chore(fontmanager): drop unused Lodestone font download

The FontManager constructor downloaded FFXIV_Lodestone_SSF.ttf from
img.finalfantasyxiv.com on first start (or read it from a local
cache) into a GameSymFont byte array. Both historical readers of
that field are gone:

- BuildFonts() used to feed the bytes into AddFontFromMemory; that
  path was replaced by the Dalamud-provided AddGameSymbol helper.
- The upstream webinterface server wrote the bytes through a
  BinaryWriter to serve them to the Svelte frontend; the entire
  webinterface was intentionally removed in HellionChat.

With no live consumer left, the field, the constructor block, the
HttpClient call and the disk cache are all dead code. Removing them:

- eliminates the synchronous HTTP request on the plugin-load thread
  (no more multi-second startup hang on slow networks)
- closes the implicit "no timeout, no size guard" exposure on that
  request
- removes one outbound network endpoint (Square Enix Lodestone CDN)
  from the privacy footprint

PRIVACY.md and THIRD_PARTY_NOTICES.md updated to reflect that
HellionChat now talks to BetterTTV only (opt-out via setting). Cached
TTF files left over from earlier versions stay in pluginConfigs/
HellionChat/ until a user removes them; they are simply no longer
read.

Build: 0 warnings, 0 errors. No behavioural change for users — symbol
glyphs (job icons, item glyphs, status effects) keep rendering through
Dalamud's built-in symbol font.

HellionChat/FontManager.cs

@@ -18,8 +18,6 @@ public class FontManager
 
     internal IFontHandle FontAwesome = null!;
 
-    internal readonly byte[] GameSymFont;
-
     private ushort[] Ranges = [];
     private ushort[] JpRange = [];
 
@@ -30,32 +28,6 @@ public class FontManager
         36f, 40f, 45f, 46f, 68f, 90f,
     ];
 
-    public FontManager()
-    {
-        var filePath = Path.Combine(Plugin.Interface.ConfigDirectory.FullName, "FFXIV_Lodestone_SSF.ttf");
-        if (File.Exists(filePath))
-        {
-            GameSymFont = File.ReadAllBytes(filePath);
-        }
-        else
-        {
-            // Dispose HttpClient and HttpResponseMessage to avoid socket
-            // exhaustion on repeated cold-start downloads. GetAwaiter().GetResult()
-            // unwraps AggregateException so failures surface cleanly. A full
-            // async refactor of the constructor would be cleaner but is out of
-            // scope for v1.0.0 — tracked in the backlog.
-            using var client = new HttpClient();
-            using var response = client
-                .GetAsync("https://img.finalfantasyxiv.com/lds/pc/global/fonts/FFXIV_Lodestone_SSF.ttf")
-                .GetAwaiter()
-                .GetResult();
-            response.EnsureSuccessStatusCode();
-            GameSymFont = response.Content.ReadAsByteArrayAsync().GetAwaiter().GetResult();
-
-            Dalamud.Utility.FilesystemUtil.WriteAllBytesSafe(filePath, GameSymFont);
-        }
-    }
-
     /// <summary>
     /// Backing bytes for the bundled Hellion font (Exo 2, OFL-1.1). Lazily
     /// extracted from the assembly's manifest resources on first use; the

PRIVACY.md

@@ -23,10 +23,9 @@ Last reviewed: 2026-05-05 (HellionChat v1.0.3).
 - The plugin does not phone home. There is no telemetry, no analytics,
   no crash reporter, no usage counter, no remote update check beyond
   what Dalamud itself does.
-- Two outbound network calls exist by design: the BetterTTV emote
+- One outbound network call exists by design: the BetterTTV emote
-  service (for chat emotes) and the Square Enix Lodestone font CDN
+  service (for chat emotes). It is documented in detail below and
-  (for the in-game symbol font). Both are documented in detail below
+  can be reasoned about per request.
-  and both can be reasoned about per request.
 - You can export every message the plugin has stored, in Markdown,
   JSON or CSV, and you can wipe stored history per channel, per date
   range, or globally.
@@ -123,24 +122,22 @@ on your behalf.
 
 Source: `HellionChat/EmoteCache.cs`.
 
