Privacy Policy

Capitalized terms used but not defined in this Privacy Policy — including "Service" — have the meaning given in our Terms of Use.

01Who we are & scope

Pocket Atelier LLC ("bipsai," "we," "us"), 5900 Balcones Drive, Ste 100, Austin, TX 78731, USA, operates the bipsai mobile application (iOS and Android) and the bipsai website (bipsai.app). For individuals in the European Economic Area and the United Kingdom, Pocket Atelier LLC is the data controller responsible for the processing of personal data described in this Privacy Policy. This Privacy Policy explains what information we collect when you use these services, how we use it, and your choices. Where a specific processing activity requires consent, we request it separately rather than treating use of the Service as consent to this policy.

Pocket Atelier LLC has appointed Data Protection Representative Limited (trading as DataRep) as its representative in the European Economic Area and the United Kingdom under Article 27 of the EU GDPR and the UK GDPR. Contact details are in §12.

02Information we collect

Account information

When you create an account, we collect the identifier provided by your sign-in method: an email address (via a one-time sign-in code or single sign-on) or a tokenized identifier from a third-party sign-in provider, plus the display name you set during onboarding. We do not store passwords. We do not collect brokerage credentials, financial-account data, holdings, or transaction history.

In-app data

• Watchlists, alerts, and preferences — the tickers you track, alert rules you create, notification channels you enable, morning-briefing delivery choices, and other in-app settings you configure. For a push alert that fires, we also keep its delivery state and the delivery service's ticket or receipt outcome so we can retry failures and show whether the push was accepted.
• In-app activity — a timestamped record of the analyses you open, associated with your account to enforce your plan's monthly analyses quota (measured per billing cycle). For accounts without a subscription, we also record the single ticker you choose for your one-time sample analysis. This activity record is held against your account (it is not the anonymous website analytics described in §03) and is deleted when you delete your account.
• Subscription status — your current plan tier (Standard, Pro, or Premium). To verify and sync your subscription, we share a pseudonymous internal account identifier (not your name or email) with a third-party subscription-management provider. That provider processes, on our behalf, transaction metadata (purchase timestamp, product identifier, renewal status), basic device characteristics (device type and OS version), and the country or region of purchase (derived from your IP address or app-store locale) to validate purchases, prevent fraud, and show the correct local currency.
• Legal acknowledgment — when you continue from the sign-in screen, we record the versions of the Terms of Use and Privacy Policy shown there and the time you agreed to the Terms and acknowledged the Privacy Policy.
• Push notifications — if you grant notification permission, we link the push token issued to your device to the account currently signed in so we can deliver notifications you choose. Alert notifications can include the ticker symbol and alert details (for example, "AAPL rose above $200"). Premium morning-briefing notifications contain a count summary of available movers, news stories, filings, and earnings reports on your watchlist. These notifications pass through a third-party push-notification delivery service and the Apple or Google push systems to reach your device. We remove that account-token link when you sign out.
• Support correspondence — if you contact us (for example, by email), we collect your message and the email address you write from, to handle your request.
• Crash and performance diagnostics — production builds use a diagnostic provider to receive error messages, stack traces, app version, device type, OS version, technical breadcrumbs, and low-cardinality timing measurements for the analysis transport (for example, time to the first response section). We disable performance tracing and the provider's default collection of personally identifying information; timing attributes do not include ticker symbols, search text, or account identifiers.

Information required to provide the Service

An email address or tokenized sign-in identifier is required to create and access an account. If you do not provide it, we cannot authenticate you or provide account features. Subscription information is required only when you use paid features. Push permission and a push token are optional; without them, you will not receive push notifications. Support correspondence and website analytics information are not required to use the mobile app.

What we do not collect

We do not collect brokerage credentials, portfolio holdings, order history, or any data from financial accounts. bipsai is a read-only research tool; it does not connect to or interact with any brokerage.

03Analytics

Our website uses a privacy-focused, cookieless, self-hosted analytics tool. It records the pages you view, the referring site, and technical metadata about the visit — browser, operating system, device type, screen size, language, and the approximate country or region derived from your IP address. The tool does not store IP addresses; visitors are counted using a rotating salted hash, so it does not identify individual visitors. It does not set tracking cookies, does not build advertising profiles, and does not share data with third parties for advertising. No cross-site tracking takes place. This website analytics is separate from the account-linked in-app activity record described in §02.

