Privacy

Last updated: 7 September 2026

Steelpunch is a font editor that runs in your browser. Drawings, metrics, and saved projects stay in this browser. They live in IndexedDB, with an Origin Private File System backup when the browser supports it. We do not store your font files. When you download a font, the browser sends the outlines to our Cloudflare Worker for that request so we can compile the file for your plan. We delete that copy when the download finishes.

If you request a sign-in link, we send email through Resend. Signed-in accounts keep your email address, plan, Stripe customer and subscription ids, and registered project ids in our Cloudflare D1 database. Sign-in uses an HttpOnly session cookie named steelpunch_session (or __Host-steelpunch_session on HTTPS). The cookie is strictly necessary for the signed-in session. It does not store your fonts. We do not set analytics cookies.

Stripe handles paid billing. Stripe receives the email you signed in with so it can send receipts and manage the subscription. We do not store card numbers. Magic-link tokens are stored as hashes and expire after twenty minutes. Sessions last thirty days unless you sign out. Rate-limit rows are dropped after twenty-four hours. Processed Stripe event ids are kept so a delayed Dashboard resend cannot re-grant a canceled plan. Sign-in rate-limit rows and sign-in log fields store an HMAC hash of the email, not the address itself.

Processors that handle Steelpunch data: Cloudflare (hosting, D1, logs), Stripe (payments and customer billing records), and Resend (sign-in email). Font outlines pass through Cloudflare only for the download request.

On Chromebooks and shared lab computers, project files stay on the device. Do not type student work into the sign-in field.

Sign out from the editor to clear the session cookie on this device. Signed-in users can delete their Steelpunch account from the editor. That cancels the Stripe subscription, deletes the Stripe customer, and removes email, plan, sessions, and registered project ids from our database. We keep a hashed record of that email and Stripe customer id so a later billing event cannot recreate the deleted account. Deleting an account also removes fonts saved in this browser on this computer. Public crawler files such as robots.txt and sitemap.xml do not include your projects.

To report a security issue, email security@steelpunch.net. For other questions, use the email you subscribe with, or open a repository issue if you run the software yourself.