Privacy Policy
Effective 25 August 2026 · Last updated 25 August 2026
Social Bull is a stock market simulator run by one person. This policy says exactly what it collects, where that goes, and how to get rid of it. It is written to be read, not to be survived.
On this page
1. Who runs this
Social Bull is built and operated by one individual in the United States. It is not a company — there is no corporation or LLC behind it — and "Social Bull" is a product name rather than a legal entity. When this policy says we, it means that one person.
It is not a broker, a dealer, an investment adviser, or a financial institution, and it does not hold anybody's money.
2. What is collected
Your account
- Email address and username
- Display name, and first and last name if you choose to add them
- Your password, stored only as a cryptographic hash — the password itself is never written down and cannot be read back, by us or by anybody else
- The date the account was created
- If you arrived through a tagged link such as
?from=reddit, that tag; and if somebody invited you, which account it was
Everything you do in the simulator
The whole of your simulator state is stored on our server so it follows you between devices. That is what makes signing in on a phone and a laptop work. It includes:
- Every portfolio, every position, every order and your full trade history
- Your trade journal — entries, notes, tags and win rates
- Watchlists, screener filters, saved screens and display preferences
- Your personal finance entries: net worth, budgets, and bills with their due dates
- Social Bull University progress and any certificates
All of the trading is simulated. The positions are not real holdings and no securities are ever bought or sold.
What you post and send
- Posts, comments, reactions, questions and snapshots on the feed
- Direct messages and group chat messages, and who they were to
- Friend requests and friendships
- Photos and videos you upload, including profile pictures and their history
- Your published profile card — the bio, picture and whichever portfolio figures you switched on for other people to see
Direct messages are not end-to-end encrypted
They are stored on the server in a form the operator could read. They are not read as a matter of course, and there is no process that goes through them — but the honest statement is that the technical ability exists, and you should treat a DM here as you would an email rather than as a private channel.
How the app gets used
- One record per day that you opened the app — the day, not the times
- Named events for features being used, such as opening the screener or setting a tag. These are feature names and a date. There is no page-by-page trail, no session recording, and no third-party analytics service involved.
When you report a problem
The Report a Problem button sends what you typed, plus which screen you were on, the app build, your screen size and your browser and operating system. That context is attached automatically so you do not have to describe it.
If you answer the survey
The optional survey asks whether you invest with real money, which broker you use, roughly how much you have invested, roughly how much you would fund a real account with, and what would stop you. Answers are stored against your account. They are used to understand who the product is for, and are reported publicly only as totals across everyone.
This is the most sensitive thing here
Money bands and a broker name attached to an identity are worth more to somebody than a simulated portfolio is. If you would rather not have that stored, skip the survey — it is optional and nothing in the app is withheld for skipping it. If you already answered and want it removed, ask, or delete your account, which removes it.
Signing in
A session token is created when you sign in and stored on our side in Cloudflare Workers KV. Your browser holds the matching cookie. Sessions last 30 days.
3. What is not collected
- No payment details. Nothing is charged, so no card, bank account or billing address is ever collected.
- No advertising or tracking SDKs. There is no Google Analytics, no Meta pixel, no advertising network, and no cross-site tracking. Nothing about you is sold, rented or shared for advertising, and there are no ads.
- No location data. The app does not ask for or use GPS or precise location.
- No contacts, camera roll or microphone access beyond a file you deliberately choose to upload.
- No real brokerage account. There is no connection to any broker and no real trading of any kind.
4. Why each thing is held
| What | Why it exists |
|---|---|
| Email and password hash | To let you sign in, and to reset a password you have lost |
| Simulator state | So your portfolio is the same on every device and survives a reinstall |
| Posts, comments, messages | To show them to the people you meant to show them to |
| Photos and video | To display them where you attached them |
| Day-level activity and feature events | To see which parts of the app are actually used, and which are not worth keeping |
| Bug reports | To reproduce and fix what broke |
| Survey answers | To understand who the product is for |
| Referral and channel tags | To know which places people arrive from |
5. Cookies and local storage
There is one cookie. It holds your session so you stay signed in. It is httpOnly, meaning page scripts cannot read it, and it is sent only over HTTPS. It is not used for tracking and there is no advertising cookie, which is why you are not asked to click through a consent banner.
The app also keeps things in your browser's local storage, all under keys beginning nv_: display preferences, saved screener setups, trade journal notes and a local copy of your portfolio so the app works while a connection is poor. That data sits in your browser, not on the server. Deleting your account clears those keys in the browser you delete from; clearing site data in your browser settings clears them anywhere.
6. Companies that process it
Social Bull runs on other companies' infrastructure. These are the only ones that handle your data on our behalf, and each is bound by its own contract and policy.
| Who | What they handle |
|---|---|
| Cloudflare | Effectively all of it — the application server, the database, session storage, uploaded photos, and video hosting |
| Netlify | Serves the website and the app to your browser; sees the requests that reaches it |
| Resend | Sends transactional email, which today means password reset messages. Receives your email address. |
| Powers the research assistant. See the next section — it deserves its own. | |
| Plaid | Bank linking. See section 9 — it is not live. |
Nobody on this list is paid to receive your data for their own purposes, and none of it is sold.
7. The research assistant
Read this one before you use it
The research assistant is powered by Google's Gemini API on its free tier. Google's terms for the free tier are materially different from the paid one: Google may have human reviewers read what is sent, and may use it to improve their models. The paid tier's guarantee against that does not apply here.
What gets sent is your question plus the context the app attaches to it, and that context can include the contents of your portfolio — which is the point of being able to ask "how am I doing?".
