Fontied (“Fontied”, “we”, “us”) is an independent, free project, operated from Bosnia and Herzegovina. For the purposes of the EU General Data Protection Regulation (GDPR) and the Law on the Protection of Personal Data of Bosnia and Herzegovina, Fontied is the data controller.
This policy covers two separate things, and it is worth keeping them apart: the Fontied browser extension, and the fontied.com website. They behave very differently, and the extension is by far the more private of the two.
This is not a carefully-worded claim with an escape hatch in it. The Fontied extension has no server, no account system, no analytics, no crash reporting, no unique identifier and no stored state. It does not phone home, because there is no home to phone.
What it is technically able to do
The extension requests exactly two Chrome permissions, and nothing else:
It deliberately does not request host_permissions, which would let it act on sites in the background, nor storage, cookies, history, tabs or downloads. It has no background service worker, so it is not running when you are not using it.
What happens when you use it
Because the extension uses no storage API of any kind — no chrome.storage, no localStorage, no IndexedDB — nothing at all persists between sessions. Close the popup and it retains nothing.
Fontied’s use of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Concretely: Fontied does not collect, transmit, sell, transfer or use any user data for any purpose, including advertising, credit assessment or lending. It does not use user data to train generalised artificial intelligence or machine learning models, and no human ever reads your data, because none is ever gathered.
A note on the fonts you download
Downloaded font files stay on your device and we never see them. Downloading a font is not the same as being licensed to use it: most typefaces are protected by copyright and licensed for specific uses. Checking that you have the right to use a given font is your responsibility, not ours.
The fontied.com website sets no cookies, has no analytics platform, no tracking pixels, no session storage and no fingerprinting. There is no consent banner because there is nothing to consent to.
It also makes no third-party requests. Every file the page loads — including both typefaces, which are bundled at build time rather than linked from Google Fonts — comes from fontied.com itself. No other company learns that you visited.
One thing nevertheless involves your data, and it is the unavoidable consequence of a page being served to you over the internet:
| What | Data involved | Why, and on what legal basis |
|---|---|---|
| Server logs | IP address, date and time, the page or file requested, HTTP status, browser user-agent string, referring page | Written automatically by our hosting provider to keep the site running, diagnose faults and defend against abuse. Legitimate interests, GDPR Article 6(1)(f). We do not combine these logs with anything else, do not build profiles from them, and do not attempt to identify you from them. |
The site is served over HTTPS, so traffic between your browser and the server is encrypted in transit.
The pages ship no executable JavaScript. The site is built with a framework, but because every page is entirely static the build removes the client-side runtime, so what actually reaches your browser is HTML, CSS and two font files. There is no analytics or tracking code of any kind, and nothing runs in your browser that could collect anything.
Since 28 August 2026 the home page and the FAQ page each carry a single <script type="application/ld+json"> block. Despite the tag name this is not a program and does not run: it is a few lines of structured data — on the home page, stating that Fontied is a free Chrome extension and linking to its Chrome Web Store listing; on the FAQ, repeating the questions and answers already visible on that page — so that search engines describe them correctly. Browsers do not execute either one, they request nothing, and they cannot observe you. The privacy page you are reading now has no script tag of any kind.
If you email us, we necessarily process your email address and whatever you write, for the sole purpose of replying. We keep such correspondence only as long as it takes to deal with it.
That is the entire list. We do not sell, rent, or share personal data with advertisers, data brokers or anyone else. There is no advertising on this site and no affiliate tracking.
We keep no databases and no user records of our own. Hosting server logs are retained by our provider for a short operational period and then rotated out automatically; we do not archive copies of them. Email correspondence is kept only for as long as the matter is open.
If you are in the European Economic Area or the United Kingdom, the GDPR gives you the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw consent where processing rests on consent. Comparable rights exist under the data protection law of Bosnia and Herzegovina.
A contact address for rights requests is not published at the moment. Until one is, the route that still works in every case is a complaint to a supervisory authority, named at the end of this section.
One honest limitation
Because we hold almost nothing, and nothing that identifies you by name, we usually have no way to connect a request to any particular record. Where we cannot identify you from the data we hold, GDPR Article 11 does not oblige us to collect extra information about you merely to do so — and collecting more data in order to honour a privacy request would defeat the point. In practice this means an access request will most often be answered truthfully with “we hold nothing about you”.
You also have the right to complain to a supervisory authority. In Bosnia and Herzegovina that is the Agency for Personal Data Protection in Bosnia and Herzegovina (AZLP); in the EEA it is the authority for your country of residence; in the UK, the Information Commissioner’s Office.
Under the California Consumer Privacy Act as amended by the CPRA, we confirm that in the preceding twelve months we have not sold or shared personal information, and have not disclosed personal information for cross-context behavioural advertising or for any business purpose beyond the hosting described above. We do not use or disclose sensitive personal information. Because we collect no identifiers, we do not process data that would allow us to respond to a request to know, delete or correct with respect to a specific person, and we do not discriminate against anyone for exercising their rights.
Fontied is a developer and designer tool. It is not directed at children, and we do not knowingly collect personal data from anyone, including children under 13 (or under 16 in parts of the EEA). If you believe a child has somehow provided us with personal data, it will be deleted.