Privacy Policy
Effective date: October 3, 2026
This policy explains what information Dupefont collects when you use dupefont.com, its API and the Dupefont app for ChatGPT (together, the "Service"), how we use it, and the choices you have.
Who we are
Dupefont ("we", "us") runs the Service and is the controller of the personal data described here. You can reach us at privacy@dupefont.com.
Summary
- You don't need an account. We don't ask for your name, email address or payment details.
- We don't save the images or font files you upload. We keep the match results, filed under a one-way fingerprint (hash) of the file, so repeat requests are fast.
- We keep some technical data, such as IP addresses and request counts, to run the Service and stop abuse.
- With your consent where the law requires it, we use Microsoft Clarity to see how people use the website.
- We don't sell personal information and we don't use advertising cookies.
What we collect
Images and font files you upload
When you upload an image on the website, send one through the API, or share one with the Dupefont app in ChatGPT, we read the text in it and compare the letter shapes with our font library. Font files are compared the same way. We don't save uploaded files: they are processed in memory and discarded when the request finishes. Transient operating-system copies, such as swap, may exist briefly; we don't access or keep them. We store the result (the fonts we matched and, for images, the text we read) under a SHA-256 hash of the file. Image results are deleted after 30 days.
Text you type
Text you enter to help us read an image, and font names you search for, are used to produce results. We don't store the text you type for images. Font names searched through the ChatGPT app are kept in our usage records (below).
Ratings and reports
If you rate or report a match, we store the fonts involved, your rating and your IP address, which we use to stop duplicate votes. We remove the IP address after 12 months.
Logs and rate limits
Our servers record standard request data: IP address, time, page requested, referrer and browser user agent. These logs are kept for about 14 days. We also count requests per IP address per day to prevent abuse, and keep those counts for up to 90 days.
The Dupefont app in ChatGPT
When you use the app, OpenAI sends us a temporary link to the image you share, plus a pseudonymous identifier for your ChatGPT account, and may send your locale and coarse location (such as country). We download the image to process your request and don't keep it. We store a one-way hash of the identifier (not the identifier itself) with the tool used, the time, whether the call succeeded, how long it took, the top font returned, your locale and country, and, for name searches, the font name. We keep these records for up to 180 days to measure usage, fix errors and prevent abuse. We don't receive your name, email address or ChatGPT conversation, and we don't use app data for advertising.
Analytics (Microsoft Clarity)
The website uses Microsoft Clarity, which uses cookies and similar technology to record how visitors interact with pages (clicks, scrolling, mouse movement, pages viewed) along with device and browser details. In the EEA, the UK and Switzerland we load Clarity only after you accept it in the cookie banner. Elsewhere it loads by default unless you decline or your browser sends a Global Privacy Control signal. You can change your choice at any time with "Cookie settings" at the bottom of every page. Clarity never runs on the pages where you upload files or see results for your uploads. Microsoft may use Clarity data as described in the Microsoft Privacy Statement (https://privacy.microsoft.com/privacystatement).
Cookies
Besides Clarity, we use a short-lived session cookie to show you messages, such as an upload error, and we keep your analytics choice in your browser's local storage. We don't use advertising cookies.
How we use information and why (legal bases)
| Purpose | Legal basis (EEA/UK) |
|---|---|
| Matching fonts and caching results | Legitimate interests: providing the tool you asked to use |
| Security, rate limiting and server logs | Legitimate interests: keeping the Service available and preventing abuse |
| Ratings and reports | Legitimate interests: improving match quality |
| ChatGPT app usage records | Legitimate interests: operating and debugging the app |
| Microsoft Clarity analytics | Consent (where required) |
We don't use your uploads to train machine-learning models. We don't make decisions based solely on automated processing that have legal or similarly significant effects on you.
Sharing
We don't sell personal information or use advertising cookies. We share information only:
- with service providers that host and run the Service (cloud hosting and network providers) and with Microsoft for Clarity analytics, as described above;
- with OpenAI, as part of running the ChatGPT app (OpenAI's own privacy policy covers your ChatGPT data);
- when the law requires it, or to protect the rights, safety and security of Dupefont, our users or others;
- as part of a merger, acquisition, financing or sale of assets. In that case we will require the recipient to honor this policy for information collected under it, or give you notice before any material change.
How long we keep it
| Data | Kept for |
|---|---|
| Uploaded images and font files | Not saved; discarded after processing |
| Image match results (by hash) | 30 days |
| Font-file match results (by hash) | Until our font index changes |
| Server logs | About 14 days |
| Daily request counts by IP | Up to 90 days |
| ChatGPT app usage records | Up to 180 days |
| Ratings and reports | Kept; IP address removed after 12 months |
We may keep information longer when the law requires it or to investigate abuse.
Security
We protect data with encrypted connections (HTTPS), restricted server access and short retention periods. No system is completely secure, and we can't promise that ours is.
Your rights
Depending on where you live, you may have the right to access, correct, delete or get a copy of your personal information, to object to or restrict how we use it, and to withdraw consent. Because we don't ask who you are, we usually can't link data to you. If you send a request, we may ask for details such as your IP address and the time of your visit to find the records. Email privacy@dupefont.com. If you're in the EEA or UK, you can also complain to your local data protection authority.
California
In the last 12 months we collected these categories: identifiers (IP address and pseudonymous IDs), internet activity (pages viewed and interactions), coarse location, and content you submit. They come from you, your browser and OpenAI. We use them for the purposes and keep them for the periods above. We don't collect sensitive personal information, we don't sell personal information, and we won't treat you differently for exercising your rights.
Children
The Service isn't directed to children under 13, or under the age of digital consent where you live (up to 16 in some EEA countries), and we don't knowingly collect their personal information. If you think a child has given us personal information, contact us and we'll delete it.
International transfers
We run the Service from the United States. If you use it from elsewhere, your information is transferred to and processed in the United States. Microsoft participates in the EU-U.S. Data Privacy Framework.
Changes
If we update this policy, we'll post the new version here with a new effective date. For material changes we'll also put a notice on the site. Material changes apply only going forward, and where the law requires it we'll ask for your consent.