🛡️ PRIVATE BY DESIGN
Your fonts stay local by default
Sora Type parses, previews, inspects, and compares fonts on your device. Font files are read with fontkit and shaped with harfbuzzjs, both running client-side in WebAssembly. Simply selecting or comparing a font does not upload it.This matters if you work with commercial or NDA-protected typefaces: normal inspection and comparison do not send those files to our infrastructure.Optional share links
When you select "Create share link" in Compare, you explicitly ask Sora Type to upload and store both font files so anyone with the link can open the comparison. Knowledge of the link grants access to download and view those files; share links are not publicly listed.Shared sessions are stored in Cloudflare D1 and R2 and are automatically deleted after 10 days without access. If you do not create a share link, Compare remains entirely local.Browser extension
The Sora Type browser extension identifies fonts on web pages you visit. It runs entirely in your browser and does not send inspection data to our servers.When you turn on the font picker and inspect text, the extension may collect page URL and title (web history), font and style information from the page (website content), and mouse clicks and movement needed to operate the picker (user activity). The side panel can also list fonts on the active tab and, when you ask it to, download a font file referenced by that page so metadata can be parsed locally.This data is stored only in extension local storage on your device. We do not sell it, share it with third parties for their own purposes, or use it for advertising, credit decisions, or anything unrelated to font inspection.If you choose "Open in Sora Type", the extension opens our web app in a new tab and may pass a font file URL as a query parameter — only when you click that link.PDF export
Generating a PDF report requires a Node.js PDF engine, which can't run in the browser. When you use "Export PDF report", your font file is sent once to our server to render the report, then discarded immediately after the response is returned — it is never logged, stored, or reused.