Privacy

Without an account

Nothing about you leaves your device. Your watchlist, your portfolio and your light or dark choice are kept in your own browser. Files you import into the portfolio are read in your browser and never uploaded.

If you turn on alerts

Alerts need our server to know what to check and where to send. For each device that turns one on, we keep a random id the device made, stored only in a scrambled form (a hash), when the device first turned alerts on, and the push subscription your browser gives us. For each rule we keep the scrip, the kind of alert, and the price for the kinds that have one. For a price we also keep the time you set it, as your device sent it and as we corrected it for your device’s clock, and the day the rule first reached us. We keep the day the rule last alerted, the note we show while it is paused, and the last day we could not check it. For an alert on a saved screen, we keep the name you gave the screen and its conditions. If you turn on the digest, we keep the symbols of the scrips you hold and watch, without how many you hold or what you paid, and remove them as soon as you turn it off. The digest also notes which My Day warnings you turned off, so it leaves them out too. We also keep the day we last sent that device an alert. Never your quantities, costs, portfolio names or watchlist names, and no account is needed. On the alerts page, “Delete my alerts from the server” removes all of it at once.

With an account

We keep your email address, your name if Google gives us one, an id Google uses for your account, when you joined and last signed in, your watchlist and, only if you turn it on, your portfolio. We keep them so you can sign in and see the same watchlist and portfolio on every device. No password, no photo, no contacts.

A small cookie keeps you signed in for up to 30 days after your last visit. Another stops other websites from acting in your name. There are no advertising or tracking cookies.

Your portfolio

Signing in does not send your portfolio anywhere. It stays in your browser only, until you choose “Keep my portfolio in my account” on the portfolio page.

If you turn that on, we keep a copy of your portfolio with your account, so the same one shows on each device you sign in on: the names of your portfolios, every transaction you saved (scrip, date, type, quantity, price, fees and tax), your stops and targets, and the suggestions you turned down. The files you import are still read in your browser; only the transactions you save from them are kept. Turn it off at any time on the portfolio page, and choose whether to delete the copy in your account too. Your browser keeps its own copy either way.

Where it is kept

On our own server. A copy is backed up every night, locked with a key only we hold, to Cloudflare’s storage. Sign-in emails are sent through Zoho Mail. If you sign in with Google, Google knows you signed in to Bull Yatra.

Download or delete it

On your account page you can download everything we hold about you, including any portfolio kept in your account, or delete your account, which deletes that portfolio copy too. Deleting asks you to have signed in within the last few minutes, so a phone left unlocked cannot wipe your account. The account is deleted seven days after you ask, and we email you when you do; signing in before then cancels it. Nightly backups taken before that still hold a copy for up to 30 days, after which they expire.

Questions

Write to info@bullyatra.com.