Privacy policy

What we store

• Your account: username, email address, and a salted hash of your password (never the password itself). Optionally a profile picture, cover image and "about me" text, if you add them.
• Your country: when you sign up, we detect your country from your connection's IP address (Cloudflare, which sits in front of the site, tells us the country). We store only the two-letter country code, never the IP address, and we don't detect it again after that. It is shown as a flag beside your name. You can change it, or choose "No country" to hide it, in Settings.
• Google sign-in: if you use "Continue with Google", we receive your Google account ID, email address and whether Google has verified it, and your display name (used only to suggest a username). We do not receive your Google password, contacts, files or anything else, and we never post to or act on your Google account.
• Gameplay: the scores and replays you submit, with their mods, statistics and timestamps; which beatmaps you download, favourite or pin; which replays you watch.
• Things you upload: beatmaps (lyrics, timing, audio and artwork) and any reports you file.
• Sign-in state: short-lived codes we email you, and session tokens for the website and the game.
• Server logs: the web server records requests (including IP address and browser) for security and debugging. These logs are rotated and not kept long-term, and are not used to build profiles of anyone.

What is public

Your username, profile picture, cover, "about me", country, scores, replays, rankings and uploaded beatmaps are shown publicly on the site, in the game and in the type!beat Discord. Your email address and anything tied to Google sign-in are never shown to other players.

Cookies

We only use cookies needed to sign you in and keep you signed in (a session cookie, plus short-lived encrypted cookies during an email-code or Google sign-in). There are no advertising cookies, no analytics or tracking scripts, and nothing is shared with ad networks.

Who else handles your data

We do not sell your data. A few services process it on our behalf, only to run the site:

• Hetzner hosts the servers and database.
• Cloudflare sits in front of the site for security and caching.
• Resend delivers our emails (sign-in codes, password resets).
• Sentry receives crash reports when something breaks, configured not to include personal data.
• Google handles sign-in when you choose "Continue with Google".

Google user data

Data received from Google is used only to sign you in and to link your Google account to your type!beat account. It is not used for advertising, not sold, and not shared with anyone except as needed to run the service. You can unlink Google in Settings (once your account has a password), or revoke type!beat's access from your Google account's security settings at any time.

Deleting your account

You can delete your account yourself in Settings. This removes your email, password, Google link, profile details, favourites, pins, download and watch history, and sign-in tokens. Your scores and uploaded beatmaps stay on the leaderboards so other players' rankings are not disturbed, but they are anonymised and no longer connected to you. If you can't sign in, email contact@mingda.sh from your account's address and we'll do it for you. You can also ask us for a copy of the data we hold about you.