Privacy Policy

1.Information we collect

Account: name, email address, authentication identifiers (for example Google or Apple account identifiers), account status, role, onboarding status, and legal-consent records.

Personalization: goals, risk and experience inputs, available capital or net-worth ranges you provide, behavioral profile inputs, and settings you choose.

Portfolio: tickers, quantities, purchase prices, asset types, watchlists, manual holdings, wallet entries you add, and portfolio context derived from them.

Ask Zoe / AI: prompts, conversation messages, and generated responses stored to provide chat history and product functionality.

Product usage: feature usage, decision and evaluation records associated with your account where applicable, logs, diagnostics, and crash or error data.

Device and technical data: IP address, browser or device type, user agent, language, approximate location derived from network data, cookies, and local storage values needed to operate the Service.

Notifications: push tokens (FCM), Telegram connection identifiers if you connect Telegram, and notification preferences.

Payments: subscription status, trial dates, and billing identifiers from PayPal and/or Apple. We do not store full payment card numbers.

Public Demo: interactions with the marketing Public Demo are generally illustrative. If any demo interaction is logged for quality or abuse prevention, it is not your live portfolio.

2.Broker-connected data

If you connect a supported broker (currently eToro), we may store encrypted API credentials you provide, the environment you selected (demo or real), sync status, and holdings data synced into your Zoe portfolio (symbols, quantities, prices, and related asset metadata).

Purpose: sync portfolio context so Zoe can personalize decision support. Zoe does not custody your funds. Zoe does not store your eToro password. Zoe does not place trades from a connected user eToro account.

Live-money Autopilot is not currently available. Disconnecting deletes Zoe's stored key and synced eToro holdings from the live system. Zoe cannot delete the key inside eToro. Do that in eToro Settings.

3.How we use information

We use information to: (1) provide and operate the Service; (2) personalize signals and decision support; (3) sync portfolios and optional broker context; (4) generate Ask Zoe responses; (5) send notifications you enable; (6) process subscriptions and trials; (7) secure the Service and prevent abuse; (8) troubleshoot and measure product quality; (9) comply with law and enforce our Terms.

Service operation is separate from Zoe's own product metrics. Zoe uses Google's paid Gemini API. Under Google's applicable Paid Services terms, prompts and responses are not used to improve Google's products. Limited Google abuse/security monitoring may still apply. Project-specific Zero Data Retention is not enabled.

4.AI and automated processing

Zoe uses automated systems and Google Gemini (Developer API) to analyze market data, minimized book context (symbols, weights, capital bands when needed), and your questions. Before portfolio context is sent, Zoe removes names, email addresses, phone numbers, exact portfolio values, exact cash balances, and broker credentials. Passwords and payment details are not sent. Gemini Developer Logging is disabled for Zoe's project. Project-specific Zero Data Retention is not enabled. Chat history is stored in Zoe's database. Outputs can be wrong or incomplete.

Automated outputs are informational decision support. They are not investment advice or a recommendation to transact in any asset.

5.How we share information

We share information with service providers that help us run Zoe, including hosting and databases, authentication (for example Google or Apple), analytics (Google Analytics when you consent), payments (PayPal, Apple), notifications (Firebase Cloud Messaging, Telegram where connected), email delivery, error monitoring, AI inference providers, market-data providers, and optional broker APIs you connect.

We may share information with courts, regulators, or other parties when required by law or to protect rights and security. We may transfer information in a merger, financing, or sale of assets.

We do not sell personal information to advertisers.

6.Financial and portfolio data

Portfolio and broker-synced information is used to personalize informational outputs and decision-support classifications.

Zoe does not custody funds. Demo Autopilot may simulate execution in a demo environment. Live-money Autopilot is not currently available. Connected financial data is used only for product functionality you enable and remains subject to your permissions and the broker's terms.

7.Retention and deletion

We retain personal information for as long as reasonably necessary to provide the Service, comply with legal obligations, resolve disputes, enforce agreements, maintain security, and support legitimate business operations. We do not currently publish fixed personal-data retention windows for every table.

In-app account deletion is available where offered and removes core account, portfolio, chat, decision, notification, and related user records from active systems. Some records may remain in backups, security logs, billing records, or legal holds for a limited period. Broker credential cleanup should be verified as part of deletion operations.

8.Security

Broker API credentials are encrypted at rest with AES-256-GCM. The encryption key lives on Zoe's servers (currently Railway). That protects a stolen database copy more than a full server compromise. Keys are not shown back in the app. We have not yet completed an independent penetration test. No system is completely secure.

9.International transfers

Information may be processed and stored outside your country of residence, including on Railway. We do not currently publish a single-country residency guarantee. Specific transfer mechanisms should be confirmed by counsel.

10.Your rights

Depending on your location, you may have rights to access, correct, delete, export, restrict, or object to certain processing of your personal information, and to opt out of certain analytics.

To exercise rights, contact hi@imzoe.io from your registered email. Which privacy regimes apply (for example GDPR or other local laws) depends on the operating entity, user geography, and business activity and should be confirmed by counsel.

11.European users (GDPR)

If you are in the EEA, UK, or Switzerland, GDPR may apply. Where it applies, we process personal data on these bases: (1) contract, to provide the Service; (2) consent, for analytics cookies and optional integrations you opt into; (3) legitimate interests, for security, fraud prevention, and product improvement, balanced against your rights.

You may request access, correction, deletion, restriction, portability, or objection. You may withdraw analytics consent via the cookie banner controls or by contacting us. You may lodge a complaint with your local data-protection authority.

For deletion or export requests, email hi@imzoe.io from your registered address. Where GDPR applies, we aim to respond within 30 days.

12.Cookies and analytics

We use cookies, local storage, and similar technologies to operate sessions, remember preferences, and measure site usage. Marketing pages may show a cookie banner. Analytics (Google Analytics) runs only after you accept analytics consent. Advertising storage remains disabled in our consent defaults. We do not knowingly load separate advertising pixels on the public marketing site.

13.Children

The Service is not intended for children under 18. We do not knowingly collect personal information from children under 18.

14.Contact

Privacy questions: hi@imzoe.io. Operating entity legal name and postal address should be confirmed by counsel and added here when finalized.