04Operational telemetry

Our backend records request metadata (HTTP method, endpoint, status code, latency), application log events, and cost and observability metrics for reliability monitoring and abuse prevention. Production app builds also send the crash and performance diagnostics described in §02 to our diagnostic provider. We do not log request content. These records may include account or session identifiers, correlation identifiers, the ticker symbols involved in your requests, and timestamps. Our application logs do not record your IP address.

We use your IP address for one narrow purpose: preventing abuse of sign-in. It is recorded with the one-time sign-in code you request, and used as a short-lived counter when you sign in through Apple or Google, so that a single source cannot flood sign-in requests against you or anyone else. Those records are deleted along with the sign-in records they belong to. Separately, our hosting and network provider necessarily handles your IP address at the network layer in order to route and protect traffic; that is inherent to delivering any service over the internet.

We retain operational records only for the applicable reliability, security, abuse-prevention, or accounting purpose.

05Account deletion & data retention

You may delete your bipsai account at any time — directly in the app (Settings → Delete Account), on the web at bipsai.app/delete-account, or by emailing support@bipsai.app. When you do, we verify the request using a single-use code sent to your account email and start a durable deletion process. New sessions are blocked immediately. The process revokes your Sign in with Apple authorization where applicable, deletes your subscription-management customer profile, and erases your account record (email address, display name, plan tier, and federated sign-in provider identifier), sessions, watchlists and their tickers, alerts, analysis-usage records, in-app preferences, push notification tokens, and push-delivery records. The app reports completion only after its required automated Apple-authorization, subscription-management, and internal erasure steps succeed. Copies of transactional emails and their delivery records held by our email provider are outside that automated workflow and are handled as described below.

The app store retains purchase records under its own control. We retain only the limited financial transaction facts and protected store references needed for bookkeeping, refunds, disputes, and legal obligations; the link to your bipsai account is removed. The subscription-management customer profile used for entitlement checks is deleted as part of the deletion process.

A narrow set of records survives without a direct account link: financial and AI-cost facts needed for company accounting; identifier-scrubbed operational logs during their normal retention period; an account-deletion audit record; a restricted, keyed recovery marker used only to prevent deleted accounts from reappearing after a database recovery; and minimal legal-acceptance evidence used to document the agreement and handle disputes or legal claims. Financial and cost records may retain the ticker and transaction facts needed for those purposes, but their bipsai user attribution is removed. Linkable one-time-code, fair-use, session, and push records are deleted. None of the retained records is used to recreate your account or for advertising.

How long we keep data

• Account and profile data — until you delete your account.
• Legal-acceptance evidence — after account deletion, we retain only a keyed pseudonymous subject value, the Terms and Privacy Policy versions, the acceptance time, and deletion and expiry dates. We do not retain your email address, name, or bipsai account ID in this record. It is normally retained for six years after deletion solely to document the agreement, handle disputes, and establish, exercise, or defend legal claims, subject to a specific legal hold or a shorter period required by applicable law.
• Deleted watchlists — a watchlist you delete in the app remains restorable for seven days and is then permanently deleted. Deleting your account deletes all watchlists, including recently deleted ones, immediately.
• Analysis-usage records — bare timestamps of the analyses you open, kept to enforce your plan's monthly quota; automatically pruned once they age past the current monthly billing window (at most about 70 days), or immediately when you delete your account.
• Operational logs and completed push-delivery records — normally 30 days. Abuse-prevention records are normally 90 days. Account identifiers and other known user identifiers are scrubbed or deleted during deletion.
• Crash and performance diagnostics — retained according to the diagnostic provider's configured retention period and deleted or de-identified sooner where the provider and applicable law allow. We do not attach your bipsai account identifier to app diagnostic events.
• Support correspondence — kept only as long as needed to handle your request and for a reasonable record afterward.
• Transactional emails and delivery records — our email provider may retain the recipient address, message content, and delivery events under its service retention rules. Its public email API does not currently provide us with automated per-recipient erasure, so these provider copies are not removed by the in-app account-deletion workflow. To request provider-level access or erasure, email support@bipsai.app; where applicable, we instruct the provider and close the privacy-rights case only after receiving completion evidence or documenting a lawful retention exception.
• Financial and AI-cost records — normally seven years, subject to a specific legal hold or a shorter period required by applicable law. App stores retain their transaction records under their own policies. Our retained records are detached from your bipsai account as described above.
• Deletion evidence — an identity-detached audit record and restricted keyed recovery marker are normally retained for six years to prove and preserve the erasure.

