Privacy Policy

1The short version

2Who is responsible for your data

The operator of the Site is:

Under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) we are the Data Fiduciary (the organisation that decides how personal data is used) and you are the Data Principal (the person the data is about). Under the EU/UK General Data Protection Regulation (“GDPR”) the same roles are called controller and data subject.

3What the app does on your own device

When you use the Site, the following happens only in your browser’s memory:

1. You type text, paste text, or open a .docx, .md, or .txt file from your computer. Files are read by the browser itself and unzipped in the browser (a .docx is a zip file). Nothing is transmitted. The file picker will also let you pick a PDF, but the app cannot read PDF text and simply tells you so — the PDF is not sent anywhere either.
2. The app draws your text as handwriting onto a canvas, letter by letter.
3. You save the result as a PNG image or a PDF. The file is assembled in your browser and handed to your browser’s own download mechanism. It is not generated on, routed through, or copied to any server.

Because of this, we hold no copy of your documents, your exported files, your handwriting settings, or the paper you chose. Closing the tab discards them.

Paper templates

Paper templates are bundled with the app. The paper photographs shipped with the Site are our own, taken by us, and more will be added over time. You cannot upload your own paper photographs, so there is no image-upload path and no images of yours for us to store. The template files (templates/*.jpg and templates/*.json) are downloaded from our own Site like any other page asset.

4Cookies and what is stored in your browser

The Site sets no cookies unless you choose to allow them. The only thing that would set one is the optional analytics described below, and it does not run until you press Allow. If you press No thanks, or simply ignore the banner, no cookie is ever set. Your choice is remembered so you are not asked again.

The one thing the Site does write to your device is a single entry in your browser’s local storage (a per-site storage area that, unlike a cookie, is never sent to a server): the width you dragged the settings panel to, stored under the key longhand.rail.

That is the whole list. It is not personal data about you, it never leaves your device, and you can clear it any time by clearing site data in your browser.

If and when paid licences launch, a licence key you enter may also be stored locally in the same way, so you do not have to paste it again.

5Information that does reach a server

Hosting and server logs (Cloudflare)

The Site is hosted on Cloudflare Pages, a static file host. To deliver any web page at all, Cloudflare receives and processes your IP address, the page you asked for, your browser’s user-agent string, and similar connection data. This is unavoidable for any website and is used to serve the files, to keep the Site available, and to protect it from attacks.

• Purpose / legal basis: performing the service you asked for, and our legitimate interest in security (GDPR Art. 6(1)(b) and 6(1)(f)); under the DPDP Act, a legitimate use connected with providing the Site you approached us for.
• Cloudflare acts as our processor (a company that handles data on our instructions) and may process it outside India and outside the EU.
• Cloudflare’s own privacy policy: cloudflare.com/privacypolicy

If we later add a small Cloudflare Worker to receive payment notifications from our payment processor, that Worker will handle the processor’s webhook messages about a purchase. It will still not receive your documents.

Analytics — two services, only one of which can set a cookie

Cloudflare Web Analytics runs for everyone, and uses no cookies. It is added by Cloudflare at the edge rather than loaded by the page itself. It sets nothing on your device, uses no browser fingerprinting, builds no profile of you and does not follow you across other sites. It reports aggregate numbers only: page views, referring site, country, browser type. It cannot tell us which paper you picked or how long your document was.

• Purpose / legal basis: our legitimate interest in knowing whether the Site works and is used (GDPR Art. 6(1)(f)); a legitimate use under the DPDP Act. It stores nothing on your device, so it does not require consent.
• Cloudflare’s documentation: developers.cloudflare.com/web-analytics

Google Analytics runs only if you allow it, and it does use cookies. This is the one that the banner asks about, and it is the only reason the banner exists.

• It does not load at all before you press Allow. Not the script, not a cookie, not a request to Google. If you decline, nothing about Google Analytics runs for the rest of your visit.
• Purpose / legal basis: your consent (GDPR Art. 7; consent under the DPDP Act). You can change your mind: clear this site’s data in your browser and the banner will ask again.
• If your browser sends a Global Privacy Control or Do Not Track signal, we do not load it and do not even show you the banner.
• What it is told when it is allowed: which paper template you chose, how many pages your document made, a coarse size bucket, and whether you saved a PNG or a PDF. It is never sent the text you typed.
• IP anonymisation is on and Google advertising signals are switched off.
• Google’s policy: policies.google.com/privacy
• [[PLACEHOLDER: Google Analytics data retention period set in GA4 Admin]]

We run no advertising on the Site.

Fonts — served from this domain, not from Google

The Site’s typefaces are hosted on this domain and served from it. Loading a page makes no request to Google, or to any other company’s servers, for anything.

