Privacy Policy
Your privacy matters. This policy explains what data we collect, how we use it, and your choices.
1. Who we are
Invest & Educate (the "Service", "we", "us") is an educational investing platform accessible at https://bullseyeapp.org. We provide real-time stock market data, mutual fund information, and curated investing lessons. The Service is intended solely for informational and educational purposes and does not constitute investment advice.
2. Information we collect
We keep data collection minimal. The types of information we may collect include:
- Account information (only if you sign in): your Google-provided email, name, and profile picture.
- Portfolio data: stock holdings you add to your portfolio (symbol, quantity, average price). Stored only against your logged-in user ID.
- Watchlist: stock symbols you save, stored locally on your device.
- Session cookies: to keep you signed in for 7 days across visits.
- Analytics: anonymised usage data (page views, feature interactions) via PostHog to improve the product.
- Server logs: standard request logs (IP, user-agent, timestamp) retained for 30 days for security & abuse prevention.
3. How we use your data
- To provide the core Service (dashboards, portfolio tracking, personalised watchlists).
- To authenticate you and keep your session secure.
- To fix bugs, monitor performance, and improve features.
- To send critical service messages (e.g. security alerts). We do not send marketing emails.
4. Third-party services we use
- Google Sign-In — for authentication. Governed by Google's privacy policy.
- Yahoo Finance — public market data feed. No personal data shared.
- AMFI India / mfapi.in — mutual fund NAV data. No personal data shared.
- Economic Times, Mint, Moneycontrol RSS — news headlines only.
- PostHog — anonymised analytics. See PostHog privacy.
- MongoDB Atlas — encrypted database hosting.
5. Data storage & security
All data is stored on encrypted MongoDB Atlas servers. Session tokens are HTTP-only cookies signed with Secure and SameSite=None flags over HTTPS. We use bcrypt for hashing where applicable and never store third-party OAuth tokens on our servers.
6. Your rights
You can, at any time:
- Access or export your portfolio data — email us at the address below.
- Delete your account and all associated data — email us with your registered address.
- Sign out — removes the local session cookie and disables server-side session.
- Opt out of analytics — enable "Do Not Track" in your browser; we honour it.
7. Children
The Service is not directed to children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child has provided us information, please contact us and we will delete it.
8. Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be highlighted on the site.
9. Contact us
Questions or requests regarding this Privacy Policy or your data?
Email: privacy@bullseyeapp.org