Today those positions are simulated, so what leaves is a made-up portfolio. That is the only reason this is a reasonable trade to be making. Even so: do not type anything into the assistant that you would not want a stranger at Google to read.
The assistant is entirely optional. Nothing else in the app sends anything to Google.
8. Sites your browser contacts directly
Market data does not all come through our server. For a lot of it, your browser fetches directly from the source. That means those companies see your IP address and what you looked up — which tickers, which filings, which charts. They are not acting for us, we have no contract with them covering you, and their own privacy policies apply rather than this one.
They include: Yahoo Finance, Finviz, TwelveData, Finnhub, ScraperAPI, Nasdaq, the SEC's EDGAR service, the St. Louis Fed (FRED), the U.S. Energy Information Administration, Google News, Wikipedia, TradingView, Seeking Alpha, and YouTube for embedded video (loaded in no-cookie mode).
Public proxies, stated plainly
When a data source refuses a direct request from a browser, the app falls back to routing that one request through a public CORS proxy — currently corsproxy.io, api.allorigins.win or api.codetabs.com. A request routed that way is visible to whoever operates that proxy.
These requests carry market data lookups — a ticker symbol and a date range. They do not carry your session cookie, your password, your portfolio, or anything that identifies your account. The operator of a proxy could still see your IP address and the symbol you asked about.
9. Bank linking
The personal finance section can show real account balances through Plaid. This is not switched on. It currently runs against Plaid's test environment, which means no real bank can be connected, no real credentials are involved, and no real balances exist to be stored.
If and when it does go live, bank login details would go directly to Plaid and never to us. We would receive balances, and for credit accounts the interest rate, minimum payment and due date, so the balance sheet has something to show. This section will be rewritten before that happens, and it will not happen silently.
10. Deleting your account
You can delete your account yourself, from your profile page in the app. It asks you to type your username, and then it happens immediately and permanently. There is no grace period and no recovery.
Destroyed on the spot
- Your email address, username, name and password hash
- Every session, on every device you are signed in on
- Your entire simulator state — portfolios, positions, orders, trade history, journal and notes
- Personal finance: net worth, budgets, bills and any linked bank record
- Your published profile card, so the profile becomes unreachable
- Every photo and video you uploaded, both the records and the stored files
- Your survey answers and any problem reports you sent
- Your friendships, reactions, University progress and certificates
- Usage records that mention you
- The copy held in the browser you delete from
Kept, with your name taken off
Posts, comments and messages you sent stay where they are, attributed to [deleted] rather than to you. They are not linked to your account, your identity, or anything else about you — the account they point at holds no profile, no data and no way to sign in.
This is a deliberate choice and worth explaining. Those items sit inside other people's threads and inboxes. Erasing them would delete one side of conversations belonging to people who never asked to lose them, and would tear holes in discussions others are still reading. So the connection to you is destroyed and the words remain.
If you want something you posted removed as well, delete the individual posts and messages before deleting your account — while you still have the controls to do it.
11. How long things are kept
While your account exists, your data is kept so the product works. There is no automatic expiry.
When you delete, the live database is cleared straight away, as described above.
Backups. Copies of the database are taken so a failure does not destroy everyone's work. A backup taken before you deleted your account will still contain it until that backup is replaced or destroyed. Backups are not used to restore individual accounts and are not consulted in ordinary operation — they exist for disaster recovery.
Aggregate figures that mention nobody — how many people used a feature in a month — are kept after individual records are gone.
12. Your rights
Depending on where you live, you may have legal rights over your data. Rather than list which laws apply to whom, here is what you can have, offered to everybody:
- See it. Ask, and you will be told what is held about you.
- Get a copy. Ask, and you will get your data in a machine-readable file.
- Correct it. Most of it is editable in the app. Ask for anything that is not.
- Delete it. Use the button in the app, or ask.
- Object or complain. Say so, and it will be dealt with rather than filed.
Requests are answered as quickly as one person can, and within 30 days. There is no charge. You will never be treated differently for making a request — nothing is withheld and no feature is degraded.
If you are in the EU or UK: the lawful bases relied on are performance of a contract, for everything needed to run your account; consent, for the optional survey and the research assistant; and legitimate interests, for basic usage counts and security. You may withdraw consent at any time, and you may complain to your national data protection authority.
If you are in California: the categories collected, and why, are listed in sections 2 and 4. Personal information is not sold or shared for cross-context behavioural advertising, and it never has been.
13. Security
- Everything travels over HTTPS.
- Passwords are stored only as hashes and cannot be recovered, only reset.
- New passwords are checked against known public breach lists, in a way that never sends your password anywhere — only a short fragment of its hash leaves the server.
- The session cookie cannot be read by page scripts, which blunts the most common way sessions get stolen.
- Private data is checked against your session on every request rather than hidden in the interface.
An honest closing note: this is a beta, built by one person, and no system is perfectly secure. Do not reuse a password here that protects anything else, and do not store anything in the app that would genuinely hurt you if it got out. If something does go wrong in a way that affects you, you will be told what happened rather than left to find out.
14. Age
Social Bull is for people 18 and over. It is not directed at children, and accounts are not knowingly created for anyone under 18. If you believe someone under 18 has an account, get in touch and it will be removed.
15. Changes
This policy will change as the product does — the bank linking section and the research assistant section in particular. The date at the top always says when it last changed. If a change materially affects what is collected or who receives it, you will be told in the app rather than left to notice.
16. Contact
For anything in this policy — a question, a request for your data, a complaint — use the Report a Problem button in the app menu, or email support@socialbulltrades.com.
It is one person reading them, so plain language gets a faster answer than legal language does.