Privacy Policy

Last Updated: July 29, 2026

At Check CPS, we respect your privacy, and this Privacy Policy (the "Policy") explains how we handle information about you when you use the website at https://checkcps.com (the "Site") and the Check CPS browser extensions (the "Extensions").

1. Our Services and Scope of this Policy

The Site provides a suite of tools designed to test and improve your clicking speed and accuracy. Our primary service is the Click Speed Test (the "CPS Test"), which challenges you to click your mouse, trackpad, or keyboard as fast as possible within a set time. The Site supports multiple test durations and may also offer additional tests or interactive features, such as reaction time tests and double-click checks (collectively, the "Services").

How much personal data we process and how depend on how you use the Services as a visitor, a registered user, or through the Extensions. Those roles are described in Section 4, and the practices for each follow below.

This Policy describes the source and types of personal data we process, why we process it, our legal bases, who we share it with, how long we keep it, and your rights and choices.

2. Acknowledgment of the Policy

This Policy is provided to inform you of our data practices. Using the Services does not by itself amount to consent to any processing that requires your consent under applicable law. Where we rely on consent, we ask for it separately, and you are free to decline.

If you do not agree with the practices described here, please do not use the Site, the Extensions, or the Services.

3. Data Controller and Applicable Law

The data controller responsible for your personal data is:

• Legal Identity: Burak Özdemir, self-employed (autónomo) registered in Spain
• Registered Country: Spain
• Business Address: Calle Puerto 14, 5th floor, 29016, Málaga, Spain.
• E-mail: contact [at] ozdemir [dot] dev .

We are established in Spain, so our processing of your personal data is governed by the EU General Data Protection Regulation (the "GDPR") under its Article 3(1) and by Spain's Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (the "LOPDGDD"). The UK GDPR applies to users in the United Kingdom.

Our lead supervisory authority is the Spanish Data Protection Agency (Agencia Española de Protección de Datos, the "AEPD"), at aepd.es. If you are in the EEA, you may also lodge a complaint with the supervisory authority in your own country. If you are in the United Kingdom, you may complain to the Information Commissioner's Office at ico.org.uk.

4. Data Subjects

What personal data we process, where it is stored, and how it is used depends on how you interact with the Site. Your user status determines each of these.

Visitors

Visitors may use the CPS Test and other features without creating an account. We do not collect registration data from you. Your test results, click history, and personal best are stored locally in your browser using local storage and are never transmitted to our servers. These local scores are not eligible for public leaderboards, global rankings, or any competitive feature. Because we have no server-side access to this local data, our processing for visitors is limited to server logs, which we keep for security, and cookieless, aggregate analytics through Ahrefs Web Analytics, which does not track individual users. Local data is tied to your browser and device. It may be lost if you clear your browser data or switch devices or browsers and can be deleted at any time by clearing your browser data.

Registered Users

Registered users create an account by providing an email address, username, and password. If social login is offered and you choose it (for example, Google), we receive from that provider the account information you permit through your settings, which may include your name and email address. We do not request or store a profile picture or avatar from any social login provider. Account data and the click data, verified test scores, settings, and history generated while signed in, are transmitted to and stored on our servers (hosted with Laravel, on DigitalOcean infrastructure). This enables verified score submission, participation in public leaderboards and rankings, and cross-device access to your history. Because signed-in scores are stored and verifiable, they are eligible for public leaderboards, and your username and score may be shown publicly, as described in Section 5 and Section 8. If you do not want a name shown publicly, choose a username that does not identify you.

Extension Users

The Check CPS browser extensions let you run the click speed test locally in your browser. The Extensions have no account, no leaderboard, and no server component. Your recent scores and personal best are stored only in your browser's local storage and are never transmitted to us. We do not collect, receive, or store any personal data through the Extensions. Your use of the Extensions is also subject to that browser's terms and to the permissions shown at installation. The server-side practices described elsewhere in this Policy (accounts, leaderboards, hosting, advertising, and analytics) do not apply to the Extensions.

