← Back to ZBee

Privacy Policy

Last updated: October 10, 2026

This Privacy Policy explains how ZBee LLC ("we," "us," or "our") handles information in connection with the ZBee™ desktop application, the ZBee: Safe Spend iPhone and iPad app, and the zbee.app website (together, "ZBee").

The iPhone & iPad app: nothing is collected

ZBee: Safe Spend runs entirely on your device and collects nothing. The numbers you type stay on your device; the app has no account, no analytics, no tracking, and makes no network requests of any kind — nothing you enter is sent to us or anyone else. Its optional check-in reminder is a purely local notification scheduled on your device. Everything below this section describes the desktop application and the website; none of it applies to the iPhone and iPad app.

The short version

Your holdings are stored only on your own device. Your investment holdings and balances live in a private database on your own computer and are read directly between your device and SnapTrade. They are never stored on ZBee's servers, and we do not sell or share them. The one exception to what passes through our servers is a screenshot or PDF you choose to have read (§2). If you add your own Tiingo key, your Mac also asks Tiingo directly for the closing prices of the tickers you entered; that never passes through our servers either (§2). To connect your accounts and to manage a paid subscription, ZBee uses a small backend service and a payment processor; the limited information they handle is described below. Your 30-day evaluation requires no sign-up, no email and no payment details. Our server does keep a small evaluation record for your Mac, with no name or email in it (§5, §9).

1. Information ZBee stores on your device

To do its job, ZBee stores the following locally on your computer, in your per-user application folder (on macOS, ~/Library/Application Support/ZBee Compass/ZBee.db). This location is fixed and is never a cloud-synced folder such as iCloud Drive or Dropbox:

Your holdings and balances are never stored on our servers. Apart from a screenshot or PDF you choose to have read (§2), they are transmitted only between your device and SnapTrade when you connect accounts (§3). If you add your own Tiingo key, your Mac sends Tiingo the ticker symbols of holdings you entered, and nothing else about them, to get each day's closing price (§2). ZBee also makes a routine connection to zbee.app to check for updates and, if you subscribe, to verify your subscription status (§7) — neither carries any of the information above. ZBee also writes a local diagnostic log (on macOS, ~/Library/Logs/ZBee Compass.log) that stays on your device.

2. What we never keep, and what we don't do

Your 30-day evaluation requires no sign-up and no email. Our server still keeps a small record for each evaluating Mac, keyed to its hashed fingerprint, so that one evaluation per Mac works and so you can connect a brokerage during your 30 days (§5, §9). A ZBee Pro subscription involves a subscription account and a payment, and connecting your accounts uses a backend service — the limited information involved is described in §3, §4, and §5.

3. Connecting your accounts through SnapTrade

When you connect your brokerage — during the 30-day evaluation or on a ZBee Pro subscription — ZBee uses its commercial integration with SnapTrade. ZBee's backend brokers the connection: it registers a SnapTrade user identity for you and authorizes a read-only link to your brokerage. Once connected, your holdings, balances, and prices are read directly between your device and SnapTrade — they do not pass through ZBee's servers. SnapTrade and your brokerage handle that data under their own terms; see SnapTrade's privacy policy at snaptrade.com. Automatic syncing is available only for the brokerages SnapTrade supports; where yours isn't, you can still enter holdings manually.

To authorize and sign requests to SnapTrade on your behalf, our backend holds the connection identifiers and the secret associated with your managed SnapTrade user. It does not hold your brokerage password (ZBee never sees it), and the connection is read-only, so it cannot place trades or move money. For most brokerages you sign in on the brokerage's own page, which gives SnapTrade a limited, revocable pass (OAuth or an API key) instead of your password, so SnapTrade never sees your password either.

A few brokerages offer no such pass. As of late September 2026, SnapTrade's list names AJ Bell, BMO InvestorLine, BUX, CIBC Investor's Edge, CommSec, DEGIRO, Stake (Australia), TD Direct Investing, Vanguard, Wealthsimple Trade, Webull and Webull Canada. For these, SnapTrade's connection window asks for your brokerage username and password itself, and SnapTrade would keep them so it could sign in as you. ZBee does not support these brokerages, but we cannot hide them from SnapTrade's window. So if you pick one and sign in, your username and password do reach SnapTrade. ZBee deletes that connection at SnapTrade as soon as it sees it, normally seconds after you finish, and tells you it did. Add those accounts by import or by hand instead. We do not control SnapTrade or your brokerage and are not responsible for their practices.

