legal

Privacy Policy

Effective Date:
Last Updated:

Welcome to Xoshnus ("we", "our", "us", or "the Platform"), accessible via https://xoshnus.com. We are committed to protecting your privacy and ensuring transparency about how your information is collected, used, and safeguarded when you visit our website and use our typography and color tools.

Please read this Privacy Policy carefully. By accessing or using Xoshnus, you agree to the collection and use of information in accordance with this policy.

1. Overview and Core Philosophy

Xoshnus is a specialized platform dedicated to Kurdish, Arabic, and multilingual typography, Unicode font discovery, color palette exploration, and text conversion utilities.

Our privacy philosophy is Privacy by Design:

  • We collect only the minimum amount of data required to operate, secure, and improve our services.
  • Whenever possible, resource-heavy and sensitive operations (such as font detection from images, color extraction from images, local font previewing, and text conversion) execute entirely within your web browser (client-side) and are never uploaded to or stored on our servers.
  • We do not sell, rent, or trade your personal information to third parties or data brokers.

2. Information We Collect

A. Information You Provide Directly

We collect information that you voluntarily submit to us when interacting with our features:

  • Contact & Support Inquiries: When you submit a message through our Contact Us form (/contact-us), we collect:
  • Full Name
  • Email Address
  • Phone Number (optional)
  • Purpose of Contact (e.g., General Inquiries, Suggestions, Font Additions, Color Suggestions, Bug Reports)
  • Message Content and any attached details
  • Telegram Bot & Subscriber Interactions: If you subscribe to our Telegram notification bot or interact with our Telegram updates, we receive your Telegram Chat ID, username, and notification preferences so we can deliver font releases, announcements, or requested alerts.

B. Automatically Collected Technical Information

When you browse the website, our servers automatically record standard technical log data:

  • Network & Device Data: IP address, browser type and version, device operating system, referring URL, and language preference.
  • Usage & Aggregate Metrics: Aggregated page views, font view counts, font download counts (TTF, WOFF2, CSS Kits), and color palette view counts. These metrics help us understand which fonts and tools are most useful to the community.
  • Security & Rate-Limiting Logs: In order to protect our platform against denial-of-service (DDoS) attacks, brute-force requests, and automated scraping abuse, our reverse proxy and SSR middleware track IP request rates temporarily.

C. Client-Side Only Data (Zero Server Retention)

The following interactive tools run locally inside your browser:

  • PC Local Fonts Explorer (/fonts/pc): When you use the local font inspector, your browser prompts you for permission via the Local Font Access API. Local font metadata and glyphs are rendered strictly in your browser session and are never uploaded to our servers.
  • Text & Script Converter (/convert): Conversions between Non-Unicode, Unicode, and Latin scripts happen locally in real-time in your browser. Your input text is never saved on our servers.

3. How We Use Your Information

We use the collected information for the following legitimate purposes:

  1. Provide and Deliver Services: To serve font files, font preview stylesheets, color palettes, and conversion utilities.
  2. Respond to Communications: To read, investigate, and reply to inquiries, bug reports, or font/color suggestions sent via our contact forms.
  3. Ensure Platform Security: To detect, prevent, and mitigate security threats, malicious behavior, spam, and unauthorized bot scraping through rate limiting and firewall rules.
  4. Analytics and Optimization: To measure platform performance, identify popular fonts and palettes, resolve technical errors, and optimize website responsiveness across devices and languages.
  5. Send Notification Broadcasts: To send updates or new font announcements via Telegram to users who have explicitly opted in.

4. Cookies, Local Storage, and Client Preferences

Xoshnus does not use intrusive third-party cross-site advertising cookies. We use modern web browser storage (localStorage and sessionStorage) to preserve your interface preferences:

  • Theme & Appearance: Storing your preference for Light, Dark, or System mode.
  • Font & Color Settings: Storing your chosen font preview text, view mode (grid vs. list), color picker selections, and converter options.
  • Session Deduplication: Using temporary session storage to avoid double-counting page and download views during single browser sessions.

You can manage or clear your browser's local storage and cookies at any time through your browser settings.

5. Third-Party Services and External Links

We may integrate with trusted third-party services to enhance site functionality:

  • Hosting & Infrastructure: Our backend servers and static assets are hosted on secure European cloud servers (Hetzner VPS) with strict access controls and encrypted traffic.
  • YouTube Video Embeds: Our Help Center (/help) embeds tutorial and help videos hosted on YouTube. When you watch these embedded videos, YouTube (Google LLC) may collect usage information according to Google's Privacy Policy.
  • Telegram API: Used solely to power our broadcast and subscriber messaging services for users who opt in to Telegram notifications.
  • External Links: Our website may contain links to external designer portfolios, personal websites, or social media profiles. We are not responsible for the content, privacy policies, or practices of third-party websites.

6. Data Security and Protection

We implement rigorous technical and organizational security measures to protect your data:

  • HTTPS / SSL Encryption: All data transmitted between your browser and our servers is encrypted in transit using industry-standard TLS.
  • Security Headers & Hardening: We enforce strict HTTP security headers, including anti-clickjacking (X-Frame-Options: DENY, frame-ancestors 'none'), rate-limiting controls, and payload sanitization.
  • Database Protection: Secure database connections with parameterized queries to prevent injection attacks and unauthorized database access.

While we strive to use commercially acceptable means to protect information, no method of transmission over the Internet or method of electronic storage is 100% secure.

7. Data Retention

  • Contact Messages: Retained in our database only as long as necessary to address your inquiry, resolve support tickets, or maintain records of community suggestions.
  • Server Access Logs: Rotated and deleted automatically after a standard short-term operational retention window (typically 14 to 30 days).
  • Telegram Subscriptions: Retained until you stop or block the bot, or request removal.
  • Aggregated Statistics: Anonymized metrics (such as total font download counts and view numbers) do not contain personally identifiable information and are retained indefinitely to display public counters.

8. Your Data Rights

Depending on your jurisdiction (such as under the General Data Protection Regulation / GDPR or applicable local privacy laws), you have the right to:

  • Access: Request a copy of the personal information we hold about you (e.g., submitted contact messages).
  • Correction: Request corrections to any incomplete or inaccurate data.
  • Deletion ("Right to be Forgotten"): Request the deletion of your personal data from our contact message archives or subscription lists.
  • Revoke Permissions: Revoke browser-level permissions (such as local font access) or unsubscribe from Telegram notifications at any time.

To exercise any of these rights, please reach out to us using the contact details provided below.

9. Children's Privacy

Xoshnus does not knowingly collect or solicit personal data from children under the age of 13 (or under 16 where required by applicable law). If you are a parent or guardian and believe that your child has provided us with personal information, please contact us immediately so we can promptly delete such information.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our tools, legal requirements, or operational practices. When updates occur, the "Last Updated" date at the top of this page will be revised. We encourage you to review this Privacy Policy periodically.

11. Contact Us

If you have questions, feedback, or requests regarding this Privacy Policy or your personal information, please contact us: