Privacy policy
Typesay collects as little as it can. This page explains what we do collect, why, and who else is involved. Last updated 1 October 2026.
What we collect
Visitors. Standard server logs: your IP address, browser, the pages you open and the time. Search phrases you type are logged without any link to you so we can improve the search. Images you upload for image search are processed in memory and never stored.
Authors. If you create an account we store your name, email, password (hashed, never in plain text), website, bio, country, payout details you choose to give us, and the fonts and files you upload.
Buyers. When licence purchases open, payment details are handled by our payment providers, Stripe and PayFast. We store your email, what you bought and the licence issued, so you can download it again and we can prove the licence exists.
Cookies and local storage
Typesay sets one cookie of its own, used to keep authors signed in. Your preview text and size are kept in your browser's local storage so they survive between pages. Neither is used to track you across other sites.
Advertising
Free font pages carry advertising served by Google AdSense. Google and its partners use cookies to serve ads based on your prior visits to this and other websites. You can opt out of personalised advertising at Google Ads Settings or at aboutads.info. Google's use of advertising cookies is described in the Google advertising policies. Paid font pages, account pages and checkout do not carry ads.
Analytics
We use privacy-respecting, aggregate analytics to see which pages and searches are popular. No profile is built about you.
Who we share data with
Paddle.com, our reseller and Merchant of Record, which processes payments, tax and billing questions under its own privacy notice. Payout providers, to pay designers. Our hosting and email providers, to run the site and send you receipts and account emails. Nobody else, unless the law requires it.
Your rights
You can ask for a copy of your data, correct it, restrict or object to how we use it, take it with you, or ask us to delete your account and everything attached to it by emailing hello@heytypesay.com. We answer within 30 days and never charge for it.
If you are in the European Economic Area, the United Kingdom or Switzerland
Typesay processes your data under the GDPR and the UK GDPR. Our legal bases are: performance of a contract (accounts, purchases, licences), legitimate interests (running and securing the site, aggregate analytics, preventing fraud), consent (advertising cookies, which you can withdraw at any time from the cookie banner), and legal obligation (tax and accounting records). Your data is processed in South Africa and by our providers in the United States under standard contractual clauses. You have the right to lodge a complaint with your local supervisory authority; in the UK that is the Information Commissioner's Office.
If you are in South Africa
Typesay complies with the Protection of Personal Information Act (POPIA). Our information officer can be reached at hello@heytypesay.com. You may complain to the Information Regulator at inforegulator.org.za.
If you are in California
Under the CCPA you can ask what personal information we hold, ask us to delete it, and opt out of the sale or sharing of personal information. We do not sell personal information. Advertising cookies may count as sharing; choosing Essential only in the cookie banner opts you out. We do not discriminate against you for exercising these rights.
How long we keep data
Account data for as long as the account exists, plus 30 days. Order and licence records for seven years, as tax law requires. Server logs for 30 days. Aggregate statistics indefinitely, since they identify nobody.
Our providers
Hosting, database and font files (Hetzner, Germany), payments and tax (Paddle.com as Merchant of Record), email sending (Resend), DNS and incoming email (Cloudflare), analytics (Google Analytics), advertising (Google AdSense). Each acts on our instructions under a data processing agreement.
Children
Typesay is not aimed at children under 13 and we do not knowingly collect their data.
Changes
If this policy changes in a way that matters, we will say so on this page and, for account holders, by email.
Questions: contact us.