Children

The Site is not directed at children under the age of thirteen (13). To create an account, you must also meet the minimum age of digital consent that applies in your country, which in parts of the EEA is higher than 13 and may be up to sixteen (16). If you are below the applicable age, you may only use an account with the consent, and under the supervision, of a parent or legal guardian who agrees to our Terms of Service.

We do not knowingly collect personal data from a child below the applicable age without that consent. If you believe a child has provided us with personal data without it, please contact us at contact [at] ozdemir [dot] dev , and we will take steps to delete it promptly.

5. Sources, Types, Purposes & Legal Bases of Personal Data Processing

We process personal data in different ways depending on how you use the Site. For each activity below, we give the source and type of data, why we process it, and our legal bases.

Technical Server Logs (all users)

When any device connects to the Site, our server (Nginx) automatically records technical information in log files, including your IP address, browser type, operating system, and date and time of access.

We process these logs to keep the Site secure and stable, to detect and prevent attacks and abuse, and to troubleshoot faults. Our legal basis is our legitimate interest in the security and integrity of the Services. These logs are stored securely, are not used for marketing or analytics, and are accessed only for security investigations, to resolve critical technical faults, or in response to a lawful request from a competent authority. They are held on our hosting infrastructure and kept only as long as needed for those security purposes; logrotate deletes them automatically after no more than six (6) months.

Content You Use as a Visitor (Local Storage)

When you use the Site as a visitor without signing in, your test results, click history, and personal best are stored locally in your browser. This data stays on your device. We cannot access, see, or store it, and it is not transmitted to us. The only handling that occurs is your own browser reading and writing locally so the tool works. Because this data does not reach us, we do not process it as a controller, and you can delete it any time by clearing your browser data.

Click Data and Scores (Registered Users)

When you take a test while signed in, the click data your session generates (such as the timing and count of your clicks), together with your scores, settings, and history, is transmitted to and stored on our servers so we can calculate and record your score, show your history, place verified scores on the leaderboard, and give you access across your devices. Our legal basis is performance of our contract with you, meaning the account and competition features you asked for.

Registered users may delete their account and all associated server-stored data at any time through the account settings on the Site.

Detecting Cheating

To keep the leaderboard fair, we use automated systems, together with human review, to detect scores that are not consistent with genuine human input. Where a score is flagged, we may invalidate it, remove it from the leaderboard, or suspend an account. This process is not based solely on automated processing; if you are affected, you can ask us to review the decision, and a person will look at it, as described in our Terms and in Section 11.

We also use click data generated through normal use of the Site to develop and improve these detection systems over time. Where possible, we use click data for this purpose in pseudonymized form. Our legal basis is our legitimate interest in protecting the integrity and security of the competition. If you delete your account or data, we stop using your stored click data for future development, though we cannot remove data already incorporated into a trained system.

To detect cheating and to re-tune our detection over time, we retain the raw click data from each score submission, including the precise timing of individual clicks. We keep this data for as long as your account remains active, because new forms of manipulation emerge and we need genuine past submissions to adjust our detection thresholds. If you delete your account, this data is deleted with it. Where we use this data to develop detection more broadly, we do so in pseudonymized form where possible.

Account Registration Data

If you create an account, we collect your email address, username, and password directly from you. Passwords are stored in hashed form and are never in plaintext. If you use social login (for example, Google), we receive information you permit through your settings, which may include your name and email address. We do not request, receive, or store a profile picture or avatar from any social login provider. After registration we process your email address to send a verification message and account-related notices. Our legal bases are the performance of our contract with you and, for security notices, our legitimate interest in protecting accounts. We store this data on our hosting infrastructure for as long as your account is active, for retention periods see Section 9.

When you register, we also derive and store a two-letter country code for your account. It comes from the CF-IPCountry header that Cloudflare adds to requests reaching our servers, which is inferred from your IP address at that moment. We use the code only to show a country flag next to your username on public leaderboards and rankings. We do not use it for profiling, analytics, advertising, or automated decision-making, and we do not store your IP address alongside your account; only the resulting country code is kept, for as long as your account is active. Codes that Cloudflare returns for an unknown location or for Tor are discarded. Our legal basis is the performance of our contract with you, and you can have the value erased by deleting your account.

