Privacy Policy

• Signing in with Google is the only way in. Your account is created the first time you do it, and Google gives us your account identifier, your verified email address, your name and the address of your profile picture. We never see your password.
• Everything you ask, along with your watchlist and your portfolio rows, is sent to the AI provider that writes the answer. Today that provider is DeepSeek.
• To stop one machine opening account after account, we derive a salted hash from your device. Your raw IP address is not kept in that record — the detail is below.
• Payment happens on Stripe's own pages. Your card details never touch our servers.
• No ad networks, no analytics trackers, no third-party cookies. We do not use your conversations to train a model.

The party that operates Bulledge, and that this document calls "we": Bulledge LTD, a company incorporated in the United Kingdom.

For any privacy question, request or complaint, use the contact form on the home page or write to [email protected]. Both reach us directly.

This document serves both as the disclosure required by Turkey's Personal Data Protection Law (KVKK) and as the information required by Articles 13 and 14 of the GDPR.

The only way into Bulledge is your Google account. Yours is created the first time you sign in with it. We ask for no email address and no password of our own, and there is no anonymous account that opens by itself.

We store the account identifier Google gives us — Google calls it the sub — along with your email address, your display name and the address of your profile picture. The identifier is the identity, not the email: Google lets the address on an account change, and the identifier does not. The email is kept so we can show you which account you are on, and so you can confirm a deletion.

An address Google has not verified is not stored. The account still works — it just shows no address, and it cannot be deleted from the screen described below, because there is nothing to check what you type against.

You give Google your password on Google's own page; we never see it and never store it. We ask Google for three things and no more: the identifier, the email address and the basic profile.

Once you are signed in we return a session token (a JWT). It is valid for a year and is kept in your browser's local storage. While a sign-in is in flight — from the moment you leave for Google to the moment you come back — we keep a short-lived record so it can be finished; it is deleted the instant it is used, and swept away if it is abandoned.

This is everything that is actually in the database. Unless noted otherwise, all of it is deleted when you delete your account.

Account and identity

Your Google account identifier, your email address where Google has verified it, your display name, the address of your profile picture, and when the account was opened. Beside them: your plan and, if you have subscribed, your Stripe customer id, your subscription id, its status and when the paid period ends.

Conversations and messages

Your questions, the model's answers, the tools it called and what they returned, its reasoning text, and each turn's duration and token count. The reasoning is never displayed; it is stored because the provider requires it to be replayed on the following turn.

Watchlist

The symbols you follow, the headings and notes you gave them, and the order you put them in.

Portfolio

Every buy and sell you entered: symbol, quantity, unit cost, date and your note. These are figures you typed. We connect to no broker and read no account of yours.

Price alerts

The conditions you set and a history of when they fired.

Scheduled tasks

The task's name, the prompt it runs, its frequency and time, your time zone, the email address the result goes to, and the answers from past runs. The last 200 runs are kept per task.

Push subscriptions

The notification endpoint your browser issues and its key material, plus which language a notification should be written in.

Preferences

Only the ones about you — language, screen order. The ones about your screen, like column widths and panel sizes, never reach the server.

Usage counters

How many messages you sent per hour and per day, how many tokens that spent, and what it is estimated to have cost; and, for each answer, the moment it was recorded and the tokens it spent. This is where your allowance is counted and the bill is read.

Where you connect from

On every authenticated request: your IP address, the first language your browser asks for, and your browser identification (User-Agent). When the same three arrive again no new row is written — the existing one's timestamp is updated — so the record grows when something changes. All three arrive with the request; none is looked up anywhere and your location is never resolved.

Share links

The token generated when you publish a conversation or a single exchange, and which range of messages it may show.

Contact form and bug reports

The name, email, role and message you typed, the page's language and your IP address. A bug report also carries which screen you were on and your window size.

Nothing else is collected. There is no advertising identifier, no cross-site tracker, no heatmap, no session recording and no third-party analytics.

