Privacy policy

Version 2 · effective 31 October 2026 · also see our Terms of Use · Refunds · Rules · Risk disclosure

The short version.

We collect what we need to run your account: your email, a scrambled version of your password, and what you save (watchlist, play-money and real holdings, notes, alerts). We do not sell your data and we do not run advertising or analytics trackers. Questions you type to the Bull and Bear are sent to an AI provider. You can delete your account and data yourself.

This policy is written to meet India's Digital Personal Data Protection Act 2023 and Information Technology Act, and Australia's Privacy Act 1988 and Australian Privacy Principles, and to be understandable if the GDPR applies to you. It must be reviewed by a qualified lawyer before the service is offered to the public. Items in [brackets] must be filled in by the operator.

1. Who is responsible

The operator of Bull and Bear, [legal name, address], decides how your personal data is used (a "data fiduciary" under India's DPDP Act and an "APP entity" or "controller" elsewhere). Contact and grievance officer: [name], info@bullandbear.markets.

2. What we collect

Account: email address, username, a salted hash of your password (never the password), plan, account status, sign-up time, last sign-in time, and the version of the terms you accepted.
If you sign in with Google, Microsoft or Facebook: we receive your email address, your name and that provider's user id. We never see your password for that provider, and we only use the sign-in to identify you.
What you save: watchlist, real and play-money holdings (symbol, quantity, price, date), notes, saved scans, alerts and settings. Real holdings are optional: only enter what you are comfortable storing.
What you ask: questions you type to the Bull, the Bear or other AI features, and the answers.
Technical: your network (IP) address, browser type, and basic request records, used for security, rate limiting and fixing faults.

We do not collect your bank, card, broker login or government ID details, and you should never type them into the service.

3. Why we use it

To create and run your account and show you your own data (contract and your consent).
To keep the service secure, limit abuse and enforce limits and plans (legitimate use and legal obligation).
To answer your questions and improve accuracy, for example by checking the AI's answers against our own data.
To contact you about your account, security or important changes. We will not send marketing emails unless you ask for them.

4. AI features

When you ask the Bull, the Bear or the referee, or use plain-English scans, we send your question and the relevant figures about the stock or market to an AI provider (currently Google, through its Gemini service) to produce the answer. Do not put personal or confidential information in questions. We do not send your holdings or notes unless you ask a question about them, and then only what that question needs. The provider processes the request under its own terms and privacy policy, which may involve processing outside India and Australia.

5. Who we share it with

We do not sell your data and we do not share it for advertising. We use service providers who process data on our behalf: cloud hosting (Google Cloud), network and security (Cloudflare), and the AI provider above. Account administrators can view your saved data to give support and prevent abuse. We may disclose information if the law requires it or to protect people and the service. If the business is sold or restructured, your data may transfer to the new operator under the same commitments.

6. Where it is stored

Your account data is stored on a server in Mumbai, India. Our operators, and our providers, may access it from other countries, including Australia. We take steps to make sure it is protected wherever it is handled.

7. How long we keep it

Account and saved data: until you delete your account (under Account), then removed from the live system immediately.
Backups: daily snapshots are kept for seven days, so deleted data disappears from backups within about a week.
Security and request records: kept briefly (typically up to 30 days) unless needed to investigate abuse.
We may keep limited records longer where the law requires.

8. Cookies and local storage

One essential cookie keeps you signed in. It is HttpOnly and expires after seven days. Your browser also stores small preferences on your device (theme, last region shown, recent searches, whether you dismissed the welcome card). We do not use analytics, advertising or tracking cookies.

9. Security

Passwords are stored only as salted PBKDF2 hashes. Traffic is encrypted in transit. The server has no open inbound web ports, applies rate limits and sign-in lockouts, and takes daily backups. No system is perfectly secure: use a strong password that you do not reuse. If we discover a breach affecting your data we will tell you and the relevant authority as the law requires.

10. Your rights

You can ask to access, correct, export or delete your data, to withdraw consent, and to complain. You can delete your account and data yourself under Account, and change your password there. For anything else, contact the address above. If you are in India you can also nominate someone to exercise your rights and complain to the Data Protection Board of India after contacting us first. If you are in Australia you can complain to the Office of the Australian Information Commissioner. If the GDPR applies you can complain to your local supervisory authority.

11. Children

The service is for people aged 18 and over. We do not knowingly collect data from children. If you think a child has signed up, contact us and we will delete the account.

12. Changes and contact

We will update this policy as the service changes and show the date at the top. We will tell you about material changes in the service or by email. Contact and grievance officer: [name], info@bullandbear.markets.