Privacy

Invitation requests

When you request an invitation, we store your email address and any optional name, company, platform, or message you provide. We also record the submission date, page path, and campaign or source label when present. We use this information to respond about TypeWright early access.

Storage and email

Requests are stored in a private TypeWright namespace in Upstash Redis. The site and its API run on Vercel. Resend processes confirmation messages, admin notifications, and sign-in emails. Resend email IDs and delivery states are stored so we can diagnose delivery problems. Our application logs do not copy invitation email addresses or messages.

Aggregate page counts

We count visits to the homepage and invitation page to understand interest. These are daily totals, not visitor profiles. We do not use analytics cookies, fingerprinting, advertising pixels, or third-party tracking scripts. We do not send URL query strings to the page-count endpoint. Browsers reporting Do Not Track and automated browsers are not counted.

Security and admin access

Public browsing and invitation requests do not require cookies. Signing in to the private admin area sets one essential, secure, HTTP-only session cookie, expiring after eight hours. Admin sign-in codes expire after ten minutes and are single-use. Access is restricted to the operator allowlist.

For abuse prevention, we derive a daily keyed hash from the request IP address and temporarily store rate-limit counters. We do not store the raw IP address in the invitation record. Vercel may process request metadata as part of providing hosting and security.

Retention and your choices

Aggregate page counts expire after 60 days. Login challenges, rate-limit counters, and sessions expire automatically. Invitation records remain while we manage early access; you can request deletion or ask us to stop contacting you by emailing hello@typewright.dev. We do not sell your details or use them for unrelated marketing.