Public Leaderboards

If you submit a score while signed in, your username and score may be shown publicly on our leaderboards and rankings, visible to anyone who uses the Site. Our legal basis is our legitimate interest in operating a public competition, which you take part in by choosing to submit scores while signed in. You can avoid public display by not submitting scores while signed in, by choosing a username that does not identify you, or by deleting your account.

Feedback

If you contact us through the feedback form or email, we process the message and the contact details you provide in order to read and respond. Our legal basis is our legitimate interest in handling inquiries and improving the Site.

Analytics

We use Ahrefs Web Analytics to understand overall Site traffic. The provider operates it without cookies and does not track individual users across sites. To the extent any identifier such as an IP address is handled momentarily to produce aggregate statistics, we rely on our legitimate interest in understanding and improving the Site and statistics we retain are aggregate and do not identify you.

Marketing Email

We do not send marketing or promotional email. The only emails we send are transactional: verification, security, and service notices related to your account.

6. Third-Party Service Providers and Recipients

To run the Site securely and reliably, we work with the providers below. Some act as our processors on our instructions; others, namely any sign-in provider you choose, and Google as our advertising partner, act as controllers in their own right for their part of the processing, under their own privacy policies.

Laravel (Hosting)

Laravel provides the hosting on which the Site runs, on infrastructure operated by DigitalOcean as its underlying provider. For all users, it processes server logs (IP addresses, browser type, operating system, and timestamps). For registered users, it also stores account data (email address, username), click data, scores, settings, and history. The servers are located in the United States, so this involves an international transfer as described in Section 9. Our legal basis is the performance of a contract and legitimate interest. For details on how these providers handle data, please refer to Laravel's and DigitalOcean's privacy policies.

Cloudflare (Security and Delivery)

Cloudflare helps protect the Site from malicious activity and speeds up content delivery. It may process your IP address and technical device data to distinguish real human visitors from malicious bots or automated attacks. Cloudflare is a US-based service, and data may be processed in the United States. Our legal basis is legitimate interest in the security and integrity of the Service. Cloudflare sets its own retention periods for this data; please refer to Cloudflare's privacy policy for details.

We also use Cloudflare Turnstile on our account registration and password reset forms to tell real people apart from automated bots. Turnstile analyses technical device and browser signals, such as request headers, user-agent strings, and how your browser renders the page, to produce a verification token that is submitted with the form and checked against Cloudflare's verification endpoint on our servers. Cloudflare's bot-management infrastructure may also set a short-lived first-party security cookie (__cf_bm, typically expiring after about thirty (30) minutes) for this purpose. This processing is strictly necessary to prevent automated abuse and bot-driven account creation, so it does not require your prior consent. Our legal basis is legitimate interest.

Google AdSense (Advertising)

We use Google AdSense to serve advertisements. Google uses cookies and similar identifiers and processes online identifiers, including cookie IDs, device identifiers, and IP addresses, to display ads, prevent ad fraud, and cap how often you see a given ad and, if you agree, to personalize ads based on your browsing. The legal basis for processing is your consent. This happens only if you consent through the ad settings. For details on how Google handles this data, please refer to Google's privacy policy.

• Consent Management: We use Google's integrated CMP (Consent Management Platform). You can customize your ad preferences or revoke consent at any time through the ad settings. Withdrawal of consent does not affect the processing carried out before the withdrawal, and after withdrawal Google will no longer use your data for personalized advertising on this Site.

7. Cookies

Our Own Cookies

We do not set first-party cookies for tracking or analytics. Where we need to remember a strictly necessary choice, such as your signed-in session, we use the minimum browser storage required for that function, listed below.

Third-Party Cookies

As mentioned above, Google AdSense may set cookies and similar identifiers to serve and measure ads on this Site and across the web, as described in Section 6.

You can opt out of personalized advertising by visiting Google's Ad Settings. To understand how Google processes data through its partners, visit Google's Partner Policy page.

