Privacy Policy

Last updated: 26.08.2026

YoFont, operated by Yo Space LLC (“we”, “us”, “our”), respects your privacy. This Privacy Policy explains how we collect, use, and protect your personal and generated data when you use yofont.com (the “Service”).

1. Information we collect

• Account data: email address, password hash, and (if applicable) social-login identifiers.
• Usage data: prompts, generated fonts, font metadata, API requests, IP address, and browser/device data.
• Payment data: securely processed by Stripe. We never store or have access to full card numbers.
• Support data: information voluntarily provided when contacting support (e.g., emails, attachments).

2. How we use information

• To provide and improve the Service, including font generation, storage, and delivery.
• To secure accounts and authenticate users.
• To manage billing and process payments through third-party providers (e.g., Stripe).
• To send transactional communications such as verification emails, receipts, and system notifications.
• To send optional marketing or feature updates (only with your explicit consent).

3. Processing of generated content

When you generate or upload materials (such as prompts, glyphs, or fonts), these are processed by our servers for the purpose of rendering your requested result. Such generated materials may be temporarily stored for technical optimization and auditing. All generated or uploaded materials remain the intellectual property of Yo Space LLC as defined in the License Terms, while you receive a license to use them according to your active subscription plan.

4. Third-party services

We work only with trusted processors that comply with major privacy frameworks:

• Stripe — payment processing (PCI DSS, GDPR, CCPA compliant)
• SendGrid — transactional and service emails
• Cloudflare — CDN and network protection

These providers are certified under the EU–US Data Privacy Framework and receive only the minimal data necessary for their operations.

5. Data retention and account deletion

Account and usage data are retained as long as your account is active. You may request permanent deletion of your account by visiting Delete my data or contacting support. We respond within 45 days (30 days for requests under the GDPR), and we verify that a deletion request comes from the account holder before acting on it.

What we delete. On a verified request we permanently erase your personal information from our active systems: email address, name, username, password, linked social-login identifiers, author profile and bio, IP addresses, sign-in history, support correspondence, and any link between your identity and records in our system. The account is closed and cannot be restored.

What we retain, and why. Some records are outside the scope of a deletion request:

• Generated font files and the technical record of their creation. As set out in section 3 above and in sections 4.1–4.3 of the License Terms, generated fonts are the intellectual property of Yo Space LLC, not of the user, and that ownership is not affected by the deletion of your account. A font file consists of vector outlines and metrics; it contains no information that identifies you, and is therefore not personal information under the CCPA (§1798.140(v)) or personal data under the GDPR (Art. 4(1)). A request to erase personal information does not extend to it.
  When your account is deleted we remove the authorship metadata and every link to your former profile, so the font is no longer associated with you or presented as yours. The de-identified file and its checksums are retained, and Yo Space LLC decides how the font is dealt with thereafter — including keeping it in or returning it to our public catalogue, licensing or selling it, or withdrawing it entirely. The retained record also evidences that the file was produced by our system and on what date. Bases: CCPA §1798.105(d)(2) and (d)(9); GDPR Art. 17(3)(e) — establishment, exercise or defence of legal claims. Nothing retained is used for profiling, marketing, or any decision concerning you, and we do not use your name, likeness or other personal information to promote the font or the Service.
• Billing and transaction records — retained as required by tax and accounting law. Basis: CCPA §1798.105(d)(8); GDPR Art. 17(3)(b).
• Security and abuse-prevention logs — retained for the period necessary to detect and prevent fraudulent or unlawful activity. Basis: CCPA §1798.105(d)(2).

Where we decline part of a deletion request, we tell you which categories we retained and on what legal basis. Data held under an exception is not used for any other purpose. Deletion may not extend immediately to archived or backup systems, from which data is removed on the normal backup rotation and is never restored to active use.

Your licence after deletion. Closing your account ends your subscription and, with it, the licence to use any fonts you generated — see section 7 of the License Terms. If you wish to continue using a font after closing your account, contact support and we will issue a perpetual licence under a separate agreement.

