Privacy
Last updated 5 October 2026.
BoboCreate is a desktop app. Your designs live in a folder on your own computer, and the app works without an account. This page lists everything that does reach us, why, and for how long.
The short version
- No BoboCreate account. There is nothing to sign up for and no password.
- No email needed to use BoboCreate. Opening, editing and printing designs never asks for one. Buying a key does: Stripe asks for it at checkout (see Licence keys).
- No product telemetry. The app does not report what you click, what you make or how you use it.
- Your designs stay on your computer. They are not uploaded to us.
- Connecting an Etsy shop is optional, and is the only feature that keeps anything on our server about your shop (see Etsy).
The app on your computer
Designs, pictures, fonts and exports are stored in the BoboCreate library folder on your computer. We cannot see them. The app keeps a log of what it has been doing, also on your computer; it is sent to nobody unless you choose Help → Save log… and email the file to us yourself.
The app connects to the internet only for these:
- Opening a design bought on bobotemp: the pictures and fonts that design needs are downloaded once.
- Checking a licence key, when you enter it and then about once a week (below).
- Looking for an update to the app.
- Etsy, only if you connect a shop (below).
Licence keys
Designs you bought on bobotemp need no key. A key is needed for designs you start from blank, and is bought through Stripe, which handles the payment. We never see your card. Stripe gives us the email address you entered at checkout, and we keep it beside the key we issued so a lost key can be found again. Stripe's own handling of your payment is described in Stripe's privacy policy.
When a key is entered, and about once a week after that, the app sends the key and the name of the computer. For each key we keep: a one-way hash of it, the name it was issued to if any, when it was first used, when it expires, and for each computer (up to two) its name and when it last checked in. That is what lets one key stay on one person's computers. A computer that has not checked in for 90 days gives up its place.
Etsy
BoboCreate can make a listing on Etsy from a design: as a package of files you upload yourself (Save Etsy package, which involves no connection and nothing on our server), or by connecting your Etsy shop so BoboCreate can create a draft listing for you. Connecting is optional, is switched on gradually, and can be undone at any time.
How the connection works
When you choose Connect Etsy shop, Etsy's own page opens in your browser. You sign in to Etsy there — BoboCreate never sees your Etsy password — and approve three permissions: to see your shop, and to see and change its listings. Etsy then gives our server an access token and a refresh token for your shop. Those tokens stay on our server. Your computer receives only a BoboCreate connection credential: a random value that identifies the connection, not you, kept in your computer's own protected storage (the Keychain on a Mac, Windows' data protection on a PC).
What our server keeps while you are connected
- your Etsy shop ID, and the Etsy user ID Etsy's API identifies the shop owner by;
- the permissions you granted;
- the access and refresh tokens, encrypted (below);
- a one-way hash of the connection credential, to recognise your computer's requests;
- the Etsy listing IDs of drafts BoboCreate made, against the BoboCreate project they came from;
- operation IDs: a record that a draft, photo or file was sent, so that a retry after a dropped connection does not create a duplicate listing;
- a short operational log: for each request, the time, which feature was used, whether it worked, Etsy's status code and how long it took. It holds no tokens, no listing text, no file names or contents, no buyer details and no IP addresses.
What it does not keep
- Your designs. Photos and files you choose to send to Etsy pass through our server on their way, and are deleted as soon as each upload finishes (a cleanup removes anything left behind within an hour).
- Your Etsy password. It is only ever typed on etsy.com.
- Buyer information. BoboCreate asks Etsy for no access to orders or buyers.
- Product telemetry, and your ordinary BoboCreate projects and files.
How the tokens are protected
Etsy's tokens are encrypted with AES-256-GCM before they are stored. The encryption key is not kept with them: it is held separately in Amazon Web Services' parameter store (AWS Systems Manager), readable only by the server itself. The tokens are never sent to your computer.
How long it is kept
| Etsy tokens and the connection credential | Until you disconnect — then erased at once. |
|---|---|
| The disconnected connection's record (shop ID, dates, no tokens) | 30 days, then deleted. |
| A connection Etsy has stopped accepting | Its tokens are erased; the record is deleted after 90 days unused. |
| Listing IDs against projects | Until you disconnect. |
| Operation IDs | 30 days. |
| Operational log | 14 days. |
| A connection attempt you did not finish | About an hour. |
| Photos and files on their way to Etsy | The length of the upload. |
Disconnecting
In BoboCreate, Settings → Integrations → Etsy → Disconnect. Our server erases your shop's Etsy tokens and the connection credential immediately, and your computer forgets the credential. Drafts already made stay on Etsy, where you can keep, publish or delete them.
Etsy's API offers no way for an app to withdraw its own permission, so BoboCreate will still appear in your Etsy account's list of connected apps. To remove it there as well, do so on etsy.com. If you no longer have the computer that connected, write to support@bobotemp.com with your shop name and we will disconnect it.
The term 'Etsy' is a trademark of Etsy, Inc. This application uses the Etsy API but is not endorsed or certified by Etsy, Inc. What Etsy itself does with your information is described in Etsy's privacy policy.
This website
bobocreate.com uses Google Tag Manager and Google Analytics to count visits, where visitors came from and which pages they read, along with a few actions such as clicking a download button. These are Google's services, governed by Google's policies. Separately, our server counts downloads per day and platform, with nothing about the person downloading.
The site is served through Amazon Web Services, including its CloudFront network. The web server's own request logs are kept for 14 days.
Questions, or removing your information
Write to support@bobotemp.com. We will tell you what we hold about your key or your Etsy connection, and remove it when you ask.