This section describes an identifier we derive from your device so we can count how many accounts have been opened from it. Under KVKK and the GDPR that is a device identifier, and it has to be spelled out.

Opening a Google account is real work, and that is most of the defence already. One abuse is left: opening account after account on the same machine to collect the free plan's questions over and over. That is what this counts — no more than three new accounts an hour from one device.

So we take three things and fold them into a single salted hash:

• A bucketed form of your IP address — the first three blocks on IPv4 (a /24), the first four on IPv6 (a /64). Not the full address: the range it sits in.
• Your browser identification (User-Agent).
• The first language your browser asks for.

Those three go through an HMAC-SHA-256 keyed with a secret that lives in the application rather than in the database. The row written to the database holds no IP address, no User-Agent and no language — only that hash, when the device was first and last seen, and how many accounts have been opened from it. The hash cannot be reversed, and without the salt it cannot be matched against any other database.

Bucketing the address is not a nicety. A household or an office leaves through one address, while a mobile carrier moves one phone around a /24 all day. A /24 and a /64 are where "counting a whole family as one person" and "counting a whole city as one person" are both least wrong. Which is exactly why this decides whether a new account may be opened and never who you are.

The count resets on its own after an hour of quiet. The row itself is kept for 30 days after it was last seen and then deleted, by a sweep that runs every hour. Rotating the salt makes the entire ledger meaningless at once, which is how a device is forgotten.

Legal basis: legitimate interests, Article 6(1)(f) GDPR and the corresponding provision of the KVKK. The interest is preventing automated abuse of the free tier of a metered AI service. It is consulted only while a new account is being opened: once you have one, it is not used on any request you make, it decides nothing about what you are shown, and it is never linked to your account. You may object to this processing through the contact form.

For the same purpose we may put Cloudflare Turnstile in front of account creation. Turnstile sets no cookie and builds no advertising profile; Cloudflare's own policy covers the detail.

This hash and the "where you connect from" record above are two separate things and should not be confused: the fingerprint row holds no IP address, the connection record does. The connection record belongs to your account and is deleted with it.

We do not use cookies to sign you in. Your session token, your theme, the sidebar width and similar screen settings live in your browser's local storage. None of it is sent anywhere on its own; the token travels only in the header of the requests you make to the API.

Clearing your browser storage only signs you out of that browser. It does not touch your account: sign in with the same Google account and you are back where you left off.

A short list. Each line says what actually reaches that party.

DeepSeek — the AI provider

When you ask something: your message, that conversation's history, your watchlist, your portfolio rows, your time zone and whatever the market tools returned. Your name, your email address and your IP address do not. We run the model on DeepSeek's own API, and your questions reach no other AI seller. This page changes with that if it ever does.

TradingView — market data

The symbol, interval and indicator you asked about. Nothing that identifies you: the connection is made with our own account.

Stripe — payments

When you subscribe, your name, email, card details and billing address go straight to Stripe. What comes back to us is your customer id, your subscription id, its status and when the paid period ends. We never see your card number.

Google — sign-in

We send you to Google to sign in, and Google returns your account identifier, your email address where it has verified one, your name and the address of your profile picture. Since this is the only way in, Google knows you use Bulledge. Your password is given on Google's own page and never reaches us.

Google — outbound email

Scheduled task results are sent through Gmail's SMTP server, so the address you gave the task and the text that is sent pass through it.

Cloudflare — the network

All traffic passes through Cloudflare, so your IP address and your request headers are visible there. Turnstile, where enabled, is also Cloudflare.

Your browser's push service

If you allow notifications, they are delivered through the push service run by whoever makes your browser (Google, Mozilla or Apple). The payload is encrypted end to end.

We do not sell, rent or hand your data to anyone for marketing. If a lawful demand arrives, we answer it to the extent we are legally required to and no further.

Some of the parties above are outside Turkey and the European Union, so using the service involves transferring data abroad. The transfer is necessary to provide the service, and each provider is bound by its own contractual and data-protection commitments.

