Privacy

We collect account identifiers, verified email or Google identity information, session records, subscription status, profile names, derived SVG/font artifacts you explicitly synchronize, and security events needed to operate MakeFont. Original source images and generated sheets remain in local browser storage.

For accounts created after October 19, 2026, we also store privacy-minimized first-touch acquisition data: source, medium, optional campaign, the first landing path without its query string, referrer hostname, capture time, and separate random analytics identifiers. We do not store a search query, advertising click ID, or full referrer URL in the account record.

We do not need or request payment-card numbers. Stripe collects payment details on its hosted checkout pages and returns billing identifiers and payment status to MakeFont.

• Font description, optional original file, default recognition language, and creation time stored locally in your browser.
• First-touch acquisition data is kept in browser storage for up to ninety days or until a new registration is recorded, whichever comes first.
• After sign-in and Submit, your font description and optional compressed reference image are sent through Cloudflare services for AI processing; the reference may be processed by OpenAI as described below. Accepted requests can return character sheets for the selected supported language, including characters absent from the reference. Production does not retain the submitted text or images in server processing logs.
• Operational metadata such as account actions, error categories, and idempotency keys; the AI font-sheet request does not create a server image-processing log.

Selecting an image or writing a description does not submit it. On Submit, the browser saves your draft in IndexedDB before a Google or email sign-in redirect. Returning restores the draft; a signed-in flow may resume submission after security and credit checks succeed. Drafts expire after twenty-four hours; clearing site data removes them sooner.

The browser prepares glyph crops, runs VTracer, presents the editor, and builds requested font formats locally. A submitted description and/or compressed reference can use AI services to create character sheets for a selected supported language, including characters absent from the reference; returned cells are reviewed and edited locally.

Automated output is untrusted visual assistance. It does not decide account permissions, charges, or final glyph mappings. Generation is never retried automatically. Some older saved projects offer an explicit Generate missing sheets action; using it sends the description and optional compressed style reference again for failed sheets while retaining successful ones. Local character recovery and font rebuilding do not call the image model.

Cloudflare provides application delivery, abuse controls, and the Workers AI binding plus AI Gateway used for the one-shot style-reference request. That call uses the default Gateway with caching and Gateway payload logging disabled. OpenAI processes that one reference through the configured image model. Stripe handles checkout, subscriptions, invoices, refunds, and disputes. Google handles OAuth when you choose Google sign-in. Google Analytics measures site usage and may receive browser, device, approximate location, referrer, page-path, interaction data, and a random analytics identifier after sign-in. Microsoft Clarity provides behavior analytics and session playback; it may receive interaction, performance, masked page-structure data, and the same kind of random analytics identifier. MakeFont does not send the account email or internal account identifier to either analytics provider.

The Core service does not store the source reference or generated sheets in R2, D1, Queues, or a server-side processing pipeline; it returns the response directly to the browser.

Original sources and generated sheets are retained only in local browser storage until you clear site data or delete the local Profile. Synchronized Profile metadata, derived artifacts, and registered-account acquisition attribution remain until you delete them or the account. Security, ledger, payment, and deletion audit records may be retained longer when necessary for fraud prevention, disputes, accounting, or law.

MakeFont uses private storage, short-lived upload and download authorization, owner checks, secure session cookies, origin validation, file signature and dimension limits, image rewriting, restricted SVG elements, non-root processing containers, rate limits, and signed payment webhooks. No internet service can promise absolute security, so we also limit the data included in logs and processing messages.

You may delete a profile, request account deletion, ask for access or correction, withdraw optional processing by not starting it, and manage a subscription through billing controls. Applicable law may provide additional access, portability, restriction, objection, or complaint rights. Contact support with the account email and a clear request; never send an OTP or password.

Privacy requests can be sent to support@makefont.app. Identity verification may be required before data is disclosed or deleted. This policy will be updated when production processors, retention periods, or product behavior materially change.