-### 2. Square Enix Lodestone font (`img.finalfantasyxiv.com`)
+### 2. Square Enix Lodestone font — removed in v1.0.4
 
-- **What it does:** Downloads the `FFXIV_Lodestone_SSF.ttf` font file
+Earlier versions of HellionChat (and upstream Chat 2) downloaded
-  from the official Square Enix Lodestone CDN once during font setup,
+`FFXIV_Lodestone_SSF.ttf` from `img.finalfantasyxiv.com` once during
-  so the plugin can render in-game special symbols (job icons, item
+font setup. That code path was a leftover from upstream's removed
-  glyphs, etc.) inside ImGui.
+webinterface feature and was no longer consumed anywhere — the in-game
-- **What is sent:** A single HTTPS GET request to the public Square
+symbol glyphs (job icons, item glyphs, status effects) come from
-  Enix font URL. Your IP address reaches Square Enix (unavoidable);
+Dalamud's bundled symbol-font helper, not from the downloaded TTF.
-  no character data, no plugin identifier, no message content.
-- **When it triggers:** Once per font initialisation, not per session
-  if the file is already cached locally.
-- **Cached:** Yes, by Dalamud's font subsystem.
-- **How to opt out:** This call is part of the font pipeline inherited
-  from upstream Chat 2 and not toggleable from the settings UI today.
-  If a user-facing opt-out for this would be useful for you, please
-  open a feature-request issue.
 
-Source: `HellionChat/FontManager.cs`.
+The download was removed in v1.0.4. As of that version HellionChat
+makes no automatic network call to Square Enix or to any
+`finalfantasyxiv.com` host.
+
+Cached `FFXIV_Lodestone_SSF.ttf` files left over from earlier versions
+remain in `pluginConfigs/HellionChat/` until manually deleted; they
+are no longer read.
 
 ### Links you click yourself (no automatic traffic)
 
@@ -218,14 +215,13 @@ retroactive cleanup to apply retroactively, by design.
 | Party | Why they appear | What reaches them | Their privacy policy |
 | --- | --- | --- | --- |
 | BetterTTV (NightDev LLC) | Optional emote rendering | HTTPS request for an emote ID; your IP | <https://betterttv.com/privacy> |
-| Square Enix | Lodestone font download (once) | HTTPS request for the font file; your IP | <https://www.square-enix.com/privacy> |
 | GitHub (Microsoft) | Plugin distribution via custom repo, issue tracker | Whatever GitHub sees from any HTTPS request to a public repo | <https://docs.github.com/site-policy/privacy-policies/github-general-privacy-statement> |
 | Dalamud / XIVLauncher (goatcorp) | Plugin loader, font subsystem, repo polling | Whatever Dalamud reports for itself; out of HellionChat's scope | <https://github.com/goatcorp/Dalamud> |
 
-Square Enix and GitHub are unavoidable for anyone playing FFXIV
+GitHub and the Dalamud/XIVLauncher loader are unavoidable for anyone
-through Dalamud at all. BetterTTV is the only third party HellionChat
+playing FFXIV through Dalamud at all. BetterTTV is the only third
-introduces on top of the baseline that is not also part of using FFXIV
+party HellionChat introduces on top of that baseline, and it is
-or Dalamud, and BetterTTV is opt-out via settings.
+opt-out via settings.
 
 ---
 
@@ -241,7 +237,7 @@ direct dependencies the plugin pulls in:
 - `SixLabors.ImageSharp` — image decoding (used for the BetterTTV
   emote pipeline), no network on its own.
 
-The two network calls listed under "Outbound network calls" are
+The single network call listed under "Outbound network calls" is
 written directly in HellionChat's own source, not delegated to a
 dependency.
 

docs/THIRD_PARTY_NOTICES.md

@@ -64,8 +64,10 @@ traffic is initiated explicitly by HellionChat's own source files
 and is documented in `PRIVACY.md` under "Outbound network calls":
 
 - `HellionChat/EmoteCache.cs` → BetterTTV API + CDN (opt-out via setting)
-- `HellionChat/FontManager.cs` → Square Enix Lodestone font CDN (one-time
+
-  download)
+The earlier Square Enix Lodestone font download (`FontManager.cs`)
+was removed in v1.0.4 — it was a leftover from upstream's removed
+webinterface feature and was no longer consumed.
 
 ---