06Data providers

The research content in bipsai — market data, fundamentals, movers, index levels, news, and earnings transcripts — is sourced from a third-party market-data provider. Some content is derived from public SEC filings, which are in the public domain. Displayed news direction and the 7-day News net are derived from third-party coverage and first-party company press releases. The latest earnings-call tone is shown separately and does not affect the news score. bipsai does not use social-media data for sentiment. These providers operate under their own privacy policies; bipsai does not control them.

07AI synthesis & processing

bipsai's research output — including the Bips Lens, bull and bear theses, news and sentiment summaries, filing summaries, Today's Lens, and the Weekly Market Theme — is generated using third-party large-language-model providers. For a ticker analysis, we send the instrument you requested and the public or licensed market information needed for that analysis. For shared, scheduled publications, we send candidate instruments and the public or licensed market information needed to select, generate, and validate the edition. We do not include your email address, account identifier, watchlist, or other directly identifying account data in model prompts. We access these providers under their commercial API terms and do not use your interactions for advertising. These providers may retain prompts and outputs briefly to detect and prevent abuse of their services.

08Payments

Subscriptions are purchased and billed directly through the app store from which you downloaded bipsai. bipsai does not process payments and does not receive your card number, billing address, or any other payment details. Manage or cancel your subscription in your app store account settings.

09How we share information

We do not sell or share your personal information, as those terms are defined under the California Consumer Privacy Act (CCPA/CPRA) — in particular, we do not share it for cross-context behavioral advertising. We share information only in these circumstances:

• Infrastructure & hosting — our cloud hosting, database, and storage provider processes data on our behalf under contract and is not permitted to use it for its own purposes.
• AI / synthesis providers — to generate ticker analyses and shared scheduled publications, we send the requested or candidate instruments and public or licensed market information, but no email address, account identifier, watchlist, or other directly identifying account data, to large-language-model providers, as described in §07.
• Authentication & email delivery — when you sign in by email, we send your email address to a transactional-email provider so it can deliver your one-time sign-in code. If you enable email delivery for an alert or the Premium morning briefing, that provider also receives your email address and the alert or briefing content, including the relevant ticker symbols, so it can deliver the message. Sign-in through a third-party identity provider is handled by that provider.
• Subscription management — we use a third-party subscription-management provider to process and verify your in-app purchases across platforms. We share a pseudonymous internal account token so it can validate your plan tier (Standard, Pro, or Premium); it processes transaction metadata, device characteristics, and country of purchase on our behalf. We never receive, store, or have access to your card details or billing address — those are handled exclusively by the app store.
• Push notifications — to deliver alerts and Premium morning briefings you enable, we send the notification content (including relevant ticker symbols when present) and your device's push token to a push-notification delivery service and the Apple or Google push systems.
• Crash and performance diagnostics — our diagnostic provider processes crash data such as error messages, stack traces, app version, device type, and OS version, plus low-cardinality analysis-transport timing measurements, on our behalf. Performance tracing and default personally identifying information collection are disabled, and timing attributes exclude ticker symbols, search text, and account identifiers.
• App store — the app store from which you downloaded bipsai processes your subscription purchases; we never receive your payment details.
• Legal and safety — when required by law, court order, or to protect the rights, safety, and integrity of bipsai and its users.

10Security

We protect your information with encryption in transit (HTTPS/TLS), access controls, least-privilege practices, and security and privacy reviews of the service providers that process data on our behalf. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

11Your choices & rights

You can manage alert, push, and morning-briefing email preferences in the app, control bipsai's access to device features such as push notifications through your device's system settings, export a portable JSON copy of your account profile and sign-in methods, subscription status, watchlists, alert rules and their status and last-fire fields, and preferences (Settings → Export my data), and delete your account at any time (Settings → Delete Account). The self-service export is a portability archive, not a complete access report covering security, operational, support, or legally retained accounting or legal-acceptance records. To request access to all personal information within the scope of applicable law, or to exercise any other privacy right, email support@bipsai.app; an authorized agent may submit a request on your behalf.

We acknowledge a verifiable privacy request within 10 business days. We respond without undue delay and within the deadline that applies where you live: ordinarily one month under the EEA or UK GDPR, or 45 calendar days under covered US state privacy laws. If the applicable law permits an extension, we will notify you within the initial period, explain why, and give the revised deadline. We use verification proportionate to the request and do not require more identity information than needed. If we deny a request, we explain the applicable reason and any appeal or regulator-complaint path the law requires. You will not be discriminated against for exercising a privacy right.

