Privacy Policy

In short

Who is responsible

Typomat is developed by Marco Lüthi, the controller responsible for data processing under the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

Marco Lüthi
Gutstrasse 172
8055 Zürich
Switzerland
hi@luthi-mar.co

Your fonts

Your fonts are saved in the app on your device: each font's name, its dial settings, and any words and colours you set on its specimen or poster. The font itself is compiled on your device from those settings. The app has no servers of its own and does not ask for access to your camera, microphone, photos, contacts or location.

iCloud Drive

If iCloud Drive is available on your device, the app also keeps each font as a .typograph file in the app's folder in your iCloud Drive, so your other devices can pick it up and you can see the files yourself. Without iCloud, the app works the same and your fonts stay on your device.

When you delete a font in the app, its file moves to a folder named Deleted inside that folder, and it stays there until you remove it. The app also keeps a small list of deleted fonts in the app's hidden part of your iCloud Drive, so that a deleted font doesn't come back from another device.

iCloud Drive is a service provided by Apple to you. The developer has no access to your iCloud Drive and never receives your fonts. Apple processes this data under its own privacy policy: apple.com/legal/privacy. You can delete the files in the Files app or in Finder, or turn off iCloud Drive for the app in your device's settings. Deleting the app deletes the data stored on your device.

Export and sharing

You can send a font as a TTF file, a poster of it as a PNG or PDF, or its source as a .typograph file. On iPhone and iPad it goes only to the apps, places and people you choose in the share sheet. On Mac you can also save a file wherever you choose. The app does not upload it anywhere. A .typograph file holds the font's name, settings and the words you set with it, so anyone you send it to can see them. A .typograph file you open in the app is read on your device and added to your fonts.

Accounts and engine licences

You only have an account if you sign in at engine.typomat.app, to try the API or manage an engine licence. If you do, or if you buy one:

• Signing in: your email address is stored by Supabase, Inc., which also sends your sign-in codes. Your browser talks to it only through this website. A sign-in keeps a session in your browser's local storage, which is what keeps you logged in, and it isn't used for anything else.
• Buying: checkout and billing are handled by Stripe, which receives your name, company, address, VAT number and payment details. The developer never sees your full card number. Stripe's own privacy policy applies to what it collects on its pages.
• Your licence: your email address, company name, the website you give us, your plan, licence dates and any licensed domains are stored with Supabase, and your company, plan, dates and domains are written into your licence key. API keys are stored only as a hash. The developer can see all of this, to run the business.
• The hosted API: fonts you make through it are generated, returned and forgotten. Their parameters and text aren't stored. The only thing kept is a count of fonts per licence per month. The hosting provider's short-lived server logs apply, as for any request.

These are needed to provide what you bought (Art. 6(1)(b) GDPR). Accounting records are kept as long as Swiss law requires, currently ten years. To delete your account otherwise, write to the address above. Supabase and Stripe may process data outside Switzerland and the EU, under standard contractual clauses.

The font engine on this website

The pages on this website let you turn dials and try fonts without the app. It runs the app's font engine as WebAssembly in your browser. The dials you turn and the text you type are handled there and are not sent to the developer or to any server. The pages only request their own files from this website.

On typomat.app/make, your font's name and settings are kept in your browser's local storage, so they're still there when you come back. That isn't a cookie, it isn't sent anywhere, and it's only there to do what you asked. To remove it, press Start over, or clear this site's data in your browser.

If you buy a font

Checkout is handled by Stripe, which receives your email address, payment details and, where needed, your address. Your font's name and settings go along with the payment, so the font can be made. Your font is then sent to your email address by Resend, Inc., which is how it reaches you, under its own privacy policy. The developer keeps your email address, the font's name and settings, and the amount, to deliver it and for accounting. Accounting records are kept for as long as Swiss law requires, currently ten years. This is needed to provide what you bought (Art. 6(1)(b) GDPR). Stripe's own privacy policy applies to what it collects on its pages.

TestFlight beta

While Typomat is in beta, it is distributed through Apple's TestFlight. If you join the beta, Apple shares information such as your email address (if you were invited by email), crash reports and feedback you choose to send with the developer, under the TestFlight terms and Apple's privacy policy. This is used only to fix bugs and improve the app.

Legal basis

Where the GDPR applies, the processing described above is necessary to provide the features you use (Art. 6(1)(b) GDPR). Under the Swiss FADP, we process personal data only as described here and in line with its principles.

What the app does not do

• No account, sign-up or login.
• No analytics, crash reporting or ad tracking in the app.
• No tracking across apps or websites, and no selling or sharing of data with data brokers.
• No fonts are sent to the developer from the app.

Promo codes

From time to time the Typomat page on this website offers free promo codes. To get one, you enter your email address and, where Apple requires its terms for your country to come with the code, your App Store country. Only then does your browser send them to this website, and from there to the developer's code service, run on Supabase (servers in the EU). It picks a code and emails it to you through the email service Resend. The country is used only for that email and is not stored. Codes for students go only to school addresses: the service checks the part after the @ against a list of art schools and universities, and sends nothing if it isn't on it.

Your email address is not stored by the code service. It keeps only a one-way, keyed hash of it next to the code, so that each address gets one code and can ask for the same code again. Your IP address is kept the same way, as a hash, for up to 24 hours to stop the codes from being emptied by automated requests. Resend keeps a log of the email it delivered, including your address, for a limited time under its own privacy policy. Resend is based in the United States, and transfers rely on standard contractual clauses or equivalent safeguards.

Your address is used only to send the code: it is never added to a mailing list or shared with anyone else. The legal basis is your request (Art. 6(1)(b) GDPR) and, for abuse prevention, legitimate interest (Art. 6(1)(f) GDPR). Nothing is sent before you press the button.

This website

This website has no cookies, analytics or tracking. Fonts are served from this website itself, so your browser does not contact third-party font services. When you visit a page, the hosting provider Vercel Inc. (based in the United States, with data centres worldwide) automatically records technical access data in server logs: your IP address, date and time, the requested page, referrer and browser type. This is needed to deliver the site and keep it secure (legitimate interest, Art. 6(1)(f) GDPR). The logs are deleted after a short period. Links to the App Store take you to Apple, where Apple's privacy policy applies.

Your rights

You have the right to request access to your personal data and to have it corrected or deleted, to object to or restrict processing, and to data portability. Because the apps store your data on your device and do not identify you, the developer usually holds no personal data about you. Most of it you can delete yourself by deleting the app.

To exercise your rights, email hi@luthi-mar.co. You can also lodge a complaint with a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU the data protection authority of your country.

International transfers

Apple may process data in the United States and other countries. Apple describes the safeguards it uses for these transfers, such as the Data Privacy Framework and standard contractual clauses, in its privacy policy. This website is hosted by Vercel Inc., based in the United States; its server logs are transferred under the same kind of safeguards.

Children

Typomat is not directed at children and does not knowingly collect data from them.

Changes to this policy

If the app starts handling data differently, this page will be updated before the change ships, and the date at the top will change.