Version 1.0 · Effective 26 August 2026
fontied (“fontied”, “we”, “us”) is an independent, free project operated by Aldin Anđelija, based in Bosnia and Herzegovina. For the purposes of the EU General Data Protection Regulation (GDPR) and the Law on the Protection of Personal Data of Bosnia and Herzegovina, that is the data controller.
You can reach us about anything in this policy at privacy@fontied.com.
This policy covers two separate things, and it is worth keeping them apart: the fontied browser extension, and the fontied.com website. They behave very differently, and the extension is by far the more private of the two.
This is not a carefully-worded claim with an escape hatch in it. The fontied extension has no server, no account system, no analytics, no crash reporting, no unique identifier and no stored state. It does not phone home, because there is no home to phone.
The extension requests exactly two Chrome permissions, and nothing else:
activeTab — lets it look at the tab you are currently on, and only after you click the fontied toolbar icon. It has no access to any other tab, and no access at all until you click.scripting — lets it run its font-finding code inside that one page.It deliberately does not request host_permissions, which would let it act on sites in the background, nor storage, cookies, history, tabs or downloads. It has no background service worker, so it is not running when you are not using it.
Because the extension uses no storage API of any kind — no chrome.storage, no localStorage, no IndexedDB — nothing at all persists between sessions. Close the popup and it retains nothing.
fontied's use of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Concretely: fontied does not collect, transmit, sell, transfer or use any user data for any purpose, including advertising, credit assessment or lending. It does not use user data to train generalised artificial intelligence or machine learning models, and no human ever reads your data, because none is ever gathered.
Downloaded font files stay on your device and we never see them. Downloading a font is not the same as being licensed to use it: most typefaces are protected by copyright and licensed for specific uses. Checking that you have the right to use a given font is your responsibility, not ours.
The fontied.com website has no scripts, no cookies, no analytics platform, no tracking pixels, no session storage and no fingerprinting. There is no consent banner because there is nothing to consent to.
Two things nevertheless involve your data, and both are unavoidable consequences of a page being served to you over the internet:
| What | Data involved | Why, and on what legal basis |
|---|---|---|
| Server logs | IP address, date and time, the page or file requested, HTTP status, browser user-agent string, referring page | Written automatically by our hosting provider to keep the site running, diagnose faults and defend against abuse. Legitimate interests, GDPR Article 6(1)(f). We do not combine these logs with anything else, do not build profiles from them, and do not attempt to identify you from them. |
| Google Fonts | IP address, user-agent, referring page — sent to Google | Needed to display the site's typefaces. See section 4 — this is the one genuine third-party disclosure on this site. |
The site is served over HTTPS, so traffic between your browser and the server is encrypted in transit.
If you email us, we necessarily process your email address and whatever you write, for the sole purpose of replying. We keep such correspondence only as long as it takes to deal with it.
The typefaces on this site, Instrument Serif and Inter, are loaded from Google's servers at fonts.googleapis.com and fonts.gstatic.com. When your browser fetches them, Google receives your IP address, your user-agent string and the address of the page you are viewing. This happens before you interact with the page at all, and we cannot see or prevent what Google does with it.
We would rather this were not the case. Serving the same fonts from our own server would remove this transfer entirely, and we intend to do exactly that. Until this section says otherwise, assume the transfer described above is still happening.
Google acts as an independent controller for this data. Their handling of it is governed by the Google Privacy Policy. Google is based in the United States, so this involves a transfer outside the EEA; Google relies on the EU–US Data Privacy Framework and on Standard Contractual Clauses for such transfers.
We consider the legal basis for this to be our legitimate interest in presenting the site as designed (Article 6(1)(f)). You should know that some European data protection authorities and at least one German court take the view that embedding Google Fonts requires prior consent rather than legitimate interest. We are telling you this rather than hiding behind the more convenient reading, and it is the reason we plan to self-host.
If you would prefer to avoid this entirely today, a content blocker that blocks Google Fonts will do so; the site remains fully readable in fallback typefaces.
We do not sell, rent, or share personal data with advertisers, data brokers or anyone else. There is no advertising on this site and no affiliate tracking.
We keep no databases and no user records of our own. Hosting server logs are retained by our provider for a short operational period and then rotated out automatically; we do not archive copies of them. Email correspondence is kept only for as long as the matter is open.
If you are in the European Economic Area or the United Kingdom, the GDPR gives you the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw consent where processing rests on consent. Comparable rights exist under the data protection law of Bosnia and Herzegovina.
Exercise any of them by writing to privacy@fontied.com. We will respond within one month.
One honest limitation. Because we hold almost nothing, and nothing that identifies you by name, we usually have no way to connect a request to any particular record. Where we cannot identify you from the data we hold, GDPR Article 11 does not oblige us to collect extra information about you merely to do so — and collecting more data in order to honour a privacy request would defeat the point. In practice this means an access request will most often be answered truthfully with “we hold nothing about you”.
You also have the right to complain to a supervisory authority. In Bosnia and Herzegovina that is the Agency for Personal Data Protection in Bosnia and Herzegovina (AZLP); in the EEA it is the authority for your country of residence; in the UK, the Information Commissioner's Office.
Under the California Consumer Privacy Act as amended by the CPRA, we confirm that in the preceding twelve months we have not sold or shared personal information, and have not disclosed personal information for cross-context behavioural advertising or for any business purpose beyond the hosting described above. We do not use or disclose sensitive personal information. Because we collect no identifiers, we do not process data that would allow us to respond to a request to know, delete or correct with respect to a specific person, and we do not discriminate against anyone for exercising their rights.
fontied is a developer and designer tool. It is not directed at children, and we do not knowingly collect personal data from anyone, including children under 13 (or under 16 in parts of the EEA). If you believe a child has somehow provided us with personal data, write to us and we will delete it.
If this policy changes, the version number and effective date at the top of the page change with it. Material changes — anything that widens what is collected or who receives it — will be described here rather than quietly folded in. Removing the Google Fonts dependency described in section 4 will be recorded here when it happens.
Questions, corrections, or a rights request: privacy@fontied.com.