Self-host fonts to eliminate unconditional third-party IP transfers (GDPR)

[Copilot]

Every page load was making requests to fonts.googleapis.com and fonts.gstatic.com, transmitting visitor IPs to Google regardless of consent state — a GDPR grey area flagged by German DPAs.

public/fonts/ (new — 7 woff2 files, ~176 KB)

• Bebas Neue Regular — sourced from dharmatype/Bebas-Neue (OFL)
• DM Mono Light, LightItalic, Regular, Medium — sourced from google/fonts (OFL), TTF→woff2 converted (~57% size reduction)
• Instrument Serif Regular, Italic — same source/conversion

public/css/style.css

Seven @font-face rules added at the top of the file with font-display: swap:

@font-face {
  font-family: 'DM Mono';
  src: url('../fonts/DMMono-Regular.woff2') format('woff2');
  font-weight: 400;
  font-style: normal;
  font-display: swap;
}
/* …etc for each variant */

public/index.html + public/privacy.html

Removed all three Google Fonts <link> tags (preconnect ×2 + stylesheet).

public/privacy.html

Third-party services section updated: fonts are self-hosted, no CDN requests.

firebase.json

woff2 added to the 1-year immutable cache rule alongside js|css.

---

📍 Connect Copilot coding agent with Jira, Azure Boards or Linear to delegate work to Copilot in one click without leaving your project management tool.

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• fonts.googleapis.com
  • Triggering command: /usr/bin/curl curl -s -A Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/120 REDACTED,wght@0,300;0,400;0,500;1,300&family=Instrument+Serif:ital@0;1&display=swap (dns block)
  • Triggering command: /usr/bin/curl curl -v -s -A Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/120 REDACTED (dns block)
• gwfh.mranftl.com
  • Triggering command: /usr/bin/curl curl -s REDACTED (dns block)
• https://api.github.com/repos/googlefonts/dm-mono/contents/fonts
  • Triggering command: /usr/bin/curl curl -s --max-time 15 REDACTED (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)