Privacy Policy

Last updated: September 9, 2026

Apibeary ("we") is an invite-only market-signals dashboard at apibeary.com, operated by Heronward LLC, doing business as Apibeary, a Florida limited liability company. Questions about anything here: help@apibeary.com.

This page tells you what we collect, why, where it goes, and how to make us delete it. It's written to be read.

What we collect

Account basics. Your email address and a display name — either what you give us, or (with Google sign-in) the name, email, and verified-email flag Google shares. We never see or store your Google password. Sign-in is by an emailed one-time link or by Google, so we hold no password of yours.
A session cookie. One first-party cookie that keeps you signed in for up to 7 days. No advertising or third-party tracking cookies — we don't run any.
Brokerage holdings (optional). If you connect a broker, the connection is made on SnapTrade's secure page — your broker login never touches our server. What we receive is read-only: positions and balances, so we can show flags on what you hold. The connection secret is encrypted at rest on our server, and we keep a cached list of the tickers you hold so an alert can say when a scout flags something you own. We cannot trade, move money, or change anything in your account. Disconnecting in Settings deletes our link and that cached list, and tells SnapTrade to delete you on their side.
Push subscriptions. If you turn on notifications, we store the delivery endpoint your device gives us.
Things you create in the app. Stars, shortlist entries, journal notes, settings, email digest preferences, API tokens (stored as hashes), and the record of any AI assistant you connect (which one, when, and when it last read — never your conversations with it).
Billing identifiers, if you subscribe. Stripe tells us your customer and subscription identifiers and the country of the card you paid with, and we keep those beside your plan. Your card number, name and billing address stay with Stripe. Of each Stripe notification we keep only its identifier and type.
Server logs. Standard access logs (IP address, page requested, browser type) for security and simple traffic counts, kept for 90 days, plus a security log of sign-in attempts, rate-limit refusals and billing events, kept for the same 90 days. No third-party analytics service sees them.

What we never do

We don't sell your data. We don't share it with advertisers. We have no ad networks, no data brokers, no third-party analytics. And by design, we have no ability to place trades with anything you connect.

Who processes data for us

A short list, each strictly for its job: DigitalOcean (hosting, New York datacenter), Cloudflare (the network in front of our servers — it receives every request, including your IP address, before we do), Resend (sends our emails), SnapTrade (handles broker connections), Tiingo, Inc. (market data — live prices), Stripe (payments and subscriptions — card details go straight to Stripe and never reach us), and Google (only if you choose Google sign-in).

Where your data is processed

Our servers are in the United States (DigitalOcean, New York). Cloudflare's network receives your requests at the point nearest you and passes them to those servers, so if you're outside the United States, your data is still processed there.

The other companies named above process the slice each receives on their own systems, in the places they operate and under their own privacy policies: Stripe your payment, Resend your email, SnapTrade your broker connection, Google your sign-in if you use it.

Where the market data comes from

Market Data from Tiingo.com. Prices are licensed for you to read here — see the Terms (section 5) for what you may and may not do with them.

AI models and connected assistants

Some scouts use AI language models to read public text: filings, statements, news. Your account stays out of it. We send no account details, holdings, journal entries or settings to any AI model provider, and the scouts cannot read the member database at all. Connecting your own AI assistant on the Connect page is a different flow, and it is yours: your assistant reads your signals feed and a small record of who you are (your username and plan) through a credential we issue to it, and what that assistant then does with the text — including how long its vendor keeps it and whether the vendor trains on it — is governed by that vendor's terms, not ours. Disconnect it at any time from Settings or the Connect page.

How long we keep it

Your data stays while your account exists. Access logs and the security log are kept for 90 days. The member database is backed up nightly: those backups are kept for 14 days on the server, and a copy of each is also pulled to equipment the operator controls, off the server, and kept there for 60 days. Anything you delete can persist in those backups until they age out.

Deleting everything

Settings → Close account does all of this on the spot: it cancels any Pro subscription with Stripe, tells SnapTrade to forget you, disconnects any AI assistant, and deletes your profile, journal, stars and notes, watchlist, settings, tokens, push subscriptions, brokerage link and cached holdings. Your email address and name come off the account row; what remains is an anonymous row holding the dates you joined, were last seen, and left, plus a count of any bulk exports you made, kept for abuse review. Security-log entries naming your email go with the account; entries that name only an IP address age out within 90 days. Stripe keeps its own records of any payments under its own policy. If you were on the updates list, we keep your address and the date you left so we can carry on not emailing you. Backups age out on the schedule above. It's built in, so it needs no email — though help@apibeary.com works too.

Security, honestly stated

HTTPS everywhere; brokerage secrets encrypted at rest; server access by key only, no passwords; automatic security patching; and the service can read your connected data but never act on it. No system is unbreakable, and we won't pretend otherwise — but the blast radius is deliberately kept small.

Your choices

Email digests: pick daily, weekly, or off — every email has a one-click unsubscribe. Push: on/off in Settings. Brokerage: disconnect anytime. Account: delete anytime.

Announcement emails

We keep two separate lists, and they are not the same thing. If you asked us for an invite, we may send you at most two emails about that request — an answer, and a note on the day accounts open — and each carries a link to join our updates list. Following that link shows you a page with a button; you are on the updates list only once you press it, and we email that list occasionally about what has shipped and what is opening. Nothing else puts you on it: not holding an account, not reading the feed, not asking for an invite, and not merely opening a link. Both lists send from alerts@apibeary.com with a reply-to of help@apibeary.com, through Resend, already listed above. Every announcement carries a one-click unsubscribe, and you can also leave from apibeary.com/updates/opt-out at any time. We keep your address on the updates list until you leave or delete your account; after either, all we keep is your address and the date you left, so that we can carry on not emailing you.

Children

Apibeary is not for anyone under 18.

Changes

If this policy changes in a way that matters, we'll email account holders and note the new date up top.