Checkout and subscription management are Stripe's own pages. Card details never reach our servers; 3-D Secure, card updates, invoices and receipts are all Stripe's screens.

When Stripe changes a subscription it notifies us. We record the raw notification so the same event cannot be processed twice and charge you twice. It may contain fields Stripe sends, such as your name, email, country and the last four digits of your card. It never contains the full card number.

That notification is the only thing that decides which plan your account is on — not the moment you return from the payment page. It is what stops a closed tab or a card declined afterwards from leaving a plan granted that was never paid for, and it is why the screen can show your old plan for a few seconds after you pay.

Conversations, lists, portfolio, alerts, tasks

Until you delete them or delete your account. There is no automatic clear-out.

Task run history

The last 200 runs per task.

Alert firing history

The last 500 firings per account. Older ones are deleted automatically; the alerts you set are not affected.

The device fingerprint row

30 days after it was last seen.

The free-trial record

Indefinitely. It stays when you delete your account — see below.

Unfinished sign-in records

Deleted the moment they are used. Abandoned ones fall away in the hourly sweep.

Payment notifications

As accounting and dispute records, for as long as the applicable law requires. These survive the deletion of your account — see below.

Contact form messages

They are attached to no account and are not deleted with one; they are cleared by hand once the correspondence is closed.

Server logs

Kept briefly for debugging and rotated on a schedule.

You delete your account yourself: there is a delete button on the Account screen in the workspace. It asks you to type the email address this account signs in with, matched without regard to capitals. Nothing is queued — it happens when you press the button.

Typing the address proves intent, not identity, and saying so is better than implying a protection that is not there. The session token in your browser can already read everything in the account; the second step exists so nobody deletes an account by misclicking. An account whose address Google never verified cannot be deleted here, because there is nothing to check what you type against — write through the contact form instead.

Deletion is immediate and cannot be undone: there is no grace period, no trash and no recovery. It removes the account row and everything that hangs off it — conversations and messages, watchlist, portfolio, alerts and their firing history, tasks and their runs, push subscriptions, preferences, usage counters, share links, connection records and the bug reports you sent from inside the app. Signing in with the same Google account afterwards opens a new, empty account; it does not bring the old one back.

Three things are left behind, and listing them is the honest thing to do:

• Payment notifications. Deleting an account does not undo an invoice, so these are kept — detached from the account — for as long as the law requires.
• Messages you sent through the contact form. That form exists for people without accounts, so it is attached to none.
• The device fingerprint row. It contains nothing about your account and falls away on its own within 30 days.
• The free-trial record: a keyed, one-way digest of your Google account's identifier and how many questions it has asked — nothing else; no address, no name, no content. Its only job is that deleting your account and opening it again with the same Google account does not hand out the free ten a second time.

Deleting a single conversation is also permanent, and takes only that conversation.

Under Article 11 of the KVKK and Articles 15-22 of the GDPR you may ask whether we hold data about you, ask for a copy of it, have it corrected if it is wrong, have it deleted where the conditions are met, object to processing, and receive your data in a portable form.

Send requests through the contact form. We answer within 30 days at the latest. The only way we can recognise you is the Google address on your account, so write from that address: we have no other means of verification, and it is the same thing that protects your account from somebody else's request.

If our answer does not satisfy you, you may complain to the Turkish Personal Data Protection Authority, or in the EU to your own country's data protection authority.

All traffic is carried over TLS. Your password never reaches us: Google's own page handles the sign-in and returns only its result. The fingerprint salt lives in the application rather than in the database. The database is reachable only from the server itself, and the application connects as its own role with no more privilege than it needs.

No system is perfect. If you find a vulnerability, write to us through the contact form; we ask for a reasonable window to fix it before you publish.

Bulledge is not directed at anyone under 18 and we do not knowingly collect data from them. If we learn that an account belongs to someone under 18, we delete it.

When the policy changes, the date above changes. For a change that materially affects what we collect or which third parties are involved, we will also say so inside the app.