Privacy Policy

Last updated: August 5, 2026

Apibeary ("we") is an invite-only market-signals dashboard at apibeary.com, operated by Heronward LLC, doing business as Apibeary, a Florida limited liability company. Questions about anything here: help@apibeary.com.

This page tells you what we collect, why, where it goes, and how to make us delete it. It's written to be read.

What we collect

Account basics. Your email address and a display name — either what you give us, or (with Google sign-in) the name, email, and verified-email flag Google shares. We never see or store your Google password. If you use the password fallback, we store only a one-way hash — not the password itself.
A session cookie. One first-party cookie that keeps you signed in. No advertising or third-party tracking cookies — we don't run any.
Brokerage holdings (optional). If you connect a broker, the connection is made on SnapTrade's secure page — your broker login never touches our server. What we receive is read-only: positions and balances, so we can show flags on what you hold. The connection secret is encrypted at rest on our server. We cannot trade, move money, or change anything in your account. Disconnect anytime in Settings.
Push subscriptions. If you turn on notifications, we store the delivery endpoint your device gives us.
Things you create in the app. Stars, shortlist entries, journal notes, settings, email digest preferences, API tokens (stored as hashes).
Server logs. Standard access logs (IP address, page requested, browser type) for security and simple traffic counts. No third-party analytics service sees them.

What we never do

We don't sell your data. We don't share it with advertisers. We have no ad networks, no data brokers, no third-party analytics. And by design, we have no ability to place trades with anything you connect.

Who processes data for us

A short list, each strictly for its job: DigitalOcean (hosting, New York datacenter), Resend (sends our emails), SnapTrade (handles broker connections), Tiingo, Inc. (market data — live prices), and Google (only if you choose Google sign-in).

Where the market data comes from

Market Data from Tiingo.com. Prices are licensed for you to read here — see the Terms (section 5) for what you may and may not do with them.

How long we keep it

Your data stays while your account exists. Server backups rotate on a short cycle, so deleted data can persist in backups for up to about 30 days before aging out. Access logs are kept for traffic stats and security review, then rotate.

Deleting everything

Settings → Close account erases your account on the spot: profile, journal, stars, tokens, push subscriptions, and brokerage connection (we also tell SnapTrade to forget you). It's built in — no email required, though help@apibeary.com works too.

Security, honestly stated

HTTPS everywhere; brokerage secrets encrypted at rest; server access by key only, no passwords; automatic security patching; and the service can read your connected data but never act on it. No system is unbreakable, and we won't pretend otherwise — but the blast radius is deliberately kept small.

Your choices

Email digests: pick daily, weekly, or off — every email has a one-click unsubscribe. Push: on/off in Settings. Brokerage: disconnect anytime. Account: delete anytime.

Children

Apibeary is not for anyone under 18.

Changes

If this policy changes in a way that matters, we'll email account holders and note the new date up top.