Privacy Policy

Version 1.0 · effective 21 October 2026 · operator: Carl Luise, Nevada, United States (a Nevada LLC is being formed and will take over this policy when it exists)

1. Who we are

Bull Whistle (bullwhistle.com) is operated by Carl Luise, an individual based in Nevada, United States. A Nevada limited liability company is being formed to operate the service; when it is registered this policy will name it as the operator, and your data will be handled by it under the same terms. Questions about this policy go to [email protected].

2. What we collect

Bull Whistle is invite-only during its beta. You can only create an account with an address an administrator has invited.

Your account

• E-mail address and the name you give us. Used to sign you in, to send you the one-time codes and security notices described below, and to send price-alert e-mails if you turn them on.
• Your password, never stored as such. We keep a salted hash (PBKDF2-HMAC-SHA256, 600,000 rounds, plus a server-side secret). When you choose or change a password, the first five characters of a one-way hash of it are checked against the Have I Been Pwned breach list so we can refuse passwords that are already public. The password itself never leaves our server.
• Passkeys (Face ID / Touch ID / security keys) if you set one up. We store the public key only; the private key stays on your device and we never see your biometrics.
• Google sign-in, if offered and you use it: we receive your Google account's e-mail address and name from Google's sign-in token, nothing else, and we do not post to or read your Google account.

Sessions and security

• Sign-in sessions. Each device you sign in on gets a session token. We store a one-way hash of it, a short device label taken from your browser's user-agent string (for example "iPhone · Safari"), the time, and the network your request came from, reduced to a network prefix (the first three groups of an IPv4 address, or the first 48 bits of an IPv6 address). Sessions last 30 days from last use and at most 90 days, and an account can hold at most five at once.
• Why the network prefix. It drives three protections: rate limits on sign-in attempts, the "new device" e-mail you get when your account is used from a device we have not seen, and the account-sharing rule, which signs other devices out if one account is active from three or more networks and two or more kinds of device inside ten minutes. We do not use it for anything else.
• Security notices by e-mail. New-device sign-ins, password changes, e-mail changes, and the account-sharing notice.
• An audit trail of account events (sign-ups, sign-ins, password changes, invites, deletions) with the same device label and network prefix, kept inside the encrypted account store and visible to the administrator for abuse handling.

What you make in the app

• Your watchlists, the journal entries you write, your price alerts and which fired alerts you have seen, your settings (theme, indicator choices, layout), and your portfolio book (the sleeves and weights you build, and your saved setups). These sync across your signed-in devices through our server and are stored encrypted, per person.

What we do not collect

• No advertising identifiers, no third-party analytics, no tracking pixels, no social plugins.
• No precise location. The optional city label on your devices list exists only if the operator enables an IP-to-city lookup; it is off today.
• No payment details. Bull Whistle has no paid tier during the beta.

3. Broker and exchange connections

Connecting an account is optional. Without a connection, Bull Whistle shows only the holdings you type in yourself.

Linked brokerages through SnapTrade

• For brokerages such as Robinhood, Webull, Fidelity, Schwab, Vanguard, E*TRADE, Interactive Brokers and Coinbase, Bull Whistle uses SnapTrade, a third-party connection service. You sign in on your broker's own site inside SnapTrade's connection portal. Your broker username and password never pass through Bull Whistle.
• SnapTrade gives us a per-user identifier and a per-user secret so we can ask it for your holdings. We store both in your encrypted account record. The connections are read-only by construction: Bull Whistle never requests, and the connection does not grant, the ability to place orders, move money or change your broker account.
• What we receive: the accounts under the link, their holdings (symbol, quantity, value) and cash balances. We store the latest snapshot per account, encrypted, so the app can show it without asking the broker every time.
• When you remove a connection in Settings, we ask SnapTrade to revoke the link and delete our copy of the snapshot. You can also revoke any connection from the broker's own security settings at any time.
• SnapTrade's own handling of your data is governed by SnapTrade's privacy policy.

Exchange and broker API keys

• For Kraken, Bitget, BitUnix and Interactive Brokers Flex reports, you can paste an API key you create at the exchange. The add form tells you exactly which read-only permission to grant. Create read-only keys only. Bull Whistle never calls a trading or withdrawal endpoint, but a key with those rights would be a risk to you if it were ever exposed elsewhere.
• Keys are sealed inside your encrypted account record (AES-256-GCM, with a key that exists only in the server's environment). The app shows you a key's last four characters; a secret, passphrase or token is never shown back and never written to a log.
• What we fetch with them: balances and holdings, and, where the key allows it, your executed trades, so the app can show your position history and realised gains. We store the latest snapshot, encrypted.

