Privacy Policy
Last updated: 12 November 2026
This Privacy Policy explains how Typly sp. z o.o. ("Typly", "we", "us") processes personal data when you use the Typly AI Keyboard mobile application for iOS and Android (the "App") and the website typly.app (the "Website"). It is written to meet the requirements of the EU General Data Protection Regulation (GDPR).
1. Who is the controller
Typly sp. z o.o., al. gen. W. Sikorskiego 9A lok. 24A, 02-758 Warsaw, Poland, registered in the National Court Register (KRS) under no. 0000910270, tax ID (NIP) 5213933913.
Data protection contact: [email protected]. General support: [email protected].
2. What the App does with your text
Typly is a keyboard that generates suggestions with artificial intelligence. To do that, the App sends text to our servers only when you ask for suggestions: when you open the Typly panel on the keyboard, pick a style, or use the Generate, Reply, Processing, Bundles or Dating features. What is sent:
- the text you typed in the field you are replying in,
- the text in your clipboard, if you copied a message to reply to,
- the style or prompt you selected, your profile settings and the language settings.
Nothing is sent while you type on the plain keyboard. The App does not read other apps, your contacts or your photos. Text typed into password fields is never processed by third-party keyboards on iOS or Android.
Our servers forward the request to an AI model provider (see section 6) and return the suggestions. We do not use your text to train AI models.
3. What data we process and why
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Account data: e-mail address, sign-in provider (e-mail, Google or Apple), authentication identifier, e-mail verification status | creating and securing your account, restoring your data across devices | art. 6(1)(b) performance of a contract | until you delete your account |
| Device and app data: pseudonymous device identifier, app version, operating system version, keyboard language, country derived from IP address | providing the service, preventing abuse, compatibility, statistics | art. 6(1)(b) and (f) legitimate interest in security and product improvement | until account deletion; country and version data up to 12 months in logs |
| Request content: the text and clipboard context you submit for suggestions, the selected style, response time | generating suggestions; improving quality of suggestions and detecting abuse | art. 6(1)(b); art. 6(1)(f) for quality and abuse analysis | processed in real time; stored in encrypted request logs for up to 12 months |
| Custom prompts, profiles, favourites, hidden styles | your personalisation | art. 6(1)(b) | until you delete them or your account |
| Usage counters: number of generations per day/month, trial dates, plan status | enforcing free-plan limits, trial and subscription | art. 6(1)(b) | until account deletion |
| Subscription status received from Apple App Store / Google Play (product, validity). We never receive your card number. | unlocking Premium | art. 6(1)(b) | until account deletion |
| Crash reports and technical diagnostics (device model, OS version, app state at crash) | fixing bugs | art. 6(1)(f) | 90 days (Firebase Crashlytics default) |
| In-app analytics events (screens opened, features used), collected without advertising identifiers | product improvement | art. 6(1)(f) | up to 14 months |
| E-mail communications: transactional messages (verification, trial ending, account notices) and product e-mails about Typly | running the service; informing you about Typly features | art. 6(1)(b) for transactional; art. 6(1)(f) for product e-mails about our own service, with an unsubscribe link in every message | until account deletion or unsubscription |
| Support correspondence (your e-mail, the content of your message, screenshots you send) | answering your request, handling claims | art. 6(1)(b) and (f) | up to 3 years after the case is closed |
| Website analytics cookies (see section 9) | measuring traffic and campaigns | art. 6(1)(a) consent | see cookie table |
You are not obliged to provide any data, but without an account you cannot use the AI features.
4. Automated processing
Suggestions are generated automatically by AI models. They are proposals only; you decide what to send. We do not make decisions producing legal or similarly significant effects on you solely by automated means. Usage limits for the free plan are applied automatically based on counters, not on the content of your messages.
5. Age
The App is intended for users aged 13 and over. If you are a parent or guardian and believe your child has provided us data without permission, contact [email protected] and we will delete it.
6. Who receives your data (processors and recipients)
We use the following service providers, bound by data processing agreements under art. 28 GDPR:
| Provider | Role | Location |
|---|---|---|
| Google Ireland Ltd. / Google LLC — Firebase Authentication, Firebase Cloud Messaging, Firebase Crashlytics, Google Analytics for Firebase | sign-in, push notifications, crash reports, in-app analytics | EU and USA |
| Google LLC — Gemini API | generation of text suggestions in all features, including Dating | USA / global; API data is not used to train Google models |
| Hetzner Online GmbH | hosting of our application servers | Germany (EU) |
| MongoDB, Inc. (MongoDB Atlas) | cloud database for account data | EU region |
| Oracle Cloud | hosting of our e-mail delivery system (self-hosted) | Germany (EU) |
| Cloudflare, Inc. | content delivery, DDoS protection and traffic routing for the Website and the API | EU / global edge |
| Apple Inc. / Google Commerce Ltd. | app distribution, payments and subscriptions under their own terms | per store |
| Google Ireland Ltd. — Google Analytics 4 and Google Ads conversion tracking | Website statistics and campaign measurement (only with your cookie consent) | EU and USA |
We may also disclose data to professional advisers and to authorities where the law requires it.
7. Transfers outside the EEA
Some providers process data in the United States. Transfers are based on the EU-US Data Privacy Framework where the provider is certified (Google, Cloudflare, MongoDB) and otherwise on the European Commission's Standard Contractual Clauses, with additional safeguards such as encryption in transit and at rest. You can request a copy of the relevant safeguards at [email protected].
8. Your rights
Under the GDPR you have the right to:
- access your data and obtain a copy (art. 15),
- rectify inaccurate data (art. 16),
- erase your data (art. 17) — you can delete your account directly in the App (Profile → Delete account); this removes your account, profile data and your address from our mailing list,
- restrict processing (art. 18),
- data portability (art. 20),
- object to processing based on legitimate interest, including product e-mails (art. 21) — use the unsubscribe link or write to us,
- withdraw consent at any time where processing is based on consent (cookies), without affecting the lawfulness of earlier processing,
- lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl). You may also complain to the authority of your place of residence.
To exercise your rights write to [email protected] from the e-mail address used in the App. We respond within one month.
9. Cookies and similar technologies on the Website
The Website uses:
| Cookie / technology | Provider | Purpose | Type | Duration |
|---|---|---|---|---|
typly_consent (local storage) |
Typly | remembers your cookie choice | necessary | 12 months |
_ga, _ga_* |
Google Analytics 4 | traffic statistics, anonymised | analytics — only with consent | up to 2 years |
_gcl_*, Google Ads conversion |
Google Ads | measuring whether an app install came from our campaign | marketing — only with consent | 90 days |
Analytics and marketing cookies are set only after you click "Accept" in the cookie banner. You can change your decision at any time by clicking "Cookie settings" in the footer or by clearing your browser storage. The App itself does not use cookies.
10. Security
Data is encrypted in transit (TLS). Request logs are encrypted at rest with a key held separately from the servers. Access to production data is limited to authorised personnel and logged. Passwords are never stored by us; authentication is handled by Firebase Authentication.
11. Changes to this policy
We will publish changes on this page and update the date above. For material changes we will inform you in the App or by e-mail.
12. Contact
Typly sp. z o.o., al. gen. W. Sikorskiego 9A lok. 24A, 02-758 Warsaw, Poland · [email protected] · [email protected]