Imprint & Privacy

No cookies — not one, not even a session cookie. No third-party trackers, ads, or analytics scripts: no Google Analytics, no Meta Pixel, nothing like that. No accounts either. There is no sign-up and no login anywhere in the app, so we hold no email address and no password of yours.

Your browser's local storage isused, but for the app rather than for tracking. It is where your drawings live (see "Your drawings and fonts"), and it holds two random ids the publishing check depends on (see "Proof that a font was drawn"). Neither contains anything about you. Nothing counted below can tell whether you have been here before: the analytics identifier is derived fresh each day and never stored on your device.

One thing is written the other way round: if you opt out with ?notrack, that refusal is remembered for the rest of the browser tab so a reload doesn't quietly undo it. It records that you declined, never anything you did, and it is gone when the tab closes.

Visiting the live site (fontane.studio) briefly logs the events below. Every one of them is either a count or a fixed category from a short list — never free text, never a file, never anything you drew:

• Page visits— counted via a one-way hash of your IP address, your browser's user-agent, and the calendar date, combined with a private salt. That hash changes every day and can't be reversed back into your IP — it only lets us approximate how many different people visit per day, without storing your actual IP anywhere. We also record the referring site's hostname only (e.g. "google.com"), never a full URL or query parameters, plus which page you landed on (e.g. "editor", "marketplace"), your country as a two-letter code, your browser language as a two-letter code, and whether the device is a phone, tablet or desktop. The country comes from our host's edge network and the device category is read from the user-agent string — neither the IP nor the full user-agent is stored.
• A visit id— a random number generated fresh on every page load and kept only in the page's memory. It is notstored on your device, so reloading, opening a second tab, or coming back tomorrow all produce a completely unrelated id, and there is no way to connect them. It exists so the events in one visit can be counted together — for example "how many visits used a drawing tool at least once" — rather than as unconnected totals.
• Time on site — how many seconds a visit was actually visible, and in which part of the app (for example the letter grid, a single letter, the Typer, the Writer).
• Tool actions— that a tool was used and which one (e.g. "pen", "eraser"), in which part of the app, and whether the input was a stylus, a finger or a mouse. Not what you drew with it, where on the canvas, or on which letter.
• Undo — that an undo happened, and which tool had been used last.
• Font exports— which file format you exported (e.g. "otf") and roughly how many letters the document had, as one of five ranges (empty, 1–5, 6–20, 21–60, more than 60). The exact number is never recorded, and neither is the font itself.
• Character sets— which of the built-in character sets (e.g. "Latin Extended") you switched on or off in the Grid.
• Blocked actions and errors — that an entry code was rejected, or that something like an export failed, with a short label saying where. Never the code you typed, and never the contents of an error.
• Guided tour — that the first-time tour started, that it was completed, or the step number (1–8) it was skipped at. Never anything about what you drew.

Your language is taken from the Accept-Languageheader your browser sends with the request anyway, and your country from our host's edge network — we don't ask your device for either. None of this fires from local development or preview deployments, only the real production site. It is processed under legitimate interest (GDPR Art. 6(1)(f)): understanding rough usage without identifying anyone.

Three ways, all of which work without you telling us anything:

• If your browser or extension sends Global Privacy Control (or the older Do Not Track), we drop the request before anything is read, derived or written. Nothing needs configuring here.
• Add ?notrack to the URL (e.g. fontane.studio/?notrack) and nothing is sent for the rest of that visit — including once you move on into the editor, so opting out on the way in covers the drawing too. It survives a reload, but only for that browser tab; open a new one and it has to be part of the address again — bookmark it and that happens by itself. For an opt-out that holds everywhere and forever, use Global Privacy Control or Do Not Track above instead.
• Block requests to /api/track. Nothing else on the site depends on them.

The daily visitor hash is erased after 90 days. The remaining event rows — counts and category labels — are deleted after 14 months. The stroke summaries described under "Proof that a font was drawn" are deleted after 60 days for a project that was never published; for a font that was published they are kept as long as it is listed, because they are the evidence for it.

You have the right to access, rectification, erasure, restriction, portability, and to object (GDPR Art. 15–21). We have to be straight with you about one of them: for the analytics data we genuinely cannot identify you, and we won't ask you for extra information in order to be able to — so we can't look up "your" rows to show or delete them, and Art. 11(2) is exactly the case this describes. Objecting is the right that does work in practice, and any of the three methods above exercises it immediately. For anything concerning a font you published to the Marketplace, write to us and we can act on it. You can also complain to a supervisory authority — for us that is the Berlin Commissioner for Data Protection and Freedom of Information.

Everything you draw and tag — strokes, glyphs, metrics, settings — is saved only in your own browser's local storage. We never see it. The drawing itself only leaves your browser if you choose one of these (the one thing that is sent without asking is a summary of each stroke, described under "Proof that a font was drawn" below — never the drawing):

• Export a font, JSON, skeleton SVG, or FFF project file — generated entirely in your browser and offered to you as a download; nothing is uploaded.
• Publisha font to the Marketplace — this uploads the compiled font file plus the name you chose to our storage, along with a small metadata record (font name, glyph count, publish date, download count). Once published, it's public — anyone with the link, or browsing the Marketplace, can view and download it. There's no account system, so a published font currently can't be edited, renamed, or taken down by request through the app — double-check what you're publishing beforehand.

Publishing to the Marketplace is open to anyone and has no account behind it. What keeps it from becoming a dumping ground for fonts nobody drew is a plausibility check: before the server accepts a font, it has to already hold a record of that font being drawn, over time.

So while you draw, the app sends a short summary of each stroke: which tool made it, which part of the editor you were in, how many points it had, how long it took, the average pen pressure and how much that pressure varied, and the width and height of its bounding box. Never the coordinates, never an image, never which letter it was. A summary cannot be turned back into anything you drew — it says that a stroke happened and roughly how, not what it looked like.

Two random ids hold those summaries together: one for this browser, one for the project you have open. Your browser generates both, keeps them in its own local storage, and neither contains anything about you. Starting a new file rolls the project id; clearing this site's data in your browser settings removes both.

They are recorded while you draw, before anyone knows whether you will ever publish — which is exactly what makes them proof rather than a formality. If you never publish, they are deleted after 60 days. This is also the one thing ?notrack does not switch off, and the reason is honest rather than convenient: it is not telemetry, it is the check itself, and quietly skipping it would just be a way to publish around it. If you would rather not have it at all, block requests to /api/provenance/events — drawing, exporting and downloading all keep working; publishing is the only thing you give up. Legal basis: legitimate interest (GDPR Art. 6(1)(f)) — keeping the Marketplace something people can trust.

The site is hosted on Vercel (application and edge network), with Supabase as our database and file storage provider for published fonts and the anonymous analytics described above. We don't run any servers of our own.

This describes what the site actually, technically does today, kept in sync as that changes — not a substitute for formal legal advice. If you need a legally certified policy for your own use case, have it reviewed by a lawyer.