Privacy

How the no-upload guarantee is enforced

There are no API routes, no server actions and no server-side file handling anywhere in this application. Font bytes are read with the FileReader API, processed in Web Workers, and written to object URLs your browser creates locally.

Every response carries a Content-Security-Policy with connect-src 'self' and form-action 'none'. Even if a dependency tried to POST your font somewhere, the browser would block the request and log it to the console. The automated test suite asserts that a full conversion produces zero cross-origin requests.

The WebAssembly engines — the WOFF2 codec and the HarfBuzz subsetter — are served from this origin. Nothing is fetched from a CDN.

What analytics collects

Vercel Analytics records page views: the URL, the referrer, and coarse device and country information. That is all it is configured to do here.

No custom events are sent. No file name, file size, family name, glyph count, table list, licence string or any other property of any font you open is ever recorded, transmitted or logged. The conversion code path contains no analytics call at all.

What is stored on your device

Nothing persistent. Fonts you add live in memory for the lifetime of the tab. Object URLs are revoked when a preview is replaced or the queue is cleared. Closing the tab discards everything; there is no local database, no cache of your files and no session to resume.

Related

• Licensing

  What OS/2 fsType embedding bits mean, why converting a font grants you nothing, and how to check whether you may subset or web-embed a font you own.

  Open

• Home

  Convert, inspect, preview and subset fonts entirely in your browser. Nothing is uploaded. Batch queue, glyph coverage, web-font packs and honest verification of every file produced.

  Open