This policy explains what The Bull Rankings ("we", "us") collects when you use The Bull Rankings, why, where it is stored, who else processes it, and the choices you have. It applies to the website and its APIs.
1. Information we collect
If you create an account:
- Email address — for sign-in, email verification, and account recovery.
- Password — stored only as a salted bcrypt hash. We never store or log your plaintext password.
- Display name — optional, shown only to you.
- Watchlist and search history — the tickers you save or look up, so they follow you across devices.
If you subscribe to the weekly digest:
- Email address — submitted through the digest sign-up form and used to send the weekly email. You can unsubscribe from the link in any issue, which removes the address.
Collected automatically when you use the site:
- Security and abuse-prevention data — IP address and browser user-agent, used transiently for rate limiting and recorded in a security audit log of authentication events (sign-up, sign-in, failed attempts). Failed-login counts and temporary lockouts are kept on your account record.
- Analytics — aggregate, cookieless usage measurements (page views, referrers, performance timings) via Vercel Analytics. These do not identify you individually.
2. Cookies and local storage
- Session cookie (essential) — a single signed,
HttpOnlycookie that keeps you signed in. It carries only an opaque account identifier. Required for the site to function; not used for tracking. - Browser local storage — your recent searches and a copy of your watchlist are cached in your own browser for a faster experience. This never leaves your device except as described above for signed-in accounts.
- Advertising cookies — display advertising (Google AdSense) is enabled on this site. Google and its partners may set cookies or read device identifiers to serve and measure ads, including personalized ads where permitted. That activity is governed by Google's own policies; see Section 4 and the opt-out links there.
Our own analytics is cookieless and needs no consent. Advertising cookies are set by Google rather than by us. You can turn off ad personalisation in your Google Ad Settings, and opt out of third-party advertising cookies at aboutads.info or youronlinechoices.eu.
3. How we use your information
- To operate core features — accounts, watchlists, and search.
- To secure the service — rate limiting, lockouts, and abuse detection.
- To send transactional email — verification and password-reset messages.
- To send the weekly digest, if you have asked for it. This is the only non-transactional email we send, it goes only to addresses submitted through the sign-up form, and every issue carries a one-click unsubscribe link. We do not sell or share the list, and we send nothing else to it.
- To understand aggregate usage and improve the product.
We do not sell your personal data.
4. Where your data is stored and who processes it
We rely on the following providers, each acting as a processor or independent controller for the data noted:
- Vercel — website hosting and cookieless analytics.
- Neon — the PostgreSQL database holding account, watchlist, search records.
- Resend — delivery of verification, password-reset, and weekly-digest emails (receives your email address).
- Google AdSense — display advertising, currently enabled (an independent controller for ad-targeting data).
- Yahoo Finance and Finnhub — market-data sources. They receive ticker symbols only — never your personal information.
- Groq and Google (Gemini) — generate the written stock commentary. They receive ticker symbols and public company fundamentals only — never your personal information.
5. Data retention
- Account data — kept while your account is active. On deletion it is removed from the live database; routine encrypted backups may persist for up to 30 days.
- Security audit log — authentication events are retained for up to 90 days, then discarded.
- Single-use tokens — email-verification and password-reset tokens are stored only as hashes and expire shortly after issuance.
6. Your rights and choices
- Access — request a copy of the data associated with your account by emailing us.
- Deletion — delete your account, which removes your account data as described in Section 5.
- Correction — update your display name and watchlist at any time from your account.
- EU/UK residents — you have rights under the GDPR/UK GDPR, including access, rectification, erasure, restriction, portability, and objection. Our legal bases are contract (operating your account), legitimate interests (securing the service), and consent where required.
- California residents — you have rights under the CCPA/CPRA, including to know, delete, and correct your personal information, and to opt out of any "sale" or "sharing." We do not sell personal data. Because display advertising is enabled, ad personalisation may be treated as "sharing" under the CPRA; you can opt out using the Google Ad Settings and industry opt-out links in Section 2, or by emailing us.
To exercise any of these rights, contact us at the address in Section 10.
7. Security
Passwords are bcrypt-hashed; session cookies are signed, HttpOnly, and scoped with the __Host- prefix in production; verification and reset tokens are stored only as hashes; the site sends a strict Content-Security-Policy and other hardening headers; and access is rate-limited. No system is perfectly secure, but we apply current best practices.
8. International transfers
Our providers may process data in the United States and other countries. Where required, transfers rely on appropriate safeguards such as Standard Contractual Clauses.
9. Children
The site is intended for adults and is not directed to anyone under 18. We do not knowingly collect data from minors; if you believe a minor has provided us data, contact us and we will delete it.
10. Contact
Privacy questions or requests: Bullrankings@gmail.com.
11. Changes to this policy
We may update this policy as the service evolves. Material changes will be reflected in the "Effective" date above, and — where the law requires — communicated to signed-in users.
This policy is provided for transparency and is not legal advice.