Privacy Policy

Last updated: October 8, 2026

ZoraMaker is made by Zora Software, a sole proprietorship in Texas, USA. This page says, in plain words, what ZoraMaker keeps about you, why, who can see it, and how to have it deleted. Questions or requests: support@zoramaker.com.

What we keep, and why

Your account

Your email address, your name if you give it, and your sign-in methods:

• a password, stored only as a salted one-way hash (we can't read it);
• passkeys, where we store only the public half - the private key never leaves your device;
• your two-step sign-in setup;
• recovery codes, stored hashed.

We need these to let you, and only you, in.

If you sign in with Google, we keep your Google account's ID (a number Google gives us) and its email address, so we can recognize you. We never see your Google password, and signing in with Google doesn't let us read your Gmail, Drive or contacts. ZoraMaker still asks for its own second step after Google. You can unlink Google on the Security page once you have a password.

Sign-in safety

For each signed-in session we keep when it started, when it was last used, and the browser's description (its "user agent"), so you can see your sessions and sign out the ones you don't recognize. To slow down password guessing, we count failed sign-ins using only scrambled (hashed) keys made from the email and network address - never the email or address themselves.

Your workshop

Everything you enter or upload:

• materials and supplies, what they cost and where you bought them;
• barcodes, orders, recipes, products and SKUs;
• batches you make, finished stock, shows and sales;
• your machines, and the print and laser settings read from your design files;
• your design files and pictures;
• for files you choose to only list, not upload: each file's name, size, fingerprint and the folder name your browser showed - never the file itself.

This is the product: we keep it so ZoraMaker can show it back to you and work out your costs and stock.

The waitlist

If you ask for early access on zoramaker.com we keep your email; your name, what you make and where you sell, if you tell us; how you heard about us; and when you agreed to be contacted. We use it only to contact you about ZoraMaker. An entry that doesn't become an account is deleted 12 months after you last sent it - or, if we sent you an invite you didn't use, 12 months after that invite ran out. An entry that becomes an account is deleted along with that account.

Problem reports

If you send one, we keep what you wrote, any screenshot you attach, which page you were on and the app version. You and ZoraMaker staff can see them. They are deleted 12 months after the problem is closed.

What we don't collect

• your location;
• your contacts;
• advertising or cross-site tracking identifiers;
• payment card numbers. When paid plans start, payments will go through a payment provider we name here first, and we will never see your full card number.

Cookies and your device

The ZoraMaker app uses one cookie, zm_session, which keeps you signed in. It is marked secure and same-site, and it isn't used for anything else. We don't use advertising or analytics cookies.

The app keeps a few things on your own device, and they never leave it except when you send them:

• your sign-in state, so the app opens quickly;
• your theme choice (light, medium or dark);
• sales recorded while offline, until there's a signal;
• small preferences, such as your label format;
• in Chrome or Edge, the design folder you allowed ZoraMaker to check again for new files.

This website

zoramaker.com sets no cookies. It serves its own fonts, so your visit isn't reported to a font provider. Cloudflare Web Analytics counts visits without cookies - which page, the referring site, the browser and the country - so we can see how many people visit. The early-access form sends only what you type into it.

Who can see your data

• You (and, once shops can have team members, the people you add).
• ZoraMaker staff, only to run the service, answer your requests, or investigate a problem you reported. Staff actions in the admin panel are logged.
• Our service providers, who store and move data for us and may not use it for anything else:
  • Amazon Web Services (the server, in the United States);
  • Cloudflare (the secure connection to the server, and file storage for design files and backups).
  When we start sending email (password resets, invites) or taking payments, we will name those providers here before they receive anything.
• Your own AI assistant, if you connect one. If you connect an AI app (ChatGPT, Claude, Gemini or another) - by approving it on ZoraMaker's connect screen, or by giving it an AI key from the Security page - that app can read your shop's data (stock, products, costs, orders, shows and sales) to answer your questions. It can't change anything. What that app then does with the answers is governed by your agreement with its maker, not by us. Notes you typed on sales, shows and orders are never sent to it. We keep each key's name and first few characters, so you can tell them apart, and a record of which kind of request each connection made and when, deleted after 12 months. Revoke a connection at any time on the Security page; changing your password or signing out your other devices revokes them all.
• The law. If the law requires it, we may have to share data. We will tell you unless we're not allowed to.