The Extensions do not use cookies.

8. Sharing of Personal Data

We do not sell, rent, or trade your personal data, and we do not share it with third parties for their marketing purposes. We share personal data only in the following circumstances:

• Our hosting provider, Laravel, and its underlying infrastructure provider, DigitalOcean, store and process technical data (including IP addresses and server logs) and, for registered users, account data, click data, scores, settings, and history solely to run the infrastructure the Site depends on. Our security and delivery provider, Cloudflare, processes IP addresses and technical device data solely to protect the Site against malicious traffic. These providers act as our processors, and our legal bases are performance of contract and legitimate interest.
• If you consent to advertising, Google processes advertising data to serve and measure ads, as described in Section 6 and Section 7. This happens only if you consent through the ad banner.
• If you submit scores while signed in, your username and score are shown publicly on leaderboards and rankings visible to all Site users, on the basis described in Section 5. You can stop this by not submitting scores while signed in or by deleting your account.
• Our authorized contractors or developers may access technical logs where necessary to investigate security threats or resolve critical faults, on the basis of our legitimate interest. All such parties are bound by confidentiality obligations and act only on our instructions.
• If we go through a business transition such as a merger, acquisition, or sale of assets, your personal data may be among the assets transferred. We will tell you through the Site or by email before it takes effect, and we will require the acquiring party to honor this Policy or to give you notice and choices consistent with it.
• We may disclose personal data to courts, law enforcement, or government authorities where required by a lawful request, court order, or legal process on the basis of compliance with a legal obligation. Where we are legally able to, we will try to notify you before disclosing.
• We may use and disclose personal data where necessary to protect the security and integrity of the Services and to enforce our Terms of Service, on the basis of legitimate interest.

9. International Transfers and Data Retention

Where your data is processed

Our main service providers are located in the United States: Laravel and DigitalOcean (hosting), Cloudflare (security and delivery), and Google (advertising). As a result, personal data, including server logs and, for registered users, account data, click data, scores, and history, is transferred to and processed in the United States.

For users in the EEA and the UK, we transfer personal data to these providers on the basis of the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum) under GDPR Art. 46, and, where a provider is certified, the EU-US Data Privacy Framework. You can ask us for information about the safeguards that apply, using the contact details in Section 15.

Data Retention Periods

Technical server logs (IP addresses and access data) are retained for 6 (six) months, then deleted automatically using logrotate technology on our hosting infrastructure.

Local scores (visitors and Extensions users) are stored only on your device. We set no retention period because we do not hold it; it stays on your device until you delete it or clear your browser data.

Registered-user account data (email address, username, click data, settings, and history) are kept as long as your account is active. When you delete your account, we permanently delete this data from our servers within thirty (30) days, apart from anything we must keep by law. Deletion also ends any further use of your click data to develop our detection systems.

Raw click data from submissions (including per-click timing), used for scoring and for detecting and re-tuning against cheating: retained for as long as your account is active, then deleted when you delete your account, within thirty (30) days. We do not keep it on a fixed shorter schedule because we rely on genuine past submissions to keep detection effective.

Analytics: Our Ahrefs statistics are aggregated and contain no personal data, and we may keep them for historical traffic analysis.

10. Security

We use organizational, technical, and administrative measures designed to protect your personal data against unauthorized access, loss, destruction, alteration, or misuse. We work with providers such as Cloudflare to defend the Site against denial-of-service attacks, malicious bots, and unauthorized access.

If you use the Site as a visitor or use the Extensions, your scores stay in your browser's local storage and are not held on our servers, so their security depends on the security of your own device. For registered users, account data and server-stored content are held on our hosting infrastructure, and access is limited to authorized personnel. Access to server logs is limited to authorized personnel and used only for troubleshooting and security investigations.

No method of transmission or storage is completely secure, so while we work to protect your data, we cannot guarantee absolute security.

11. Your Data Protection Rights

The framework and authorities that apply to you are described in Section 3. Subject to the conditions and exceptions in the applicable law, you have the following rights.

