Privacy notice

Controller and contact

XXVIII Ltd, trading as Bullish Bear, is the controller for personal information held by the application. Its statutory identity, registration and postal details are on the Company information page. Use the private Support page for a privacy request. If you cannot sign in, write to the registered office shown there and mark the correspondence “Bullish Bear privacy”. No personal support email address is published.

Information we use

• Identity information supplied through Auth0: the provider subject identifier, name, email address and verification status.
• Your chosen public account username and either a Bullish Bear avatar or optional uploaded profile picture. This identity follows your account and may appear beside a verified completion on a public challenge field. Your completed-chart count, activity-star tier and earned challenge flairs may appear with that public profile. Your account name, email address and sign-in identity are not displayed on that field.
• Profile-completion and 21-day access start and end timestamps, plus transactional delivery records for the start, seven-day, one-day and expiry notices.
• Course progress, preferences, practice and Quickfire summaries, free-sample usage, Research Lab runs and account-sync conflict records.
• Challenge entry, chart start and submission timestamps, directional choices, selected prediction horizon, correctness, points, completion status and final rank. Portfolio entries additionally retain virtual allocation, leverage, optional stop and target, simulated profit or loss, virtual balance and drawdown information.
• Resend receives the destination email address and content needed to send the one-time account confirmation, access-period notices and any transactional challenge result. These service messages are separate from optional marketing.
• Anonymous first-party usage measurements: page and feature use, active-minute counts, referrer domain, browser, operating system, screen class, orientation and approximate country. The analytics service does not receive an Auth0 subject, account ID, email address, chart answer, ticker or support/Research content. It processes the network address transiently to create a one-day salted session identifier and does not store the raw address.
• Support-ticket subjects, categories, messages, status and timestamps. Improvement suggestions include your submitted text, category, account identifier and review status so we can review ideas and manage feedback.
• Checkout declarations, the applicable legal version and server timestamp, subscription status, and Paddle customer, transaction or subscription identifiers. Bullish Bear does not receive or store complete payment-card details.
• Where an invite-only partner code is used: the code attribution, one-time customer benefit, qualifying transaction subtotal, commission calculation, approved adjustment and payout-reconciliation records. Partners do not receive the learner’s identity or private learning activity.
• Security and operational information such as request timing, rate-limit state, service logs, deployment evidence, browser or device details supplied in a support request, and records needed to protect the service.

Purposes and lawful bases

• Contract and requested service: creating an account, synchronising progress, delivering chart exercises and Research studies, managing support and administering a subscription.
• Legitimate interests and statistical service improvement: securing Bullish Bear, preventing abuse, diagnosing faults, understanding aggregate page and feature use, maintaining reliable records and improving the service without overriding learner rights. Anonymous usage measurement is first-party, self-hosted, not linked to learner accounts and can be refused at any time through “Usage analytics” in the footer.
• Legal obligations: responding to lawful requests and retaining records that legislation requires for accounting, tax, fraud prevention or disputes.
• Consent: used where the law requires a genuine choice. Bullish Bear deploys no advertising, cross-site profiling, session replay or heatmap tracker.

Device storage and cookies

Bullish Bear uses first-party browser storage and strictly necessary cookies for sign-in, security, account progress, preferences and session controls. Paddle storage is introduced only when checkout or subscription management is requested. The Cookies and storage notice identifies the technologies, purposes and durations.

Recipients and international processing

Auth0 provides identity and session services; Paddle acts as merchant of record for paid transactions; protected hosting and infrastructure providers process operational data needed to run the service. These providers receive only information needed for their role. Where information is processed outside the United Kingdom, Bullish Bear relies on the provider’s applicable adequacy arrangements or contractual safeguards and security measures.

Retention and deletion

• Application account, progress and support-ticket records are held while the account remains active and are removed through the account-deletion process, subject to an active subscription first being ended.
• Referral financial records may retain transaction, adjustment, commission and payout evidence after learner-data deletion where needed for accounting, tax, fraud prevention or disputes; the deleted learner’s account identifier is detached from those records.
• Raw anonymous usage events and their daily rotating session records are automatically deleted after 90 days. Replay and heatmap storage remain disabled.
• The first-party guest Research identifier expires after one year unless renewed or removed through browser controls. Local and session storage remain on the device until expiry, clearing, sign-out behaviour or account deletion applies.
• Operational logs and backups are kept only for bounded security, diagnostic and recovery periods. Deletion may not immediately remove a record from a protected backup that is retained solely for disaster recovery and expires through the backup cycle.
• Paddle and Auth0 retain records under their own legal duties and policies. Deleting Bullish Bear learner data does not erase records that another controller must lawfully retain.

Your rights

Depending on the circumstances, you may ask for access, correction, erasure, restriction, portability or objection to processing. The account page provides an application-data download and guarded deletion. You may also use Support for a request or complaint. You have the right to complain to the UK Information Commissioner’s Office. The right to object to processing based on legitimate interests is expressly available and will be considered against the stated necessity.

Automated decisions and educational scores

Bullish Bear does not use learner scores to make decisions producing legal or similarly significant effects. Hit rates, streaks, study comparisons, challenge points, virtual portfolio results, leaderboard ranks and confidence intervals are educational feedback only. Sprint scores are calculated automatically from correctness and server-measured completion time. Portfolio results are calculated from the submitted virtual trade plan and the subsequent certified historical price path. Strategy-profile results are generated from the same challenge chart pack and are identified separately from verified players.

Changes to this notice

The effective date and version appear above. Material changes will be published before they apply where required. Live billing remains prohibited until the legal text, checkout disclosures, support response path and payment controls have passed their separate launch gates.