Privacy

• GitHub profile — only if you sign in. We store your GitHub name, email, avatar URL and login (used as your handle). We never receive your GitHub password and we request no repository scopes.
• Typing attempts — the drill you played, your WPM, accuracy, consistency, error count and per-second speed samples. Per-second samples are required to compute consistency and to detect impossible scores on leaderboards.
• Request analytics — path, HTTP method, status code, response time, the tz query parameter, browser family, referring host, country, and a pseudonymous client id.

We do not store IP addresses. To count unique visitors we computeHMAC-SHA256(secret, ip + "|" + user-agent + "|" + today's date)and store only that hash. The IP is discarded immediately and never written to disk.

Because the current date is part of the input, the hash rotates every day— the same visitor is a different id tomorrow, so we cannot build a long-term profile of you even from our own database.

• Raw request analytics: deleted automatically after 90 days.
• Daily aggregate counts (totals per day, per timezone) are kept indefinitely. They contain no per-person data.
• Your account and attempts: kept until you delete your account.

One cookie: the Auth.js session token, set only after you sign in. It isHttpOnly, SameSite=Lax, and markedSecure in production. There are no advertising or analytics cookies.

Go to Settings and use “Delete account”. This permanently removes your user row, linked GitHub account, every attempt, your progress records and your race participation, in a single transaction. It cannot be undone. Aggregate analytics counters (which contain nothing identifying) are not affected.

Questions or a deletion request you cannot complete yourself: open an issue at github.com/shouldideploy/shouldideploy.dev.