Privacy Policy
This policy explains what personal data Bourse collects, why, who processes it for us and what you can do about it. We wrote it to be read, not to hide things.
Who is responsible for your data
Bourse (the website bourse.pl, the Android app and the Windows app) is run by Oleg Fylypczuk, a private individual based in Poland. He is the controller of your personal data under the GDPR. Contact for anything related to your data: bourse.official@gmail.com.
Postal address: available on request by email.
The short version
- We collect your email address and the things you choose to save in Bourse.
- We do not show ads, sell data or use analytics or advertising cookies.
- Your personal data is never sent to the AI model that writes summaries.
- You can download all your data or delete your account in Settings at any time.
What we collect and why
Account. Email address, password (stored only as a secure hash by our authentication provider), account creation date, sign-in times and the IP address used for sign-in. Why: to create your account and keep it secure. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in security (Art. 6(1)(f)).
What you save. Watchlist, simulated portfolio and savings goal, time capsules, trading journal, net worth items and liabilities, bond lots, price alerts, politician alerts, Investor Hub transactions you import from your broker's file, stress tests, and your country, language and topic preferences. Why: these features only work if we store what you enter. Legal basis: performance of the contract. We do not use this data for advertising or profiling.
Subscription. Plan status, and either a Stripe customer ID (web) or the Google Play purchase status reported by RevenueCat (Android). We never see or store your full card number. Legal basis: performance of the contract, and our legal obligation to keep accounting records (Art. 6(1)(c)).
Notifications. A push notification token, only if you turn notifications on. Legal basis: your consent, which you can withdraw in Settings at any time.
Messages. If you email us, we keep the conversation to answer you. Legal basis: legitimate interest.
Server logs. Our hosting providers record standard technical data such as IP address, browser type and time of request, to keep the service secure and to fix errors. Legal basis: legitimate interest.
Stored only on your device. Theme, language, your cookie choice, tool settings and, on Android, a counter that decides when to ask for a review. This never leaves your device.
What we do not do
- No advertising, no ad networks, no selling or renting of personal data.
- No analytics or advertising cookies and no tracking across other websites.
- No automated decisions that have legal or similarly significant effects on you (Art. 22 GDPR).
AI features
The Daily Brief, news summaries and sentiment labels, ESPI summaries and Copilot notes are written by an AI model (Google Gemini) from public news articles and public filings. Only that public text is sent to the model, never your account data or anything you save. AI-written content is marked in the app and can contain mistakes.
Who processes data for us
We use a small number of providers. Each one processes data only to provide its service to us, under a contract that includes data protection terms:
- Supabase: database, sign-in and server functions. Servers in London, United Kingdom.
- Vercel: hosting of the website bourse.pl.
- Stripe: card payments on the web (Stripe Payments Europe, Ireland).
- Google: Google Play billing, Firebase Cloud Messaging for Android notifications, and the Gemini API (public text only).
- RevenueCat: subscription status for the Android app.
- Expo: delivery of push notifications.
Where data is transferred outside the European Economic Area, the transfer is based on an adequacy decision (for example for the United Kingdom, or for US companies certified under the EU-US Data Privacy Framework) or on Standard Contractual Clauses offered by the provider.
Requests your device makes to other websites
Some content is loaded directly from other servers: news thumbnails come from the publisher's server, and in the Android app some price charts are loaded directly from Yahoo Finance. Opening an article takes you to the publisher's website. These parties see your IP address, as any website you visit would, and their own privacy policies apply.
How long we keep data
- Account and saved data: for as long as your account exists. After you delete your account it is removed immediately from the live database and from backups within 30 days.
- Payment and invoice records: 5 years from the end of the year of payment, because Polish tax law requires it.
- Server logs: a short period, normally no longer than 30 days.
- Emails: up to 2 years after the conversation ends.
Your rights
You have the right to access, correct, delete, restrict and port your data, to object to processing based on legitimate interest, and to withdraw consent at any time. In the app: Settings, Download my data, and Settings, Delete account. For anything else, email us. We answer within one month.
You can also lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl, or with the supervisory authority in your country.
Age
Bourse is for people aged 16 and over. We do not knowingly collect data from younger children. If you think a child under 16 has created an account, write to us and we will delete it.
Security
All connections use HTTPS. Passwords are hashed. Every database table is protected by row-level security, so each account can only read its own data. Access to production systems is limited to the operator.
Changes
If we change this policy in a way that matters, we will tell you in the app or by email before the change applies. The date at the top shows the current version.