Your right to access: You have the right to obtain confirmation of whether we process your personal data and, if so, to receive a copy with information about categories, purposes, retention, and recipients.

Your right to rectification: You have the right to have inaccurate or incomplete data corrected or completed.

Your right to erasure ("right to be forgotten"): You have the right to have your personal data deleted in certain circumstances, such as where it is no longer needed or where you withdraw the consent it relied on. We may be unable to comply fully where retention is required by applicable law or where a retention period in Section 9 has not yet expired. For data held in your browser's local storage as a visitor or through the Extensions, we have no server-side access and cannot erase it for you; you can remove it by clearing your browser data. For account data, you can request erasure or delete your account through your profile on the Site.

Access and Deletion Tools: You can download the data associated with your account and delete it at any time through your account settings. This lets you exercise your rights of access and erasure directly. Deleting your data or account removes it from our systems as described in Section 9, apart from anything we must keep by law and limited backups, and ends any further use of your click data to develop our detection systems.

Your right to restriction of processing: You have the right to ask us to limit our processing in certain situations, such as where you contest the accuracy of the data or object to our processing on legitimate-interest grounds.

Your right to data portability: For the data you have provided that we process by automated means on the basis of consent or contract, such as your account details, scores, and history, you have the right to receive it in a structured, commonly used, machine-readable format and to have it transmitted to another controller where technically feasible.

Your right to object to processing: You have the right to object to processing based on our legitimate interest on grounds relating to your particular situation.

Your right to withdraw consent: Where we rely on your consent, including consent to personalized advertising through Google AdSense, to withdraw it at any time through the ad settings. Withdrawal does not affect processing carried out before it.

Your right not to be subject to solely automated decision-making: We use automated systems to help detect cheating, as described in Section 5. This process is not based solely on automated processing because a person reviews a decision when you ask us to. If a score of yours is invalidated or your account is affected, you may express your view, ask for a human review, and contest the outcome by contacting us. These systems are not perfect and may occasionally err, which is why the review route exists.

Your right to lodge a complaint: If you are not satisfied with how we handle your data, please contact us first so we can try to resolve it. You may also complain to a supervisory authority. As the controller's establishment is in Spain, the lead supervisory authority under GDPR is the Agencia Española de Protección de Datos (AEPD), reachable at aepd.es. EEA users may also complain to the data protection authority of their own country, and UK users to the ICO (ico.org.uk).

12. Exercising Your Rights

We handle rights requests in line with the law that applies to you. Under the GDPR, we respond without undue delay and within one (1) month of receipt, extendable by a further two (2) months for complex or numerous requests, in which case we tell you within the first month. If a request is refused, you will be notified of the grounds for refusal within the applicable response period.

You can exercise your rights by contacting us at contact [at] ozdemir [dot] dev . We may ask you to verify your identity before we act so that we do not disclose your data to someone else. Requests are free of charge. Where a request is manifestly unfounded, excessive, or repetitive, we may charge a reasonable fee or decline to act, as the applicable law allows, and we will explain that decision.

13. Updates to this Policy

We may update this Policy to reflect legal, technical, or business changes. When we do, we post the revised version and update the "last updated" date at the top.

For minor changes that do not materially affect your rights or the way we process your data, posting an updated Policy constitutes sufficient notice. For material changes, including changes to the categories of data we collect, the purposes, the legal bases, the recipients, or your rights, we will give registered users reasonable advance notice by email before the change takes effect. Where the change involves processing that requires your consent, we will ask for that consent separately rather than treating your continued use as agreement.

Continued use of the Services after an update means you are aware of the current Policy. It does not, by itself, amount to consent to any processing that the law says requires your separate consent.

14. Language

The governing language of this Policy is English. Any translation is provided for reference only, and the English version prevails in the event of a conflict. Communications about this Policy will be in English unless we agree otherwise.

15. Contact Information

If you have questions or complaints about this Policy, or you wish to exercise your rights, please contact us in writing at contact [at] ozdemir [dot] dev .