Privacy policy

1. Who we are and information we process

HowBullish is an AI tool for interpreting information about stocks. This policy explains how HowBullish ("we", "us" and "our") handles personal data when you use our website and browser extension.

HowBullish uses Supabase for email and Google authentication. When you start an analysis, pasted source text is sent through our server to OpenRouter and its selected model providers, and analysis results and usage records are stored in Supabase for your account. New analyses use OpenRouter with data collection disabled, restricting requests to providers that do not collect submitted data for training. Hosting and external image providers may receive technical request information such as IP addresses when you load pages or video thumbnails.

The service processes account details, the source text, links, titles and captions you submit for analysis, analysis results, service usage and support messages. HowBullish is free. Paddle retains information about previous payments; HowBullish receives historical customer, transaction and subscription records rather than full card details. Document and recording uploads are not enabled.

2. Why we use information

We use information to authenticate accounts and analyze requested sources, return results, maintain previous billing records, provide support, prevent abuse and meet legal obligations. Where applicable, the legal bases are performance of a contract, legitimate interests in operating and securing the service, legal obligations, and consent for optional processing. Legitimate interests must be balanced against your rights.

Do not submit sensitive personal data or confidential information unless you are authorized to do so. We do not sell submitted content or use it to train general-purpose AI models. Previous analyses may have been processed through the former Contributor model, whose provider allowed training use. Provider retention practices may vary; our routing restriction applies to new requests.

The optional Chrome extension adds analysis controls to YouTube and X pages. It reads page structure and post links locally to place those controls; it does not collect browsing history. A source is submitted to HowBullish when you request analysis through Show signals, Analyze, the toolbar, or a selected-text action. On ordinary web pages, the toolbar extracts readable page text locally and submits it with the page title and URL. When you connect your account, a separate extension session is created. Access and rotating refresh credentials are stored locally in trusted extension storage, inaccessible to page content scripts, so your connection can survive browser restarts and extension updates. Recent analysis results remain in temporary session storage. You can disconnect in extension Settings to clear local credentials and request revocation of the extension session; uninstalling clears local extension data. Analysis is free and is saved to your account history. Selected text sent to the website is transferred in a URL fragment, cleared after import, and may be stored locally for up to 30 minutes during sign-in.

3. Service providers, cookies and international processing

HowBullish’s use and transfer of information received through the extension adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements. We process requested source content only to provide and maintain the analysis features described here, and do not use it for advertising, data brokering or general-purpose model training.

Cloudflare hosts the website and analysis processing. Supabase provides authentication and account-owned analysis records; our current database is hosted in the United States (US East). OpenRouter and its selected model providers process text submitted for analysis. These providers may process data outside your country. Video captions are read locally by the browser extension on the source page. Cloud caption retrieval and audio transcription are disabled. Captions selected for analysis are sent to HowBullish and OpenRouter and its selected model providers to generate the results. Caption URLs and page cookies are not sent to a transcription provider.

Paddle processes purchases. Its separate Privacy Notice explains its payment-related processing. If you choose Google sign-in, Google shares your basic profile, email address and account identifier with our authentication service. We request no access to your Gmail messages, Google Drive files or contacts. Resend delivers authentication emails and processes the recipient address, sign-in email content and delivery information. Sign-in links are sensitive and should not be shared.

Optional browser usage analytics are currently disabled. We do not enable session recordings or send submitted text, transcripts, source URLs, sign-in links, or email addresses to PostHog. Separately, we retain operational records of analysis and import status, duration, model token usage, and calculated service cost to operate and improve reliability. Minimal operational metrics use pseudonymous account identifiers and are summarized in PostHog. Calculated costs are distinct from invoice charges. Previously saved analytics preferences do not enable tracking while browser analytics are disabled. Authentication sessions and pending drafts use necessary browser storage; pending drafts expire after 30 minutes.

4. Retention and security

Analysis results and usage records are retained for your account. To run and diagnose analyses, our application also stores source inputs and model call traces, including full request and response bodies. These can contain the complete submitted text, source metadata, prompts and generated results. These diagnostic records currently have no automatic expiry. Historical import records, including URLs and full transcripts, may also remain even though new cloud imports are disabled. Contact admin@howbullish.com to request access or deletion, including associated diagnostic and historical import records. Provider logs and backups follow their own retention practices. Billing records may need to be retained to satisfy legal obligations.

We use account access controls and server-only access for diagnostic records. No online system can guarantee absolute security. Deleting an account may not remove records that must be retained by law; any such exceptions will be explained.

5. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete or obtain a copy of personal data, restrict or object to processing, withdraw consent and complain to a competent data protection authority. We may need to verify your identity before fulfilling a request.

The service is intended for adults aged 18 or over. If you believe a child has provided personal data, contact us so that the matter can be investigated. Send privacy requests to the contact below.

6. Contact and changes

HowBullish
Privacy email: admin@howbullish.com

We will update this policy when the service or data practices change, and provide additional notice for material changes where required.