Privacy
Privacy policy
bzora is local-first. It runs entirely on your device, connects directly to the databases you choose, and is built so that your database contents and credentials stay on your machine. We do not receive your queries, your table data, or your database passwords.
The only personal data we (or our processors) handle is what is needed to sell you a license and validate it: your purchase details (collected by our Merchant of Record) and your License Key activation (validated by the licensing service). This page also covers the small amount of data the website processes — consent-gated analytics — separately from the app.
Effective date: 15 June 2026 · Version: 1.0
1. Summary
- Stored only on your device: connection settings, and — in your operating-system keychain — database passwords, SSH passwords, and key passphrases.
- Sent off your device: your License Key and an activation/instance identifier, to validate your license; and, at purchase, your billing details to our Merchant of Record.
- Never sent to us: your database contents, queries, or stored credentials.
2. Who is responsible for your data (Controller)
The data controller for the limited personal data described in this policy is:
AVENIDA DO CÓDIGO – SOFTWARE E SOLUÇÕES DIGITAIS, Lda., a company incorporated in Portugal, NIPC 519348761, registered office Travessa Serradinha, 46, 1.º Esq. A, 2475-116 Benedita, Alcobaça, Portugal. Privacy contact: hello@bzora.io.
For purchase and payment data, our Merchant of Record (Lemon Squeezy) acts as a controller and/or processor under its own privacy policy.
3. Data stored locally on your device (not collected by us)
The Software stores the following on your device only. We do not receive or have access to it:
- Connection settings — names, hosts, ports, database names, usernames, and
non-secret connection parameters — stored in a local configuration file (
connections.json) under your user configuration directory. This file is kept secret-free. - Secrets — database passwords, SSH login passwords, and SSH key passphrases — stored in your operating-system keychain (e.g. macOS Keychain, Windows Credential Manager, or the Linux Secret Service), not in plaintext on disk.
- Local app state — license-status cache (
license.json, which holds your own License Key locally and never transmits it to our webview UI), query history, and similar preferences.
Because this data never leaves your device through the Software, requests to access or delete it are handled by you deleting the relevant files or keychain entries; we cannot do this for you.
4. Website analytics & cookies
We use Google Analytics 4 on this website to understand how the site is used — which pages get visited and roughly where traffic comes from. Google Analytics sets cookies and processes data such as your IP address and browser information.
Analytics is off by default. When you first visit, a consent banner asks for your choice, and we load Google Analytics using Consent Mode set to deny. No analytics cookies are set and no analytics data is sent unless you press Accept. If you decline, Google Analytics stays disabled.
Your choice is stored in your browser's local storage under the key bzora-consent so we don't ask again. To change your mind, clear this site's data in your browser and pick again
on the next visit.
5. Data processed when you use and license the Software
| Data | Why | Legal basis (GDPR Art. 6) | Who handles it |
|---|---|---|---|
| License Key + activation/instance identifier + a device identifier | To activate, validate, and periodically re-validate your license; to enforce activation limits and detect abuse | Performance of the contract (Art. 6(1)(b)); our legitimate interest in preventing license abuse (Art. 6(1)(f)) | Licensor and/or the licensing service (Lemon Squeezy) |
| Purchase data — name, email, billing/country and tax info, and payment details | To sell you a license, take payment, issue invoices, handle refunds, and meet tax/accounting duties | Performance of the contract (Art. 6(1)(b)); legal obligation for tax/invoicing (Art. 6(1)(c)) | Lemon Squeezy as Merchant of Record; Licensor receives transaction and license records (not full card data) |
| Support correspondence — email address and message contents | To answer your questions and provide support | Legitimate interest (Art. 6(1)(f)); steps prior to/under a contract (Art. 6(1)(b)) | Licensor |
The desktop application does not collect usage analytics, telemetry, or behavioral tracking, and contains no advertising or third-party tracking SDKs. Your database connections, queries, and results stay on your machine and go only to the databases you connect to. The only thing the app sends out is your License Key, to verify your purchase.
We do not sell your personal data, and we do not use it for automated decision-making that produces legal or similarly significant effects on you, or for profiling.
6. Recipients and processors
We share the limited personal data above only with parties that help us run the service:
- Lemon Squeezy — Merchant of Record, payment processing, and license issuance/validation. See Lemon Squeezy's privacy policy.
- Cloudflare — hosts the website and serves the application downloads. Cloudflare processes standard request logs (such as IP addresses) to deliver and protect the site.
- Google Analytics — website usage analytics, only after you consent (Section 4). See Google's privacy policy.
We may also disclose data where required by law, to enforce the EULA, or to protect our rights, safety, or property.
7. International transfers
Some processors (including Lemon Squeezy and Google) may process data outside the European Economic Area, including in the United States. Where that happens, transfers are protected by an appropriate safeguard under GDPR Chapter V — such as the European Commission's Standard Contractual Clauses or an adequacy decision (e.g. the EU–US Data Privacy Framework, where the recipient is certified). You may request details using the contact in Section 11.
8. Retention
- Locally stored data (Section 3) stays on your device until you delete it.
- License records are kept for as long as your license is active and as needed to validate it and prevent abuse.
- Purchase, invoice, and tax records are kept by the Merchant of Record and by us for the period required by applicable accounting and tax law (in Portugal, generally up to 10 years).
- Support correspondence is kept only as long as needed to resolve your request and for a reasonable period afterward.
9. Your rights
If your personal data is processed and EU/Portuguese data-protection law applies, you have the right to: access your data; rectify inaccurate data; erase it; restrict or object to processing; data portability; and, where processing is based on consent, to withdraw consent at any time (without affecting prior processing). Where we rely on legitimate interests, you may object on grounds relating to your particular situation.
To exercise these rights, contact us at hello@bzora.io. For purchase data held by the Merchant of Record, you can also contact Lemon Squeezy directly. We will respond within the timeframe required by law (generally one month).
Right to complain. You may lodge a complaint with your local supervisory authority. In Portugal this is the Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt.
10. Security
We rely on the design choices that keep sensitive data on your device: secrets are held in the OS keychain rather than in plaintext files, configuration files are stored under a restricted-permission directory, and database connections default to encrypted and verified transport (TLS, with strict SSH host-key checking when tunneling). No method of storage or transmission is completely secure, and you are responsible for the security of your device, your credentials, and your network (see EULA Section 9).
11. Children
bzora is a professional developer tool and is not directed to children under 16. We do not knowingly collect personal data from children.
12. Changes to this policy
We may update this policy from time to time. The "Effective date" above shows the latest version. Material changes will be communicated by updating this document and, where appropriate, through the Software or our website. Continued use after a change means you accept the updated policy, to the extent permitted by law.
13. Contact
Questions or requests about this policy or your personal data:
AVENIDA DO CÓDIGO – SOFTWARE E SOLUÇÕES DIGITAIS, Lda.
Travessa Serradinha, 46, 1.º Esq. A, 2475-116 Benedita, Alcobaça, Portugal
Email: hello@bzora.io
Website: bzora.io
Last updated: June 15, 2026.