Privacy
Last changed 2026-09-05
This page says what Typecase collects, where it goes, who handles it, and who to ask about it. It covers the Chrome extension, the website at typecase.dev and the app at app.typecase.dev. It is a statement of fact written by the person who built them, not legal advice.
The Chrome extension
The extension names the font actually rendering text on a web page. It is part of founding access, so it needs a sign-in before it reads anything.
What it collects
- Your email address, when you sign in. The extension sends it to app.typecase.dev so a six-digit code can be emailed to you; the code is exchanged for a sign-in token. There is no password.
- That token, and the address it belongs to, stored in the extension’s own storage
(
chrome.storage.local) on your machine. It is read by the extension’s service worker and its popup, and is never handed to a script running inside a web page.
What it sends
- To app.typecase.dev, and nowhere else: the request for a sign-in code, and a check that the sign-in still stands, made at most once every six hours. Nothing about the page you are on is in either request.
- The handoff, when you click it. “Open in Typecase” and “Send all to
Typecase” open
app.typecase.dev/?detect=…in a new tab. The address carries font metadata only: for each font, the family, the CSS stack, weight, style, size, line-height, letter-spacing, the webfont’s file URL if there is one, whether it is a system face, and up to 120 characters of the text you selected, plus the page’s URL and title. Never a font file’s bytes. It happens only when you click; nothing is sent on its own.
What it does not do
- It sends nothing about the pages you visit except that click-initiated handoff.
- It carries no analytics, no crash reporting, and no remote code.
- It never downloads a page’s font file — not the page’s, not anyone’s.
- It reads no history, no cookies and no other tab.
Permissions. The extension asks for activeTab, scripting and
storage: enough to read the page in front of you at the moment you invoke it, and to remember
the sign-in. Access to sites is declared only as an optional permission (*://*/*),
granted by you, per site or everywhere, for the “always on” mode in which the badge appears as
soon as you select text. Chrome asks first, and the same popup takes it back. Where always on is granted the
extension watches the selection on that site and nothing else.
The website and the app
The app at app.typecase.dev reads the fonts installed on your machine and keeps your shortlists. The website at typecase.dev sells founding access. Between them they collect the following.
Your fonts and your work
Your indexed fonts, Boards and saved references live in IndexedDB in your own browser. They are not synced and not uploaded. Local font files never leave your machine; indexing happens in the browser. The one nuance: the app’s Online and Free alternatives views download open-licence webfonts from Google’s CDN in order to preview them, and every page is set in typefaces served from Google Fonts, so Google’s servers see those requests. Nothing of yours is in them, and nothing of yours is uploaded, ever.
Payments
Founding access is paid through Stripe. Card details never touch Typecase. What Typecase stores, in a Cloudflare D1 database, is the checkout session id, your email address, the amount, the currency, the timestamp, and the payment intent id, which is what a refund is issued against.
Mail is sent through Resend, from hello@typecase.dev: the thank-you after a purchase, and the six-digit sign-in codes. Codes are stored hashed and expire after ten minutes.
Sign-in
Signing in to the app sets an HttpOnly session cookie, tc_session, that lasts 30 days. The
extension holds a bearer token instead of the cookie, as described above.
Analytics on the website pages
Pages on typecase.dev and app.typecase.dev load a Vaya analytics snippet in their <head>.
It is told the signed-in email address (to identify the visitor) and a signup event when a
purchase completes. The extension carries no analytics.
The notify-me form
If you leave your email to be told when something ships, the address and where on the site you left it (the source) are stored in the same D1 database.
Who handles the data
| Processor | What for | What it sees |
|---|---|---|
| Stripe | Payment for founding access | Your card and the checkout; Typecase keeps the record listed under Payments. |
| Resend | Outbound email | Your address and the message sent to it. |
| Cloudflare | The D1 database | The purchase records, sign-in codes (hashed) and notify-me addresses. |
| Vaya | Analytics on the website and app pages | The signed-in email, and the signup event on purchase. |
| Google (Fonts CDN) | The typefaces every page is set in, on every visit; previewing open-licence webfonts in the Online and Free alternatives views | The request for the font file it serves, and so which family was asked for. |
There is no other third party. No ad tech is loaded anywhere.
What expires on its own, and what does not
- Sign-in codes expire after ten minutes.
- The app’s session cookie lasts 30 days.
- The extension’s token stays in its storage until you sign out from the popup, until it expires, or until a check finds the purchase no longer stands.
- The purchase record does not expire on its own: it is what a sign-in is checked against for as long as the licence stands, because the record is the licence.
- A notify-me address stays until you ask for it to go.
- Your fonts, Boards and saved references are in your own browser, under your control, and clearing that browser’s site data removes them.
Asking about your data
Email hello@typecase.dev. It reaches Mykola, the person building Typecase, directly. Say which address you bought or signed up with and what you want to know or have done with it. The same address is where a refund is asked for: within 14 days of purchase, reply to the purchase email, no form and no questions.
What is not done with it
Nothing is sold. No data is handed to advertising platforms, data brokers or resellers. No ad tech is loaded anywhere.
Changes to this page
When what Typecase collects changes, this page changes with it, and the date at the top moves.
Questions about any line on this page: hello@typecase.dev.