Hm, wonder if this somehow is against their TOS?
The only thing that bothers me is the generation of the zip file, but streaming these files without any caching on the server would be very expensive (especially on a single free heroku dynamo).
> d. Data Portability
> Google supports data portability. For as long as you use or store any user data that you obtained through the APIs, you agree to enable your users to export their equivalent data to other services or applications of their choice in a way that's substantially as fast and easy as exporting such data from Google products and services, subject to applicable laws, and you agree that you will not make that data available to third parties who do not also abide by this obligation.
but also
> a. Content Accessible Through our APIs
> Our APIs contain some third party content (such as text, images, videos, audio, or software). This content is the sole responsibility of the person that makes it available. We may sometimes review content to determine whether it is illegal or violates our policies or the Terms, and we may remove or refuse to display content. Finally, content accessible through our APIs may be subject to intellectual property rights, and, if so, you may not use it unless you are licensed to do so by the owner of that content or are otherwise permitted by law. Your access to the content provided by the API may be restricted, limited, or filtered in accordance with applicable law, regulation, and policy.
My reading of 5e says the opposite. That 'unless expressly permitted by content owners' you shouldn't be allowing caching of content provided via Google APIs.
Considering that most (all?) fonts on Google Fonts are open (most I checked use SIL or Apache as license), downloading is most likely allowed.
Think of it like an affirmation from an open source project licensed under an MIT or BSD license. Although they might include GPL code from elsewhere, they'll generally state that they're not relicensing someone else's GPL code under the less restrictive license.
Probably the biggest issue for the service will be to make sure that licensing is ensured. (see https://news.ycombinator.com/item?id=8802833)
This may result in a higher latency, but might be more safe in regards to their ToS.
Your temporary caching, to me, seems fine. I read the ToS as saying that permitting your end user to obtain permanent copies might be disallowed ... at the discretion of the font designers. To be absolutely certain, you should check each font's license. Considering the fonts aren't Google's to license, I doubt you'll hear from them.
Interestingly, Google's own Fonts API which I'm using with my service, doesn't provide any information about the underlying license of each font (I previously wanted to include that info in the UI as well).