This changed on 2026-10-06. Before that the fonts were linked from Google’s servers, which meant Google received your IP address on every page load. A German court has held that embedding Google Fonts that way without consent can breach the GDPR, and self-hosting removes the issue rather than disclosing it.

The typefaces remain the work of their designers and are used under their open licences (SIL Open Font License or Apache 2.0).

Payments (planned — not live yet)

We do not currently take payments. When we do, the plan is a one-time licence key sold through a third-party payment processor: [[PLACEHOLDER: payment processor name — undecided; either Razorpay/Cashfree (India) or Paddle/Lemon Squeezy (merchant of record)]].

When that launches:

• Payment will happen on the processor’s page or widget, not ours. We will never see or handle your card number, UPI PIN, or bank credentials.
• The processor will collect what it needs to charge you and to meet tax law — typically name, email address, country, and payment details — and will be a controller/Data Fiduciary in its own right for that data. Its own privacy policy applies: [[PLACEHOLDER: link to the chosen processor's privacy policy]].
• We expect to receive from the processor only your email address, country, and an order/transaction reference, so we can send you your licence key and keep the tax and accounting records the law requires.
• Purpose / legal basis: performing the contract of sale (GDPR Art. 6(1)(b)) and complying with legal obligations such as tax record-keeping (GDPR Art. 6(1)(c); DPDP Act legitimate use for compliance with law).
• Retention: purchase and tax records are kept for [[PLACEHOLDER: statutory record-retention period under Indian tax law, per your accountant]].

6What we never collect

To be explicit, we do not collect: the text of your documents, your exported PNG or PDF files, files you open from your computer, your name (unless you email us or buy a licence), your phone number, your precise location, biometric data, or anything about children specifically.

7Children

The Site is intended for students and adults doing their own written work. It is not aimed at children under 18. Under the DPDP Act, processing a child’s personal data requires verifiable parental consent, and we do not knowingly collect personal data from children. Because there are no accounts, we have no practical way to verify age. If you believe a child’s personal data has reached us, write to [[PLACEHOLDER: privacy contact email address]] and we will delete it.

8Sharing your information

We do not sell your personal data and we do not share it for advertising. Data is shared only with the service providers named above — Cloudflare for hosting and page-view counts, Google only because the fonts are loaded from its servers, and later a payment processor — and only as described. We may disclose information if we are legally required to — for example a valid court order or a lawful government request.

9Transfers outside your country

Cloudflare and Google operate globally, so the limited data described above may be processed outside India, and outside the EU/UK. For EU/UK visitors, these transfers rely on the providers’ Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. Under the DPDP Act, transfers outside India are permitted except to countries the Indian government restricts.

[[PLACEHOLDER: confirm with counsel whether a GDPR Article 27 EU representative is required — it may be, since the Site is offered to EU visitors from India]]

10How long we keep things

• Documents you write: never held by us, so nothing to keep or delete.
• Cloudflare hosting and security logs: as long as Cloudflare retains them under its own policy (typically a short period).
• Cloudflare Web Analytics: aggregate counts only, retained by Cloudflare for [[PLACEHOLDER: Cloudflare Web Analytics retention period as shown in your dashboard]].
• The longhand.rail preference: stays on your device until you clear site data.
• Emails you send us: [[PLACEHOLDER: how long support emails are kept]].
• Purchase records, once payments launch: as required by tax law.

11Your rights

If you are in India (DPDP Act, 2023)

You may ask us to:

• confirm what personal data of yours we hold and what we have done with it (right to information);
• correct or complete inaccurate data (right to correction);
• erase your data where we no longer need it (right to erasure);
• withdraw any consent you have given us (at present we ask for none and rely on none, so there is nothing to withdraw);
• nominate another person to exercise these rights if you die or become incapable (right of nomination);
• raise a grievance with us and, if we do not resolve it, with the Data Protection Board of India.

Our grievance contact is [[PLACEHOLDER: grievance officer name or role]], reachable at [[PLACEHOLDER: grievance contact email address]]. We aim to respond within [[PLACEHOLDER: grievance response time in days]].

If you are in the EU/UK (GDPR)

You have the rights of access, rectification, erasure, restriction, objection, portability, and withdrawal of consent, and you may complain to your national data protection authority.

12Security

The Site is served over HTTPS. Because your documents stay in your browser, the usual risk of a server breach exposing your work does not exist here — there is no server-side copy to breach. The files you save are stored wherever you chose to save them on your own device, and are your responsibility from that point.

13Changes to this policy

If we change this policy we will update the date at the top. For a change that materially affects you — for instance adding a new third-party service — we will say so on the Site.

14Contact

[[PLACEHOLDER: privacy contact email address]] — see Contact and Grievance Redressal for the full contact details and grievance route.