Manual holdings

You can also type holdings in (ticker and quantity, or ounces of metal). They are stored with your account like any other setting.

4. The assistant and your API key

• Bull Whistle includes an optional assistant that answers questions about your watchlist, portfolio and the market. It runs on Anthropic's Claude models. It only works with an Anthropic API key you create and paste yourself in Settings › Ask Bull Whistle. Your key is sealed in your account record; the app shows its last four characters and never echoes it.
• When you ask the assistant something, your question, the recent turns of that conversation, and the portfolio, watchlist and market figures the assistant needs to answer are sent to Anthropic's API under your key. Usage is billed to your Anthropic account. Anthropic's handling of API traffic is governed by Anthropic's privacy policy and commercial terms; API inputs are not used to train Anthropic's models under those terms.
• Short notes the assistant keeps about your preferences ("remembers") are stored in your browser on that device, not on our server.
• Remove your key in Settings at any time; the assistant stops at once.

5. Market data and its sources

The prices, charts, company financials and calendar dates in Bull Whistle come from third-party sources. They are fetched by our server, not by your device, so those providers never see who you are or what you looked at.

• Stock, fund and economic data by Financial Modeling Prep.
• Crypto prices and charts: market data by Kraken, from its public market-data API.
• Treasury yields from the U.S. Treasury; macro series from FRED, Federal Reserve Bank of St. Louis; other sources are credited on the card that uses them.

Quotes are delayed and refreshed on a schedule, not streamed. See the Terms of Service for what that means for relying on them.

6. Who processes data for us

We do not share your data with anyone else, and we do not sell it. We would disclose data if required by law, and we would tell you unless we are legally prevented from doing so.

7. How data is protected

• Everything personal is stored in encrypted files (AES-256-GCM). The encryption key exists only in the server's environment, never on disk next to the data. A copy of the data without the key is unreadable.
• Passwords are hashed as described above and never stored. Session tokens are stored only as hashes, so a copy of the store cannot be used to sign in.
• All traffic uses HTTPS. Session tokens travel in a request header, never in a cookie or a URL.
• Exchange keys and secrets are never logged. Error messages carry codes and class names, not values.
• Security problems can be reported to [email protected]; we will reply and fix in good faith.

8. How long we keep things

• Your account and what you made in it: until you delete the account. Deleting it (Settings › Account › Delete) removes your record, your watchlists, journal, alerts, settings, book, broker snapshots and keys, and asks SnapTrade to revoke any links. This is not reversible.
• Sessions: 30 days from last use, 90 days at most, or until you sign that device out.
• One-time codes (sign-up, reset, e-mail change): 30 minutes.
• Audit events: kept with the account and deleted with it.
• Backups: the operator keeps encrypted backups of the server's stores for disaster recovery; deleted data leaves those backups as they rotate.
• Server logs: request logs hold URLs and timestamps, never tokens, keys or message bodies, and rotate with the host.

9. Your choices and rights

• See your data: everything we hold about you is visible in the app, under Settings › Account, your lists, your journal and your Portfolio. Your saved setups can be exported as a backup code or file from Portfolio › Presets.
• Correct it: change your e-mail, name and password in Settings › Account.
• Delete it: Settings › Account › Delete account, or e-mail us from your account address.
• Devices: Settings › Account › Devices lists every signed-in device; sign any out, or sign out everywhere.
• E-mails: alert e-mails can be switched off in Settings. Security notices (new device, password change) cannot, because they exist to protect the account.
• Ask us anything about your data at [email protected]. If you are in a place with data-protection rights (for example the EU, UK or California), you can use that address to exercise them, and we will answer within 30 days.

10. On your device

Bull Whistle sets no cookies. It uses your browser's local storage to keep you signed in, remember your settings, cache market data for offline use, and hold the assistant's notes. A copy of your settings and book also lives on each device so the app opens instantly. Clearing site data in your browser removes all of it from that device; nothing on the server changes.

11. Age

Bull Whistle is for adults. You must be 18 or older (or the age of majority where you live) to hold an account. We do not knowingly collect data from anyone younger; if you believe we have, tell us and we will delete it.

12. Where data lives

Our servers are in the United States. If you use Bull Whistle from elsewhere, your data is transferred to and processed in the United States under this policy.

13. Changes

When this policy changes we update the version and date at the top, and for anything material we tell account holders by e-mail before it takes effect. Earlier versions are available on request.

14. Contact

Carl Luise · Bull Whistle · Nevada, United States · [email protected]