Privacy Policy
Last updated: 3 October 2026
Ziora runs on your Mac. Your code and your canvases stay there — we never upload them. You sign in with Google or Apple to buy and use Ziora, so we hold your account — the email address your provider shares with us — and the licence attached to it, plus your email if you joined the waitlist. Apart from signing in and checking your licence, the app sends us three things and nothing else: a once-a-day anonymous ping you can switch off, a report if it crashes, and whatever you type into Send Feedback. Section 3 sets out exactly what each one contains.
1. Who we are
Ziora (“we”, “us”) provides the Ziora application for macOS and this website. We are the data controller for the information described below.
For any privacy question, or to exercise any of the rights in section 8, email hello@ziora.dev. We read and answer these ourselves.
2. What we collect
On our servers
| Record | What it contains |
|---|---|
| Your account | Which provider you signed in with (Google or Apple), the account ID that provider gives us, the email address it shares, your name if it shares that too, and when the account was created and last signed in |
licenses | One row per Mac a licence is active on: that Mac’s install_id, the licence it came from, tier, revoked flag, created date, and the account it belongs to (none, for a code redeemed without signing in) |
invites | Purchases: the account that bought, the email address given at checkout, the Stripe payment reference, the licence number, tier and date. Codes we issue by hand: the code, tier, which install claimed it, when, expiry, an internal note |
app_access | Global version gate — minimum supported build and access window. No personal data |
telemetry | One row per launch-day: your usage-insights ID (never your install_id), the word “heartbeat”, app version, build number, and whether the build is a release or a development one. Nothing else — see section 3 |
waitlist | Email address, the date you signed up, and where you signed up from |
The email address on your account is whichever one Google or Apple shares when you sign in. If you use Apple’s Hide My Email, it is a private relay address and we never see your real one. When you buy, we also keep the email address given at checkout with the purchase. Your card details are entered on Stripe’s checkout and never reach us.
Ziora uses two random identifiers, and keeps them apart. Your install identifier is a random UUID created the first time you launch the app and kept in your macOS Keychain, so it survives reinstalling. It is how the licence check recognises this Mac, so once you sign in it is recorded against your account. Your usage-insights ID is a second random UUID that exists only for the heartbeat in section 3. It is never sent with your sign-in, your licence check, a crash report or a feedback report, and nothing in our account or licence records can be matched to it. Switching usage insights off deletes it. Neither identifier is derived from your hardware, serial number, MAC address, Apple ID, or anything else about you or your machine.
On your own Mac — never uploaded
- Canvases and settings, in
~/.ziora/ - Wallpapers, in
~/Movies/Ziora/ - A voice log at
~/.ziora/logs/voice.log— text transcripts only. No audio is ever recorded or stored. - Agent transcripts, wherever each coding tool already writes them
The one exception is Send Feedback: if you choose to attach recent activity to a report, an extract of those logs travels with it. That is described in section 3, and it never happens unless you send a report.
3. What the app sends us
Apart from signing in and checking your licence (sections 2 and 5), three things, and this is the complete list. Two of them run without you doing anything, so they are spelled out in full.
Anonymous usage insights
Once per launch-day at most — never more than one every 20 hours — the app sends a single row containing your usage-insights ID, the word heartbeat, the app version, the build number, and whether this is a release or a development build. That is the entire message. There is nowhere in it to put a prompt, a file path, a canvas, terminal output, an email address, or anything that names your account, and the app is written so that those cannot be added by accident. The ID is not your install identifier and never travels with your sign-in, so nothing we store can match a heartbeat to you or to your licence.
It answers one question — how many Macs are running which version — and it goes into a write-only table, so no app, including yours, can ever read it back.
It is on by default and you can turn it off at Settings → Canvas → Privacy → “Anonymous usage insights”. Off means nothing is sent at all.
Crash reports
If Ziora crashes, it writes a note to your own disk as it dies and sends it the next time you launch. The report contains the cause (the signal or exception name), a short description, the app version and build, your macOS version, and up to thirty lines of stack trace. It does not contain your install_id, your email, your code, or your canvases, and it is machine-scrubbed for anything that looks like a key or a token before it leaves your Mac. Stack traces can still mention file paths, which on a Mac usually include your account name.
It goes to a server we run, which turns it into a push notification on the developer’s phone. It is not sold, shared, or used for anything but fixing the crash.
Release builds always report crashes; there is no switch for this in the app today. You have the right to object to it (section 8) — email us and we will stop it for your install.
Send Feedback
This only ever happens when you press the button. It files a card on our private Trello board so we can track the bug. What travels with it:
- What you typed, and whether you filed a bug or a feature request
- The app version
- A screenshot, if you attached one — you choose the image, and it is only sent if you do
- System info and open agents — your macOS and hardware model, memory, free disk, how long the app has been running, your
install_id(which links the report to your account if you have signed in), whether the last session crashed, and how many canvases and agents you have open. On by default; there is a switch in the report window - Recent activity — an extract of the last ten minutes of the problem, voice and action logs, scrubbed for secrets first. This can contain what you said to the app and what it did. On by default; there is a switch in the report window
A copy of every report is also saved on your own Mac, so you can always see exactly what was sent. Switch both toggles off and a report carries nothing but your words and the version number.
