Privacy.
Updated 24 September 2026
The short version
meshfont runs in your browser. Your letters stay on your device unless you sign in and save them. We count visits without cookies, we sell nothing about you, and you can delete everything yourself in one step.
Without an account
You can draw without signing in. Your work is kept in this browser and nothing you draw becomes public on its own. A browser is not a backup: keep copies of work that matters, or sign in so it saves to your account.
If you sign in
Sign in with a link sent to your email, or with Google where offered. Supabase, our sign-in and database service, keeps your email address, your profile and the fonts you save. Google, if you use it, gives us your name, email and profile picture, which appear on your profile.
What we count
A handful of anonymous events: a page view, how long a tab stays open, a first save, an export, a share link being made. Each carries a random identifier from this browser and whether you were signed in. No cookies, no letter shapes, no email addresses. Cloudflare Web Analytics counts visits the same cookie-free way.
Who else is involved
Supabase for sign-in and storage, Cloudflare for hosting and analytics, Google if you sign in with it, and Google Fonts and jsDelivr for the fonts the site loads. Each sees the connection details any web request carries, such as your IP address; some work outside the UK under the standard contractual protections. Nobody else gets access, nothing is sold, nothing feeds advertising.
Share links and public things
A share link is unlisted, not private: anyone who has it can open the font and type in it. You can switch sharing off or make a new link at any time, and the old one stops working. Anything you choose to make public, such as a post on the feedback board once it opens, stays public until it is removed.
Keeping it, and deleting it
Account data stays as long as the account does. Delete your account from Settings and everything goes at once, including this site's data in the browser you did it from; it cannot be undone. Anonymous counts are held by Cloudflare under its own retention and are never linked to a person. Exports and share links you handed out are not recalled.
Your rights, and children
You can ask for a copy of your data, have it corrected or deleted, or object to how it is used: write to hello@meshstudio.app and you will hear back within a month. The Information Commissioner's Office at ico.org.uk is the UK authority if that does not settle it. meshfont is not for children under 13, and we do not knowingly keep an account for one.
Who is responsible
meshfont is run by Paul Mayer, individually, in London, United Kingdom, the data controller for everything here. Your email and sign-in details are what an account needs to exist; the anonymous counts rest on a legitimate interest in knowing whether the product works. Changes to this notice are dated at the top, and anything that matters to existing accounts is explained before it applies.