Privacy Policy
Last updated: April 2026 · Bureau7 LLC, 30 N Gould St Ste N, Sheridan WY 82801, USA
1. Who we are
Whystock is operated by Bureau7 LLC (“we”, “us”, “our”). This policy explains what personal data we collect when you use whystock.app, why we collect it, and your rights over it.
2. Data we collect
When you sign in or subscribe, we collect:
- Account data — your name and email address, provided via Google OAuth.
- Subscription data — your plan status and billing dates. Payment card details are processed and stored exclusively by Stripe; we never see or store them.
- Usage data — tickers you search, features you use, and pages you visit, used to improve the platform.
- Locally stored data — your watchlist and recent searches are stored in your browser's local storage and are not transmitted to our servers.
- Communication preferences — your email newsletter opt-in choices (trading digest frequency: daily, weekly, or monthly), collected when you create an account. Leaving all options unchecked means you will only receive essential transactional emails.
3. How we use your data
- To authenticate you and manage your account.
- To process subscription payments via Stripe.
- To send essential transactional emails (trial expiry reminders, billing receipts, and account notifications). These emails cannot be opted out of while your account is active as they are necessary for the service.
- If you opted in during account creation, to send trading-related newsletters (daily market digest, weekly stock analysis, or monthly comprehensive report). You may withdraw this consent at any time by contacting info@whystock.app. We never send unsolicited marketing, promotional, or advertising emails. Newsletter content relates solely to financial market analysis and is never used to promote third-party products or services.
- To monitor platform health and fix bugs.
4. Third-party services
We use the following third parties, each with their own privacy policy:
- Google OAuth — sign-in authentication.
- Stripe — payment processing. Your card data goes directly to Stripe and is never stored by us.
- Google Gemini — AI-generated analysis. Ticker queries may be sent to Google's API to generate narratives. We do not send any personally identifiable information to Gemini — only anonymous ticker symbols.
- Google Cloud / Firebase — hosting and database infrastructure.
- Resend — transactional email delivery. Your email address is passed to Resend solely to deliver emails on our behalf. Resend does not use your email for any other purpose. See resend.com/privacy.
5. Data sharing
We do not sell, rent, trade, or share your personal data with any third party for marketing, advertising, or commercial purposes. We share only what is strictly necessary with the service providers listed in Section 4 (Google OAuth, Stripe, Google Gemini, Google Cloud/Firebase, Resend) solely to operate the platform. None of these providers are permitted to use your data for their own marketing purposes.
6. Email consent & your choices
We obtain your explicit consent before sending any newsletter emails. When you create an account you are presented with clear opt-in checkboxes for each newsletter frequency. Consent is entirely optional and not required to use the platform.
You can withdraw consent at any time by emailing info@whystock.app and we will stop sending newsletters within 5 business days. Withdrawing newsletter consent does not affect your ability to use Whystock or receive essential account emails. We keep a record of when you gave or withdrew consent to comply with data protection obligations.
7. Your rights
You have the right to:
- access a copy of the personal data we hold about you;
- correct inaccurate data;
- request deletion of your data;
- withdraw consent for newsletter communications at any time;
- object to or restrict processing in certain circumstances.
To exercise any of these rights, contact us at info@whystock.app. We will respond within 30 days.
8. Data retention
We retain your account data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days, except where retention is required by law (e.g. billing records).
9. Cookies & local storage
We use a session cookie for authentication (NextAuth). Your watchlist and recent searches are stored in browser local storage — this data never leaves your device. We do not use advertising or tracking cookies.
10. Changes to this policy
We may update this policy from time to time. Material changes will be noted by updating the date at the top of this page.