ZiduriWhat Make Palette processes
- Palettes and tags: Four colour values, tags, moderation status, timestamps and aggregate likes for submitted or approved palettes.
- Anonymous visitor identity: A random visitor identifier in an HTTP-only cookie lets the service associate an anonymous like with one browser without requiring an account.
- Browser collection: Liked palette IDs and the selected palette are kept in local browser storage. This is optional and can be removed by clearing site data.
- Account data: If you sign in, the service stores your email address, account ID, authentication provider and optional display name. Magic links expire after 15 minutes.
- Operational data: Requests may include an IP address or proxy-provided client address for rate limits and abuse prevention. The application also receives ordinary request and error logs from its hosting infrastructure.
Why it is processed
Palette and like data powers the public feed, popularity rankings, related palettes and moderation workflow. Visitor and CSRF cookies protect state-changing requests. Account data enables cross-device collection sync and submission history. Rate-limit information protects the service from abuse.
Where data is stored
The public web app is deployed on Vercel. The API and worker are deployed through Render; the project uses PostgreSQL/pgvector and object storage through Supabase, plus a Redis-compatible queue/cache through Upstash. These services may process data on Ziduri's behalf to provide the product.
Authentication and third parties
Accounts are optional. Make Palette can use passwordless email links and, when configured, Google OAuth. Google receives the OAuth request only when you choose Google sign-in. Email delivery is handled by the configured SMTP provider when email magic links are enabled. Cloudflare Turnstile may be used for the optional human check on submissions when configured.
Local storage, cookies and exports
The app uses local storage for anonymous likes and the selected palette. The API uses a visitor cookie, a readable CSRF cookie and, for signed-in users, an HTTP-only session cookie. Copying a hex value or downloading CSS, JSON, a palette image or a PNG preview is a browser action; those files are saved wherever your browser is configured to save downloads.
Retention and deletion
Approved palettes, tags and like records remain in the service while they are useful to the public feed. Pending and rejected submissions are retained for moderation and abuse prevention. To remove local collection data, clear Make Palette site data in your browser. To request account or submission deletion, contact Ziduri and include the account email or palette ID so we can locate the record.
Analytics and advertising
The current Make Palette implementation does not include a product analytics or advertising SDK. Hosting providers may maintain their own security and operational logs under their terms.
Your choices and rights
You can use the app without signing in, decline optional Google authentication, clear local storage, and stop submitting or liking at any time. Depending on where you live, you may have rights to access, correct or delete personal data. Contact Ziduri to make a request or ask a question about this policy.
Contact and changes
For privacy questions, use the Ziduri contact page. Make Palette is an active product; if accounts, storage, analytics or third-party integrations change materially, this policy will be updated with a new version and effective date.