We never sell your data.

Google Drive and other cloud drives

When you choose to link design files from Google Drive (and, later, OneDrive or Dropbox), you pick the files in the drive's own file picker. ZoraMaker can open only the files you pick - not the rest of your drive.

• Your browser reads a picked file once to fill in the design's details (name, designer, license, print or laser settings, material amounts). We keep those details, the file's name, size and fingerprint, and its link.
• If you choose "Load it into ZoraMaker", the file is copied into your ZoraMaker storage like any upload (and stays linked to your drive). Otherwise the file stays only in your drive.
• We don't keep a long-term sign-in to your drive. When ZoraMaker needs to read a file again, you're asked to allow it at that moment.
• We never change, move or delete anything in your drive.

ZoraMaker's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data from your Google Drive is used only to show you your own designs in ZoraMaker. It is never sold, never used for advertising, never used to train AI models, and never read by people except with your permission, for security, or where the law requires it.

The shared product catalog

ZoraMaker has a shared catalog of real products (a brand's filament colors, vinyl colors, retail barcodes) that fills in the form when you add something. When you add a product it doesn't know yet, its product facts - brand, product line, color, color code, the product's type details and its retail barcode - may be shared to help it grow. Never your amounts, prices, suppliers or notes, and never which shop it came from. A product is only added once 3 separate, established shops agree, or ZoraMaker staff check it - so seeing a product appear can hint that a few other shops use it too. Staff may review what's waiting; they see the facts and how many shops agree, never which shops. You can switch this off on the materials page; switching off deletes what was still waiting. Removing a barcode or renaming a material removes what you'd shared about it.

ZoraLister

Connecting ZoraMaker to ZoraLister is optional. To connect, you paste a key you make in ZoraLister. We keep it encrypted and never show it again, and you can remove it any time on the Security page (or in ZoraLister).

With it, ZoraMaker sends only the products you choose to send: their names, descriptions, options, SKUs, the prices you set, how many you have available, their pictures (through links that work for one hour), and your cost per piece (for ZoraLister's own figures; never shown in a listing). ZoraMaker reads back only where each sent product stands on each marketplace (for example "for sale" or "waiting"). ZoraMaker never connects to any marketplace itself.

How long we keep things

• While your account is open, we keep your workshop data.
• When you delete your shop (Security → Delete this shop), it is deleted from the live system 7 days later. You can cancel until then, and everything keeps working meanwhile. If you ask us instead, we delete it within 30 days. Deleting removes your shop's data, its files, your sign-in (unless you belong to another shop), and your early-access entry.
• Backups are encrypted and kept for 30 days, so deleted data is gone from them within 30 days after that.
• Business records the law requires, such as billing records once paid plans exist, are kept as long as the law requires.

Your choices and rights

You can download everything your shop holds, any time, from the Security page ("Download all my data": a ZIP of spreadsheets). For anything else, write to support@zoramaker.com to:

• get a copy of your data;
• correct it;
• delete it, or your whole account;
• be taken off the waitlist.

We'll answer within 30 days. Depending on where you live - for example Texas, California, or the EU and UK - the law may give you more rights, and we'll honor them.

Security

• Every connection is encrypted (HTTPS).
• Passwords are hashed, and two-step sign-in is required.
• Each account's data is walled off from every other account in the database itself.
• Backups are encrypted, and we test restoring them every night.

No system is perfect. If something goes wrong that affects your data, we'll tell you promptly.

Age

ZoraMaker is for people 18 or older and isn't directed at children.

Changes

If we change this policy, we'll update the date at the top. If a change is important, we'll tell you in the app or by email before it takes effect.