Do Not Track and Global Privacy Control

We do not track visitors over time or across third-party websites, and we do not sell or share personal information, so there is no tracking or sale for a browser "Do Not Track" or Global Privacy Control signal to switch off — the Service treats every visitor the way those signals request and behaves the same whether or not a signal is present. Where applicable law requires a Global Privacy Control signal to be honored as an opt-out of sale or sharing, that opt-out is honored automatically because we do not sell or share personal information in the first place.

California residents (CCPA/CPRA)

In the past 12 months we have collected these categories of personal information: identifiers (email, account and session identifiers), commercial information (your plan tier), internet/app activity (watchlists, alerts, notification preferences, and the in-app activity record of the analyses you open, described in §02), geolocation (approximate country or region), and device/network identifiers (push tokens, device characteristics, and IP address). We collect them from you and your device and from our subscription-management provider, and use them to provide, secure, and operate the Service. We disclose them to the service providers listed in §09. We do not sell or share personal information and do not use sensitive personal information for purposes that would trigger a right to limit it. California residents have the right to know/access, delete, and correct their personal information, to opt out of sale or sharing (which we do not do), to limit the use of sensitive personal information, and to not be discriminated against for exercising these rights.

We honor the request process above for California residents even if a statutory business-size threshold does not apply to us. We verify authorized-agent requests and may ask for proof of the agent's authority as permitted by law.

12Notice to European & UK users

If you are in the European Economic Area or the United Kingdom, the following applies. The data controller is Pocket Atelier LLC, 5900 Balcones Drive, Ste 100, Austin, TX 78731, USA (support@bipsai.app).

Our EU and UK representative

Pocket Atelier LLC has appointed Data Protection Representative Limited (trading as DataRep) as its representative under Article 27 of the EU GDPR and the UK GDPR. If you are in the EEA or the UK, you can raise a data-protection question or exercise your rights through DataRep by email to datarequest@datarep.com, quoting "Pocket Atelier LLC" in the subject line, or by post:

• European Economic Area — DataRep, 77 Camden Street Lower, Dublin, D02 XE80, Ireland
• United Kingdom — DataRep, 107-111 Fleet Street, London, EC4A 2AB, United Kingdom

Address any letter to "DataRep" rather than to Pocket Atelier LLC, or it may not reach us. DataRep is the contact point for data-protection matters raised by individuals in the EEA and the UK and by supervisory authorities there. For anything else — support, billing, or a question about the Service — emailsupport@bipsai.app.

Legal bases for processing

• Performance of a contract — to create and manage your account, watchlists, and alerts, and to provide your Standard, Pro, or Premium subscription.
• Legitimate interests — to secure the Service, prevent abuse, maintain operational telemetry, and keep the Service reliable.
• Consent — to send push notifications and morning-briefing emails you enable. You can withdraw consent in the app; push permission can also be withdrawn in your device settings.
• Legal obligation — where we must process data to comply with applicable law.

International data transfers

bipsai is operated from the United States, and your personal data is processed and stored in the United States. A transfer from the EEA may rely on an applicable adequacy decision, including the EU-US Data Privacy Framework only when the US recipient is actively certified for the relevant data, or on the European Commission's Standard Contractual Clauses with any required transfer assessment and supplementary measures. A restricted UK transfer may rely on a UK adequacy regulation or on the UK International Data Transfer Agreement or UK Addendum with the required transfer risk assessment. We do not treat an EU mechanism as automatically valid for the UK. To ask which mechanism applies to a particular provider, or to request information about the relevant safeguard, emailsupport@bipsai.app.

Your EU/UK rights

You have the right to access, rectify, erase, restrict, or port your personal data, to object to processing based on legitimate interests, and to withdraw consent where processing is based on consent. You also have the right to lodge a complaint with your local supervisory authority — your national or regional Data Protection Authority (in the UK, the Information Commissioner's Office). To exercise any of these rights, email support@bipsai.app.

Automated decisions

bipsai does not make automated decisions that produce legal or similarly significant effects for you; the research outputs the Service generates are informational only.

13Children

bipsai is intended for adults. You must be at least 18 years old to use the Service; it is not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has provided information to us, contact us and we will delete it promptly.

14Changes to this policy

We may update this Privacy Policy from time to time. The effective date at the top of this page reflects the most recent version. For material changes, we will provide notice in the app.

15Contact

Questions about this policy? Email support@bipsai.app, or write to: Pocket Atelier LLC, 5900 Balcones Drive, Ste 100, Austin, TX 78731, USA.