4. What we never collect
- Ziora uploads no source code. Agents run locally in your own checkout; whatever they send goes directly to that agent’s provider, under your own account.
- No audio recordings are stored, by us or on your machine.
- No behavioural analytics, no session recording, no third-party tracking or advertising SDKs, and no profiling. The heartbeat in section 3 counts launches; it does not follow what you do in the app.
- No advertising, no selling of data, no sharing with data brokers.
- Signing in only tells us who you are, so your licence can follow you between Macs. We never see your Google or Apple password.
5. Where your data goes
Ziora talks to the following services. Where an AI provider is listed, that is your own account under your own agreement with them — we are not a party to it and never see those keys.
| Destination | What is sent | When |
|---|---|---|
updates.ziora.dev | A request for the update feed and build download. Our server logs record IP address, user agent, app version and timestamp | On launch, and when you check for updates |
| Google or Apple | Your sign-in, on their own page. They tell us the account ID and email address described in section 2, and your name if they share it | When you sign in |
| Supabase | Your signed-in session and your install_id, so our server can check that your account holds a licence and record this Mac against it. If you redeem a code we issued by hand, that code too | When you sign in, when the app checks your licence, and when you redeem a code |
| Stripe | Your account ID and email address, so checkout is tied to your account, then your payment, entered on Stripe’s own checkout page. Stripe tells us the payment went through, which account made it and the email address used at checkout — never your card details | When you buy |
| Supabase | The usage-insights heartbeat described in section 3 | Once per launch-day, unless you have switched it off |
api.ziora.dev | The crash report described in section 3, which our server turns into a push notification to the developer | On the launch after a crash |
api.ziora.dev, then Trello | Your feedback report, and the attachments you chose to include | Only when you press Send Feedback |
| OpenAI | Live microphone audio and conversation | Only while Live Voice is switched on, and only with your own OpenAI key |
| xAI | Live microphone audio and conversation | Only while Live Voice is switched on, and only with your own xAI key |
| Hugging Face | Nothing about you — a model download of roughly 600 MB | The first time you enable on-device voice |
| Apple | Search terms you type into the player | When you search the Apple Music catalogue |
| Spotify | OAuth sign-in and search terms | Only if you connect Spotify |
YouTube, via player.maestro.orizu.dev | Standard YouTube embed traffic. This sets YouTube cookies | When you use a YouTube node |
| Your AI coding tools | Whatever those tools normally send — prompts and code context | When you run an agent. These are your own tools on your own accounts |
6. Legal basis for processing
- Contract — for your account and for verifying your licence, so we can provide the software you bought.
- Legitimate interests — for delivering updates and keeping the service secure; for the usage-insights heartbeat, so we know which versions are still in use and when it is safe to stop supporting one; and for crash reports, so faults get fixed. In each case the data is the minimum that answers the question, and you can object to any of it under section 8.
- Consent — for the waitlist, and for anything you choose to attach to a feedback report. You can withdraw it at any time by unsubscribing or emailing us.
7. How long we keep it
- Your account: until you ask us to delete it. Your licence belongs to the account, so deleting the account ends the licence too.
- Licence records: for the life of the licence, plus six years afterwards, which is the period HMRC requires business records to be kept.
- Waitlist entries: until you unsubscribe or ask us to remove you.
- Usage-insights rows: 24 months, then deleted.
- Crash reports: 12 months, then deleted.
- Feedback reports: while the bug or request is open, and for 12 months after it is closed.
- Server logs: 30 days, then deleted.
8. Your rights
Under UK data protection law you have the right to access your data, to have it corrected or erased, to receive a portable copy, to object to processing, and to withdraw consent where we rely on it. To exercise any of these, email hello@ziora.dev.
For the usage-insights heartbeat and for crash reports we rely on legitimate interests, so you have the right to object. Usage insights have a switch in Settings; for crash reports, email us and we will stop them for your install. Tell us the email address you sign in with when you write — that is how we find your account.
If you are unhappy with how we have handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint (opens in a new tab).
9. International transfers
Our database is hosted by Supabase in the EU (Sweden), and the server that receives crash and feedback reports is in Germany, so those records stay in the European Economic Area. Trello (Atlassian), which holds feedback reports once they are filed, is United States based and we rely on its standard data protection terms for that transfer. Google or Apple, whichever you sign in with, and Stripe, which takes your payment, process data under their own terms and may transfer it to the United States. Where you choose to use them, OpenAI, xAI, Apple and Spotify are United States based and process data under their own terms with you.
10. Cookies
This website uses no analytics, sets no tracking or advertising cookies, and loads no third-party scripts or embeds. If you sign in on it, it sets three cookies that only keep you signed in, and nothing reads them but our own server: ziora_oauth for the ten minutes a sign-in takes, ziora_access until your session token expires, and ziora_refresh for seven days so you stay signed in. Signing out deletes all three. Note that the app itself sets YouTube cookies if you use a YouTube node, as described above.
11. Children
Ziora is not directed at anyone under 16.
12. Changes to this policy
If we change this policy we will update the date at the top of this page and, where the change is significant, tell you in the app or by email.