify privacy policy.

We retain order information for as long as we have an ongoing relationship with you, and for as long as we are legally required to (for example, to meet tax, accounting, or anti-fraud obligations). You may ask us to delete your order information; we will do so to the extent permitted by law.

We collect your email address when you sign up for our newsletter — either through a signup form on our Sites, or during Shopify checkout.

We collect your email address.

We use your email address to send you periodic information about ZSA products, services, activities, and other relevant topics. You can unsubscribe at any time using the link at the bottom of every email, or by contacting us.

We do not sell or otherwise share your marketing information with third parties for their own marketing purposes.

We use Mailchimp to send marketing email. You can view the Mailchimp privacy policy.

We use n8n Cloud (operated by n8n.io) to route signup events from Shopify and from our signup forms into Mailchimp. You can view the n8n privacy policy.

We retain your email address until you unsubscribe or ask us to delete it. Unsubscribe requests are processed promptly.

Oryx supports account creation by email or via social login (currently Google and GitHub; we may add additional providers over time). Oryx supports two-factor authentication.

For an Oryx account, we may store:

• Email address
• Display name
• Identifiers from your social login provider, where applicable
• Two-factor authentication secrets and recovery codes, if you enable two-factor authentication
• Your saved keyboard layouts and associated metadata (such as layout names and tags)
• Other information necessary to operate or improve Oryx — for example, account activity timestamps, preferences, and information related to features we add over time

Oryx does not exchange data with our Shopify storefront or with typ.ing. Your Oryx account is not linked to any other system on the basis of your purchase history.

For a typ.ing account, we may store:

• Email address
• Display name
• Password hash
• Your custom training texts (private to you; not shared)
• Your training history, settings, and daily challenge results
• Your Readwise API token, encrypted at rest, if you choose to connect Readwise (see below)
• A flag indicating whether you are a ZSA customer (see “typ.ing & Shopify Sync” below)
• Other information necessary to operate or improve typ.ing — for example, account activity timestamps, preferences, and information related to features we add over time

We use account information to:

• Authenticate you and protect your account
• Save your work (layouts, custom texts, settings) so you can return to it
• Provide account-specific features and personalize your experience within the relevant product
• Communicate with you about your account
• Maintain the security and integrity of our services

We do not share account information with third parties for their own purposes. Account data is stored on infrastructure operated by our hosting providers (see “Where Your Information Is Stored” below).

When you sign in via Google or GitHub, those providers receive information about your sign-in attempt in accordance with their own privacy policies.

You can ask us to delete your Oryx or typ.ing account at any time. When you do, we delete your account and the personal information associated with it, including your saved layouts (Oryx) or your custom texts, training history, settings, and Readwise token (typ.ing).

Keymapp displays your live keymap, generates an on-device heat map of your keyboard use, and flashes firmware onto your ZSA keyboard. It exposes a local API that other applications can use to control certain aspect of your keyboard such as layers, but only when you explicitly enable this API feature in Keymapp's settings (it is off by default). The heat map is processed strictly on your device and is never transmitted to us or to anyone else.

Kontroll is a command-line tool that demonstrates how to use the Keymapp API to control your ZSA keyboard from scripts and the command line.

Zapp is a command-line tool for flashing your ZSA keyboard.

When Keymapp or Zapp needs to fetch a keyboard layout, it sends the layout’s hash identifier (which is stored in your keyboard’s firmware) to Oryx. The request is logged on our servers and includes your IP address. The hash identifier is not, on its own, tied to your account.

Keymapp, Kontroll, and Zapp also perform:

• Update checks
• Anonymous usage telemetry — this telemetry does not include a persistent identifier that would let us link telemetry events to a particular installation or user
• Crash reporting — crash reports may include your IP address along with technical information about the crash (such as a stack trace)

Crash reports are sent to a Sentry instance that we self-host on Digital Ocean infrastructure in Toronto. They are not shared with sentry.io or any third party.

typ.ing uses self-hosted analytics to understand how the product is used. The analytics system records events such as page views, training session type, and training events (for example, when a session is started or completed). The analytics infrastructure is hosted in Toronto, Canada.

You can opt out of analytics in your typ.ing settings. Analytics are not shared with any third party.

If you choose to connect Readwise to typ.ing, you provide us with a Readwise API token. We store this token encrypted at rest and use it solely to fetch your Readwise content for use within typ.ing. Content fetched from Readwise is delivered to your device for use during training. We do not transmit Readwise-fetched content to any third party.

You can disconnect Readwise at any time in your typ.ing settings, which removes the stored token.

We use a flag on your typ.ing account to record whether you are a ZSA customer. This flag is set in two ways:

• When you create a typ.ing account, typ.ing checks Shopify (using your email address) to see whether a customer record exists.
• When a customer record is created on Shopify, Shopify sends typ.ing a webhook with the customer’s email address. typ.ing only updates the customer-status flag on an existing typ.ing account that uses the same email. Becoming a Shopify customer does not create a typ.ing account for you.

We use this flag for internal product analytics and to provide functionality that depends on whether you are a ZSA customer. The flag is not shared with any third party.

We send internal notifications to a private team channel on Telegram when a typ.ing account is created (including the customer-status flag described above) and when an existing typ.ing user becomes a ZSA customer. These notifications include the user’s email address. They are routed through n8n Cloud and delivered via Telegram. The channel is private and restricted to ZSA staff.

You can view the Telegram privacy policy.

You have the right to:

• Access the personal information we hold about you
• Ask that we correct inaccuracies in your personal information
• Withdraw consent to certain uses of your personal information
• Make a complaint to our Privacy Officer, and, if you are not satisfied with our response, to the Office of the Privacy Commissioner of Canada

In addition to the rights above, you have the right to:

• Receive a copy of the personal information we hold about you in a structured, commonly used technological format (data portability)
• Be informed of any personal information collected about you and the purposes of that collection
• Lodge a complaint with the Commission d’accès à l’information du Québec if you are not satisfied with our response

We process your personal information on the basis of one or more of the following legal bases: to perform a contract with you (for example, to fulfill an order), with your consent (for example, to send marketing email), or to pursue our legitimate interests in operating and improving our products in a manner that is not overridden by your rights.

You have the right to:

• Access, correct, and delete your personal information
• Object to processing, or ask us to restrict it
• Receive your information in a portable format
• Withdraw consent at any time, where consent is the legal basis
• Lodge a complaint with your local data protection authority

Your personal information may be transferred outside the EEA or the UK, including to Canada and the United States, in connection with the services described in this policy.

Depending on your state of residence (for example, California, Virginia, Colorado, Connecticut, Utah, or Texas), you may have the right to:

• Know what personal information we have collected about you and how we use it
• Request deletion of your personal information
• Request correction of inaccurate personal information
• Opt out of the sale or sharing of your personal information for cross-context behavioural advertising
• Limit the use and disclosure of sensitive personal information
• Not be discriminated against for exercising your rights

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. To exercise any of your rights, contact our Privacy Officer.