Privacy Policy

The short version

• We set no cookies.
• We run no analytics, no tracking, no advertising and no profiling.
• Our host, Cloudflare, unavoidably processes your IP address and request details to deliver the page and keep it secure.
• If you email us, we process what you send until the matter is dealt with.
• You can ask us for access, correction, erasure, restriction, portability, and you can object to the processing above, at any time.

The rest of this page is the full account.

Who we are and how to reach us

Schrift Studio is a product of Heapforge Ltd., a company incorporated in England and Wales under company number 17418393. Heapforge Ltd. is the data controller for this website and decides why and how the personal data described here is processed.

For anything relating to privacy or data protection — including any of the rights set out below — write to privacy@schrift.app.

We are not required to appoint a Data Protection Officer and have not appointed one. Privacy inquiries go to the address above and are handled by the company’s directors.

What this policy covers

This policy applies to the website at schrift.app and nothing else.

What the website itself collects

This site itself does not collect any data. This site does not:

• set any cookies, of any kind, including so-called “essential” ones;
• use localStorage, sessionStorage, IndexedDB, or any other browser storage;
• run analytics, tracking pixels, session recording, fingerprinting, or advertising;
• contain any forms that could be submitted
• offer accounts, logins, or profiles;
• embed content from a third party

We do not sell personal data, share it for advertising, or transfer it to data brokers. We carry out no automated decision-making and no profiling within the meaning of Article 22 of the GDPR/UK GDPR.

Delivering the site: connection data

This site is hosted on Cloudflare Pages, provided by Cloudflare, Inc.

What is processed: your IP address, the date and time of the request, the page or file requested, the HTTP response status, your browser’s user-agent string, and — where your browser sends one — the referring page.

Why: to transmit the page you asked for, and to detect and block denial of service attacks, abuse and other malicious traffic.

Legal basis: legitimate interests, Article 6(1)(f) UK and EU GDPR. Our legitimate interest is in making the site available and keeping it secure; this processing is necessary to do that. You may object to it — see Your rights below.

Who else is involved: Cloudflare acts as our processor and is bound by a data processing agreement. Heapforge Ltd. does not access, export, analyse or retain these logs, and we have enabled no Cloudflare analytics product on this site. No other recipient receives this data. It is not used to build any profile of you and is never combined with anything else, because we hold nothing else.

How long: we retain none of it ourselves. Retention within Cloudflare’s systems is governed by Cloudflare’s own practices, described in the Cloudflare Privacy Policy.

If you email us

Writing to privacy@schrift.app or contact@schrift.app is entirely your choice; nothing on this site requires it. If you do:

What is processed: your email address, your name if you give it, the content of your message and any attachment, and the technical headers your mail sends.

Why: to read your message, answer it, and keep a record of what was asked and what we replied.

Legal basis: legitimate interests, Article 6(1)(f) — responding to people who contact us. Where your message concerns a data protection right, the basis is instead legal obligation, Article 6(1)(c), because we are required to handle and record such requests.

Who else is involved: our email hosting provider, acting as our processor. We do not pass your correspondence to anyone else unless you ask us to or the law requires it.

How long: we keep correspondence for as long as the matter is live and for 24 months afterwards, then delete it. Records of data protection requests are kept for the same period as evidence that we handled them properly.

International transfers

Cloudflare operates a global network, and our email provider may likewise process data outside the United Kingdom (UK) and the European Economic Area (EEA). Where personal data is transferred outside the UK or the EEA, it is protected by an adequacy decision (including the EU-U.S. Data Privacy Framework and its UK Extension, where applicable) or by the European Commission’s standard contractual clauses, together with the UK International Data Transfer Addendum issued by the Information Commissioner’s Office.

You can obtain a copy of the safeguards that apply by writing to privacy@schrift.app.

Security

The site is served over HTTPS only and requires it in advance through HTTP Strict Transport Security. Correspondence is held in accounts protected by strong, unique credentials and multi-factor authentication.

Your rights

Under the UK GDPR and the EU GDPR you have the right to:

• Access — obtain confirmation of whether we process your personal data and, if so, a copy of it and the information in this policy.
• Rectification — have inaccurate data corrected or incomplete data completed.
• Erasure — have your data deleted where one of the grounds in Article 17 applies.
• Restriction — require us to stop using data while a dispute about it is resolved.
• Portability — receive data you provided to us in a structured, commonly used, machine-readable form, where processing rests on consent or a contract and is automated.
• Object — object at any time, on grounds relating to your particular situation, to processing based on legitimate interests, which is all of the processing described above. We must then stop unless we can show compelling legitimate grounds that override your interests.
• Withdraw consent — where any processing ever rests on consent, withdraw it at any time without affecting what was done beforehand. We currently rely on consent for nothing.
• Not be subject to automated decision-making producing legal or similarly significant effects. We carry out none.

To exercise any of these, email us at privacy@schrift.app. We will respond within one month, and will tell you if we need to extend that by up to two further months if the request is complex. There is no fee unless a request is manifestly unfounded or excessive. We may ask for enough information to be satisfied of your identity, and for nothing beyond that.

Complaints

If you are unhappy with how we have handled your data, inform us by contacting us at privacy@schrift.app. We will attempt to resolve your complaint as soon as possible and in a reasonable time frame.

You also have the right to complain to a supervisory authority. In the United Kingdom that is the Information Commissioner’s Office, at ico.org.uk. If you are in the European Economic Area, you may complain to the data protection authority of the country where you live or work, or where you believe the problem occurred; the European Data Protection Board publishes the list of national authorities.

Children

This site is not directed at children, and it collects no information from anyone, including children.

Changes to this policy

If this site changes in a way that affects your privacy we will update this page and change the date below before that change goes live. Where a change is material, we will describe it here rather than quietly amend the text.

Last updated: 15 September 2026. Questions to privacy@schrift.app.