Privacy Policy

In short

Who is responsible

Typomat is developed by Marco Lüthi, the controller responsible for data processing under the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

Marco Lüthi
Gutstrasse 172
8055 Zürich
Switzerland
hi@luthi-mar.co

The SDK, and your users

The SDK runs inside your own product. It checks your licence key there, without contacting this website, and sends nothing to the developer. The only thing it ever fetches is the engine's own file, from wherever you host it. So what your users type and make in your product doesn't reach the developer. What your product does with their data is for your own privacy policy.

The hosted API

Fonts and outlines you make through it are generated, returned and forgotten. Their parameters and text aren't stored. What's kept is a count of fonts per licence per month, and when each key was last used. The hosting provider's short-lived server logs apply, as for any request.

Accounts and signing in

You only have an account if you sign in here, to try the API or manage a licence. You can also have a licence without one: buying doesn't need an account, and the developer can give someone a licence.

You sign in with a code sent to your email address. Your address is stored by Supabase, Inc. from the moment you ask for a code, even if you never use it, along with when that record was made and when you last signed in. The code is emailed by Resend, Inc., or by Supabase if that isn't available. Your browser talks to Supabase only through this website.

So that nobody can use the form to flood someone's inbox, each request for a code also keeps a one-way hash of your email address and of your internet address (Art. 6(1)(f) GDPR). Entries over a day old are removed the next time anyone asks for a code.

A sign-in keeps a session in your browser's local storage: the tokens that prove who you are, and your account details, including your email address. It keeps you logged in until you sign out, and its token goes to this website with requests from your account. The site's menu also checks for it, and the contact form fills in your address from it. It isn't used for anything else.

Buying

Checkout and billing happen on Stripe's own pages. Stripe receives your email address, name, company, address, VAT number if you give one, payment details and, on the plan tied to one domain, that domain. The developer never sees your full card number. From your account, the billing link opens Stripe's customer portal, for invoices, card details, switching plan and cancelling. Stripe's own privacy policy applies to what it collects on its pages.

This website takes from Stripe only what the next section lists, and Stripe's reference numbers for your checkout, customer record and subscription. The rest stays in the developer's Stripe account. Your licence belongs to the address you paid with, and appears when you sign in with it.

Your licence

Your email address, the name on the licence (your company, or failing that your own name or email address), the website you give us, your plan and its status, licence dates, any licensed domains and the licence key are stored with Supabase.

The name, plan, dates and domains are also written into the licence key, where anyone who has the key can read them. If you put the key in your product, that includes anyone who can read your product's code. A key that's already out can't be changed or recalled.

API keys are stored only as a hash, with the key's first characters so you can recognise it, its name, and when it was made, last used and revoked. The whole key is shown to you once and never stored.

The free trial

The trial needs no card, so Stripe isn't involved. You give your company's name and, if you like, its website, stored as above. To keep it to one trial per mailbox, a simplified form of your address is kept with the licence, without anything after a plus sign and, for Gmail, without dots. It stays after the trial ends, since that's what stops a second one.

If the developer gives you a licence

The developer can issue a licence by hand, with nothing charged, to someone who has never signed up. Your email address, your name or company, the plan, any domains and any end date are then typed in by the developer and stored as above. The website doesn't email you when this happens. Signing in with that address shows the licence. To have it removed, write to the address above.

What the developer keeps to run the business

The developer can see all of the above, along with font sales and messages, in an admin view that only the developer's admin address can open, checked on the server on every request. Two more things are kept there, and neither is shown in your account:

• The developer's own notes about a business, stored next to its email address.
• A log of what's been done in the admin: who did it, what it was, and the licence and email address it concerned. An entry can name a company, a plan or a font.

Emails about your licence

Beyond sign-in codes, this website emails the address on a licence, through Resend, in these cases only: when you've used 80% of your API fonts, and again when they're used up; shortly before a trial, a pilot or a licence given by the developer ends, and once it has; 14 days before a yearly licence renews; and when a payment hasn't gone through. To say what a renewal will cost, and to leave out anyone who has cancelled, this website asks Stripe about that subscription first.

These are part of providing the licence (Art. 6(1)(b) GDPR). They aren't marketing, and they aren't a mailing list. Which reminders have gone to a licence, and when, is kept with it, and appears in the developer's admin log.

Why, and for how long

Signing in, licences, the trial and the API's count are needed to provide what you bought or signed up for (Art. 6(1)(b) GDPR). There's no button to delete an account, and nothing here deletes these records by itself: they stay until you ask for them to be deleted, by writing to the address above. Accounting records are kept as long as Swiss law requires, currently ten years.

The contact form

If you write to us through a form on this site, your name, email address, company if you give one, the subject you pick and your message are stored with Supabase, and reach the developer by email through Resend, Inc. If the developer answers from the site, that answer is stored with your message and goes out through Resend too. A one-way hash of your internet address is kept with them, only to stop the form being abused: an address or device can only send so many messages.

They're used to answer you (Art. 6(1)(b) and (f) GDPR), and kept in the site's database for as long as that takes and for reference afterwards, up to two years. That doesn't cover the email in the developer's inbox, or the line in the admin log, with your address, for each answer or deletion. To have them deleted sooner, write to the address above. Both services may process data outside Switzerland and the EU, under standard contractual clauses.

The font engine on these pages

These pages let you turn dials and try fonts, by running the engine as WebAssembly in your browser. The dials you turn and the text you type are handled there and aren't sent to the developer or to any server. The pages only request their own files from this website.

This website

This website has no cookies, analytics or tracking. Fonts are served from this website itself, so your browser does not contact third-party font services. When you visit a page, the hosting provider Vercel Inc. (based in the United States, with data centres worldwide) automatically records technical access data in server logs: your IP address, date and time, the requested page, referrer and browser type. This is needed to deliver the site and keep it secure (legitimate interest, Art. 6(1)(f) GDPR). The logs are deleted after a short period.

The only thing this website keeps in your browser is the signed-in session described above, in local storage. Stripe's checkout and billing pages are on Stripe's own site, so they aren't covered by this. The emails this website sends show the Typomat icon, loaded from typomat.app, so opening one can appear in the same server logs. It's the same file for everyone.

Legal basis

Where the GDPR applies, what's needed to provide what you bought or signed up for rests on Art. 6(1)(b) GDPR, and keeping the site secure and free of abuse on legitimate interest (Art. 6(1)(f) GDPR), as the sections above say. Under the Swiss FADP, we process personal data only as described here and in line with its principles.

Your rights

You have the right to request access to your personal data and to have it corrected or deleted, to object to or restrict processing, and to data portability. If you have an account or a licence, or wrote to us, the developer holds the data described above, including any notes about you.

To exercise your rights, email hi@luthi-mar.co or use the contact form. You can also lodge a complaint with a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU the data protection authority of your country.

International transfers

This website is hosted by Vercel Inc., based in the United States; its server logs are transferred under safeguards such as the Data Privacy Framework and standard contractual clauses. Supabase, Stripe and Resend may also process data outside Switzerland and the EU, under standard contractual clauses.

Children

The Typomat Engine is for businesses. It isn't directed at children and doesn't knowingly collect data from them.

Changes to this policy

If this website starts handling data differently, this page will be updated before the change ships, and the date at the top will change.