6. User rights

• Request a copy of your personal data (“data access”).
• Request correction or deletion of inaccurate data.
• Withdraw consent for optional marketing communications.
• Request erasure of your personal information, subject to the retention exceptions described in section 5.
• Object to processing, or restrict it, where the GDPR gives you that right.
• Lodge a complaint with your data protection authority (EU/UK), the California Privacy Protection Agency, or the California Attorney General.

Generated font files are the intellectual property of Yo Space LLC and are not personal information; a request to erase personal information does not extend to them. On deletion we remove the authorship metadata and any link to your profile, so the font is no longer associated with you. How the de-identified font is dealt with afterwards is a matter of ownership, described in section 5 and in sections 4.1–4.3 of the License Terms.

We do not discriminate against you for exercising any of these rights. To exercise them, contact us via the Support page.

7. Data protection

We use encryption (HTTPS/TLS), hashed passwords, and secure access policies. Data is hosted on compliant infrastructure in the United States. Access to personal data is limited to authorized personnel only and is logged for security auditing.

8. Legal basis for processing (GDPR)

We process data based on one or more of the following lawful grounds:

• Performance of a contract (to deliver the Service you subscribed to).
• Compliance with legal obligations (e.g., billing or fraud prevention).
• Legitimate interest (security, fraud prevention, improvement of our services).
• Consent (for optional communications or analytics, where applicable).

9. International transfers

Your information may be transferred and processed in the United States. By using the Service, you acknowledge and consent to such processing under U.S. privacy laws and international frameworks.

10. YoFont plugin for Figma

The YoFont plugin runs inside Figma and talks only to yofont.com. This section explains what it sends, stores and shares. It applies in addition to the sections above.

• What leaves Figma, and when: only on an explicit action by you. When you press “Create a font”, the plugin sends your text prompt and — if you attached one — a reference image. That image is either a file you picked yourself or a PNG export of the layers you selected. Nothing is exported or uploaded while you merely browse, select layers or move around your file.
• What the plugin does not do: it never reads, scans or modifies your Figma document beyond the layers you have selected, and it never sends document contents, layer names, file names or team information to our servers.
• Account access: sign-in happens on yofont.com in your browser (email or Google) and you approve the pairing there. Your password is never typed inside Figma. The plugin receives a scoped API key; we store only a SHA-256 hash of it on our side.
• Local storage: the API key and your interface preferences are stored on your own machine in Figma’s clientStorage. Choosing “Disconnect” in the plugin deletes the local copy and revokes the key on our servers immediately.
• Technical logs: for rate limiting, abuse prevention and support we record the endpoint called, the plugin version, the timestamp, the account ID and the IP address of the request. These logs are not used for advertising or profiling.
• Interface assets: the plugin’s interface files (scripts, styles, web fonts and translations) are loaded from yofont.com when you open the plugin, so that fixes reach you without an update. No code from any other source is loaded or executed.
• AI processing: generating or redrawing glyphs involves third-party AI image-generation providers, which process the prompt and any reference image you supplied for the sole purpose of producing your result. They do not receive your account credentials.
• Fonts you apply: when you apply a font, the plugin downloads the font file from yofont.com to your computer and asks Figma to use it. The file is downloaded for you to install under your licence; we do not track which text layers you apply it to.
• Retention and deletion: data created through the plugin (prompts, reference images, generated fonts) is retained and deleted under section 5 of this policy, including the exceptions described there. Your plugin API key is revoked and your personal information erased when your account is deleted. You can disconnect the plugin at any time, and request deletion at Delete my data.
• No ads and no third-party trackers run inside the plugin.

Questions about the plugin specifically: Support page. Setup and usage documentation: yofont.com/figma-plugin.

11. Changes

We may update this Privacy Policy periodically to reflect technical, legal, or operational changes. The updated version will always be published at yofont.com/privacy with a new effective date.

Questions? Visit our Support page.