Privacy

This page describes what actually happens to data when you use HeyMadeFonts. It is a factual description of our set-up, not a certification. Last reviewed: 9 November 2026.

Who is responsible: The operating company will be named here before public launch. Contact: [email protected].

Where things run

Every request to heymadefonts.com and fonts.heymadefonts.com passes through Cloudflare's network before it reaches our server. Cloudflare answers many requests from the data centre closest to the visitor, which can be outside the EU, and processes the visitor's IP address and request headers to deliver and protect the service. Cloudflare keeps its own security and operational logs under its own terms. We therefore do not claim that requests are processed only in the EU. Our own servers and storage are in Germany.

The font CDN (fonts.heymadefonts.com)

• No cookies are set, and no cookies are read.
• Our origin server does not write access logs for this host. We do not record which website requested which font.
• The CSS contains only font information. It loads nothing from any third party.
• Responses are cached for a long time. Many requests are therefore answered by Cloudflare without reaching our server.
• Like any web request, a font request reveals the visitor's IP address and browser headers (including the Referer of the embedding page, if that site sends one) to the services that deliver it: Cloudflare and, on a cache miss, our server. We do not store these on our server.

The website

• No analytics service, advertising pixel or third-party script is loaded. Fonts on this site come from our own servers.
• Browsing pages sets no cookies. A session cookie (strictly necessary, for form security) is set only on the scan form, the contact form and the staff login.
• If you switch between light and dark mode, the choice is saved in your own browser (localStorage) and never sent to us.
• We count some actions anonymously per day: the event name and a coarse label such as a font name. Examples are a code snippet copied, a download, or a link to HeyMadeIt clicked. The counts contain no IP address, identifier or URL of yours. They are kept for 30 days.
• To limit abuse, we rate-limit some actions using a keyed hash of your IP address. The key changes every day, and the hash lives in a short-lived cache entry for at most a few hours. We do not store your IP address.

The website scanner

• When you scan an address, our server in Germany fetches that one public page and the stylesheets it references, as a plain HTTP client. It does not run the page's JavaScript and does not download font files.
• We store the normalised address, the findings and redacted evidence: hostnames and paths with query strings removed. Reports are private to the browser that started the scan. A browser cookie scoped to that report holds the access key; we store only a hash of it.
• Reports are deleted automatically after 7 days, or immediately when you press "Delete report". A share link is created only if you ask for one. It expires after at most 7 days and can be revoked at any time.
• The website you scan sees a request from our server, with a user agent that identifies the HeyMadeFonts scanner. It does not see your IP address.

Contact form and staff accounts

Messages sent through the contact form (name, email address, message) are kept for 90 days and then deleted. Staff accounts and the admin audit log are kept for operating the service. The audit log is kept for 365 days.

Your rights

You can ask for access to, correction of or deletion of personal data we hold about you, or object to its processing, by writing to [email protected]. You can also complain to your data protection authority.

What this page is not

Using HeyMadeFonts does not, by itself, make a website compliant with the GDPR or any other law. Whether loading fonts from any provider is lawful depends on the whole website, its legal basis, its agreements and its consent set-up. For advice about your website, ask a qualified lawyer.