Privacy Policy

Last updated: 19 July 2026 (version 2026-07-19)

This Privacy Policy explains what personal data Zenith ("we", "us", "the service") collects, why, how it is stored, and the rights you have over it. It is written specifically for Zenith and describes only what the product actually does.

Who we are

The operator of zenithapp.co (identified above) is the data controller for the personal data described here. You can reach us for any privacy question at the contact address above.

Data we collect

We collect only what the service needs to work:

• Account data: your email address and a one-way hash of your password. We never store your password in plain text.
• Financial data you enter: budgets, transactions, income, categories, savings accounts, goals, investment positions, and any notes or labels you add. This is the content of the app and is yours.
• Uploaded statement files: if you use statement import, the file you upload is stored temporarily and is deleted as soon as the import is saved or discarded. We do not keep your statement files after that point.
• Technical data: your IP address (used for security, rate limiting, and abuse prevention) and an approximate country derived from your IP (used only to enforce our regional access policy).
• Analytics (only with your consent): if you accept analytics cookies in the cookie banner, Google Analytics collects aggregated usage data (such as pages viewed, approximate location, and device or browser type) to help us improve Zenith. If you decline, no analytics cookies are set and no analytics data is collected. See the Cookies section below.

AI analysis and your own API key (BYOK)

Zenith's AI features run on your own Anthropic API key, which you provide in settings. We store that key encrypted at rest and never use our own AI account on your data.

When you choose to run an AI analysis, the relevant data for that analysis (for example the budget figures or holdings involved) is sent to Anthropic using your key so it can generate the result. Anthropic acts as a processor for that request under its own terms. If you never run an AI analysis, no data is sent to Anthropic.

Service providers (processors)

We use a small number of providers to run the service. Where a provider processes personal data, it does so as our processor under a data processing agreement:

• DigitalOcean - hosting of the application and database.
• DigitalOcean Spaces - temporary storage of uploaded statement files (deleted after import, as described above).
• Resend - sending transactional email (verification codes, account notices, password resets).
• Cloudflare Turnstile - bot and abuse protection on sign-up and sign-in.
• Anthropic - AI analysis, only when you run it, using your own key (see above).
• Market data providers (Financial Modeling Prep, Finnhub, Twelve Data) - stock and fund prices and fundamentals. Only ticker symbols are sent to these providers. No personal or financial data about you is ever sent to them.
• Google (Google Analytics) - aggregated product usage analytics, loaded only if you accept analytics cookies in the cookie banner. You can decline, and you can change your mind by clearing the site's cookies for zenithapp.co.

Redis (used for caching and rate limiting) is self-hosted on our own infrastructure and is not a separate third party. Country lookup for the regional policy is performed locally from a bundled dataset, with no third-party call.

Legal bases

Where the GDPR applies, we rely on:

• Performance of a contract to provide the account and the app features you ask for.
• Legitimate interests to keep the service secure (rate limiting, abuse prevention, enforcing our regional policy).
• Consent where you actively choose an optional feature, such as running an AI analysis with your key.

Retention

We keep your account data and the content you enter for as long as your account exists. Uploaded statement files are deleted as soon as an import is saved or discarded. When you delete your account, all of your data is permanently deleted (see below).

International transfers

Some of our providers (including Anthropic, Google, and Cloudflare) are located in the United States. Where personal data is transferred outside your region, that transfer is covered by the appropriate safeguards (such as the EU Standard Contractual Clauses) with the provider.

Your rights

Subject to applicable law, you have the right to:

• Access the data we hold about you.
• Rectify inaccurate data (you can edit your data directly in the app).
• Erase your account and all associated data. You can do this yourself at any time in Settings, Account, Delete account. Deletion is immediate and permanent, including any stored files.
• Portability: export a machine-readable copy of your data. Use Settings, Account, Export my data (JSON) to download everything you have stored, excluding secret material such as your password hash and your encrypted API key.

To exercise a right that is not self-serve, contact us at the address above. You also have the right to lodge a complaint with your local data protection supervisory authority.

Cookies

Zenith uses a strictly necessary session cookie to keep you signed in. This is always active because the app cannot work without it, and it is not used for tracking.

With your consent, we also use Google Analytics cookies to measure how Zenith is used. When you first visit, a cookie banner lets you Accept or Decline analytics cookies:

• If you accept, Google Analytics is loaded and sets its cookies.
• If you decline (or make no choice), Google Analytics is never loaded and no analytics cookies are set.

You can change your decision at any time by clearing this site's cookies and site data in your browser, which will show the banner again. We do not use advertising cookies.

Changes to this policy

If we make a material change, we will update the version and date above and, for signed-in users, may ask you to review and accept the updated policy.