4. Subscription and payment

If you subscribe to ZBee Pro, payment is handled by our payment processor, Stripe. You provide your payment details directly to Stripe, and their handling of that information is governed by Stripe's privacy policy, not this one. We do not receive or store your full card number. From Stripe we receive what we need to provide and support your subscription — typically your name, email address, subscription status, billing country, and the last four digits and brand of your card for receipts and fraud prevention. We use this only to operate your subscription and to meet our tax and accounting obligations.

Stripe's checkout page also asks for your billing address (at least your country and ZIP or postal code) so it can work out whether sales tax applies and how much. Stripe holds it; we can see it in our Stripe account, and we use it only for sales tax and our tax records. ZBee's own servers do not store it. When your subscription starts, we send one email to your verified address confirming what you bought, that it renews each year until you cancel, and how to cancel.

Before you subscribe — or to authorize ZBee Pro on a new Mac — we ask for your email address and confirm it by sending a short verification code. We do this to make sure the address is yours, and so your purchase is tied to an address we have verified. We store your email and your account status; we keep the verification code only briefly (as a one-way hash) while it is pending. If you give us an email (to subscribe or to restore ZBee Pro) but never subscribe, we automatically delete that email about six months after you last used it. If you delete your account (see §9) we erase the email tied to your subscription, remove it from the Intel Mac notice list in §5 too, and keep nothing derived from it.

We also keep a plain count of how far purchases get — how many verification codes were sent, how many were accepted, how many checkouts reached Stripe, and how many completed — so we can tell whether people are getting stuck on the way. Each record is one word and a timestamp: no email address, no name, no device identifier, no IP address, and nothing about your plan or your money. Nothing links one of these to another or to you, so they are counts of steps, never of people, and the rows are deleted after 90 days like every other counter described in §7.

5. Information we process on our servers

To run the Pro features above, ZBee's backend (hosted on Cloudflare) processes a limited set of information:

We retain this while your subscription is active and for a reasonable period afterward for tax, accounting, and dispute records, then delete or anonymize it. You can erase all of it at any time (see §9). Your investment holdings and balances are not stored as part of this. The only time any of them pass through our servers is a screenshot or PDF you choose to have read (§2), and we do not keep it. Our servers never see a Tiingo key you add, the tickers your Mac sends Tiingo, or Tiingo's prices (§2).

6. Service providers

We rely on these service providers ("sub-processors"), each under its own privacy policy:

Tiingo is not one of our service providers. If you add your own key (§2), Tiingo serves you directly under your own account and its own terms; ZBee has no account or agreement with Tiingo on your behalf, and none of your data passes through us on its way there.

7. The website, downloads, and the app's update & subscription checks

The zbee.app website and app downloads are hosted by Cloudflare (the disk image is served from Cloudflare R2 at dl.zbee.app). Like virtually all websites and file hosts, these providers automatically record standard technical information when you visit or download — such as your IP address, browser/device type, referring page, and timestamps — for security and operational purposes. This data is processed by those providers under their own privacy policies.

The website uses no advertising pixels, no third-party analytics and no tracking software, and sets no cookies. (It used to carry the Reddit Pixel to measure our Reddit ads; that has been removed.)

The website also keeps its own small, anonymous counters so we can tell how many people reach the site and how many go on to download ZBee. When you visit zbee.app, our server may record a row containing only: which step happened (for example "read the page" or "pressed Download"), a coarse device class (browser vs. automated crawler, Mac vs. not, and — because ZBee runs only on Apple-silicon Macs — whether the Mac has an Apple or an Intel chip), an optional campaign label if you arrived from one of our ads or links, and a timestamp. That is the whole row. We do not store your IP address, your browser's user-agent string, a cookie, or any identifier — nothing that could single you out or link one visit to another, here or on any other site. Your browser's user-agent and the name of the network it connects from are inspected only to decide the coarse class above, and then discarded. These counters are read only in aggregate, and rows are automatically deleted after 90 days. Since September 26, 2026, before a month's rows can be deleted, we keep that month's totals: how many rows of each kind there were, with the same columns as the rows (for example "Download pressed, Mac, Apple chip, 12") and nothing finer than the month. We keep these totals, for this counter and every other counter on this page, until we no longer need them; they cannot single you out or link one visit or launch to another. The site does keep a short campaign label in your browser's session storage when you arrive from one of our ads or links, so that a later download can be attributed to it; it contains no identifier, and your browser clears it when you close the tab. This is measurement of our own website only, and none of it ever touches your financial data.

