What typeset.us collects.

No cookies, analytics or trackers

The site sets no cookies, stores nothing in your browser, and runs no analytics, advertising or session-recording scripts. An earlier version sent a notification to a public ntfy.sh channel on every page view; that has been removed.

What the host logs

typeset.us is hosted by Vercel. Like any web host, Vercel receives each request, including your IP address, your browser’s user agent, the address requested and the time, and keeps its logs under Vercel’s privacy policy. typeset.us adds nothing to those logs and runs no analysis on them.

Tools that contact another site

Google Fonts. The font tools (Library, Pairing Builder, Specimen, Variable Fonts and Animations) load typefaces from Google Fonts, so your browser requests them from fonts.googleapis.com and fonts.gstatic.com, and Google receives your IP address and user agent under its Google Fonts privacy terms. Every other page uses fonts served by typeset.us itself.

Pages you ask it to read. Audit, Font DNA and the grader read a page whose address you enter. The typeset.us server fetches that page once and hands the HTML back to your browser; it stores nothing. The address you enter is part of your request to typeset.us, so it appears in the host’s request log. To limit abuse, the server keeps each client’s IP address and request times in memory for one to two minutes after its last request. Audit and Font DNA then show the page with its own stylesheets, fonts and images, which your browser loads from wherever that page keeps them.

Fonts you open. A font file you open in Font Inspector, Specimen or Variable Fonts is read in your browser and never uploaded.

Payments. The sponsor page links to Stripe. Nothing reaches Stripe until you follow a link, and Stripe handles the payment under its privacy policy.

The hosted Typeset script

When a site loads go@<version>.js or another file from typeset.us, the request reaches Vercel like any other and lands in the same logs, and your browser may tell Vercel which site loaded it. typeset.us sets no cookies on these files and does not analyse the requests.

Once loaded, the script makes no network requests of its own: no fetch, XMLHttpRequest, sendBeacon or WebSocket, no cookies, no storage and no telemetry. It changes only the text it composes.

A site that must keep its readers’ requests off typeset.us can install from npm (npm i -E typeset.us@4.4.0) and serve the files from its own domain, or load the same file from jsDelivr, which then handles the requests under jsDelivr’s privacy policy.

The npm package

The typeset.us package makes no network requests, sets no cookies, uses no storage and has no install scripts. Its typeset-audit command opens only the page you give it, in a browser on your machine, and uploads no report.

Contact

Questions or corrections: dyork@typeset.us. Security problems: see the security policy.