What the app tells our server, in short. The ZBee app contains no third-party analytics, advertising or tracking software, but it does send our own server a few signals of its own, each described in full below:

None of these carries a balance, a holding, an amount, your name or your email.

The ZBee app itself makes a routine connection to zbee.app when it launches: it anonymously requests a few small files telling it the latest available version, current tax figures, and any notices for ZBee users. These requests include no financial data and no identifier created by ZBee. They carry only the standard technical information (such as your IP address and a timestamp) that Cloudflare logs for any web request, plus, on the version file only, one word naming the app's coarse state — evaluating, read-only, or subscribed — so we can tell those launches apart in aggregate. That word is a category, not an identifier: it cannot single you out or link one launch to another. Since September 22, 2026, ZBee also requests that same file once more, the moment it starts and before its window appears, marked only with the word start and carrying no state word. That tells us apart a copy of ZBee that started but stopped before its window opened from one that was never opened at all. It carries nothing else, and nothing links it to the later request or to you. When you choose Check for Updates or What's New in ZBee, ZBee requests that file again, marked only with the word check and carrying no state word, so that it is not counted as a launch. If you are a Pro subscriber, ZBee additionally verifies your subscription/license status with our backend; that request is associated with your subscription, not with your financial data, which it never carries. Separately and once per install, ZBee registers its evaluation window with our backend using a one-way hashed machine fingerprint (§1) — the same fingerprint a subscription check carries — so an evaluation can't be restarted by reinstalling. Each registration carries a short set of yes/no answers about your Mac and nothing else (the record itself also keeps the dates your evaluation began and started running, and when your Mac first and last registered). Since the first release of the evaluation: whether ZBee has ever calculated an answer on it, whether it holds holdings of your own, and whether the subscription screen has ever been opened. Since September 2026, to understand how evaluations go: whether your holdings arrived by brokerage connection, by import, or by hand (each a yes/no; more than one can be yes); whether the Trade-offs page, the year-by-year table or a year's arithmetic, and the PDF export have ever been opened; how many different days ZBee has been opened on, as a bracket (2, 3, 5 or 10 or more days) rather than a count; and, if you answer it, the single question the app asks once between day 3 and day 7 of your evaluation — "Has ZBee answered your question yet?" — as one of yes, not yet or no. Since September 26, 2026, to understand evaluations that stop early: which way in you chose on the first screen (connect a brokerage, import, add by hand, try the sample data, or none); whether you opened the import window, and whether you pressed Link Account, even if neither finished; and your Mac's macOS version as two numbers (such as 15.3). For those two and for the first three answers above (an answer calculated, holdings of your own, the subscription screen), the record also keeps when our server first learned that each became yes, to the minute. They are categories, not figures: no balance, no holding, no amount, no email, and no record of when you used ZBee beyond the dates described here. They exist only so we can tell whether people get far enough to see the app work and whether it worked for them. ZBee registers once more each time one of those answers first becomes yes (or the day-bracket moves up, or you answer the question) — only on the change itself, never on a launch where nothing changed, so an answer that turned yes months after your window started is not simply missing. This applies to evaluations only: a subscribed Mac sends none of these, and every one of them, with its dates, is erased the moment you subscribe. Immediately before that erasure we add 1 to a set of running totals — how many people who subscribed had reached an answer, had holdings of their own, and so on — so we can tell whether an evaluation is working without keeping anything about the person who had it. The totals are counts and nothing else: no row per person, no dates, no identifier, and nothing that can be matched back to you or to your subscription. The whole record — dates included — is deleted if you delete your account. This is never a per-launch check-in. These checks fail silently when you are offline.

No email address is asked for during the evaluation. The app never prompts you for an address before you choose to subscribe; the date your evaluation ends is shown in the app itself.

We count the launch request, so that we can tell how many people open ZBee rather than only how many download it. The record is a count and nothing else — the same anonymous counter described above, storing a timestamp, whether the request came from a developer machine, and (since September 26, 2026) the macOS version as two numbers, and no IP address, no user-agent, no cookie, and no identifier of any kind. Nothing links one launch to another or to you, so these are counts of launches, never of people, and the rows are deleted after 90 days like every other counter here. The launch count itself needed no new request: we count a request ZBee already had to make to check for updates. Two things ride that existing request: the coarse state word described above (which is stored with the launch), and the app's name and version and your macOS version in its user-agent, as web requests ordinarily carry. The macOS version (two numbers, such as 15.3) is stored with the launch, so we can see if ZBee fails on one version of macOS; the rest is used only to tell a real launch from a web crawler before being discarded, never stored. The start request described above is the one exception: it is an extra request, made so that we can count starts. It is stored the same way (a timestamp, whether it came from a developer machine, and the macOS version, nothing more), kept apart from the launch count so neither is counted twice, and deleted on the same 90-day schedule. The app still contains no third-party analytics software and nothing in these launch counts that can single you out or link one launch to another; everything it tells our server is listed on this page, in full — the state word, the start marker and the check marker here, and the one-time evaluation registration in §1. We also email ourselves when some things happen:

Those emails stay in our own mailbox and are not deleted on the schedules described here.

Nothing runs while ZBee is closed. The Mac app makes the requests described here only while it is open. Versions released in September and early October 2026 added a once-a-day background item on your Mac (an entry under System Settings → General → Login Items & Extensions); updating ZBee removes it. Nothing about which notifications you keep or turn off leaves your Mac.

When a newer version is available, ZBee downloads it automatically in the background from dl.zbee.app so the update is ready when you choose to install it — ZBee never installs an update without you clicking. Like the version check above, this download is anonymous and carries no financial data and no ZBee-created identifier; it does mean your device contacts Cloudflare (recording the standard technical information described above) without you clicking anything. You can turn it off in Settings → Updates → "Download updates automatically", after which ZBee only tells you an update exists and downloads it when you ask.

We count that update download, so we can tell how many copies of ZBee are keeping themselves current. The record is a count and nothing else — the same anonymous counter described above, storing a timestamp and no more: no IP address, no user-agent, no cookie, no version number, and no identifier of any kind. Nothing links one update to another, to a download, or to you, so these are counts of transfers, never of people or of machines, and the rows are deleted after 90 days like every other counter here. No new request was created to make this possible: the download already had to happen, and it now passes through our own server on its way to the file instead of going straight to storage.

8. If you contact us

If you email us feedback or support requests, we receive your email address and whatever you include in your message. We use that information only to respond to you and to improve ZBee, and we do not sell it or use it for marketing.

Diagnostic reports. ZBee's Privacy & Data screen has an optional "Export diagnostic report" action. It saves a plain-text file — ZBee's app version, your operating-system and Java versions, a few counts, and ZBee's own activity log (app events and error messages), with your home-folder path removed — that you can read and then choose to email to us if you want help with a problem. It is created only when you ask, and it is never sent automatically: this is a file you control, not telemetry. It never contains your holdings, balances, values, account numbers, email, or license code. The activity log can name a brokerage you connected or synced, and an error message in it can quote what a server replied. Read the file before you send it.

9. Data retention and deletion

10. Security

Your holdings live on your own device, so their security depends largely on your device's security — keep your computer and accounts protected. For the limited information our backend and payment processor handle, we use encryption in transit and rely on established providers (Cloudflare, Stripe). No method of storage or transmission is 100% secure, and we cannot guarantee absolute security.

11. Children

ZBee is not directed to children and is not intended for use by anyone under 18. We do not knowingly collect personal information from children.

12. Your privacy rights

Depending on where you live (for example, under California's CCPA/CPRA or the EU/UK GDPR), you may have rights to access, correct, or delete personal information about you. Because ZBee keeps your financial data on your own device, that data is already entirely under your control. For information we do hold — such as your subscription record, email correspondence, or data our hosting and payment providers process — you may contact us using the details below and we will respond as required by applicable law. We do not sell or "share" personal information as those terms are defined under applicable law.

13. International users

ZBee is operated from the United States. If you access the website or contact us from outside the U.S., any limited information described above may be processed in the U.S. or in the countries where our service providers operate.

14. Changes to this Policy

We may update this Policy from time to time. Material changes will be reflected by updating the "Last updated" date above and posting the revised Policy at zbee.app.

15. Contact

Questions about privacy? Contact us at support@zbee.app.