Privacy Policy

When you create a BullStreet account, we collect:

• Email address (used for sign-in and one-time verification codes)
• Username, display name and an optional profile picture
• Watchlist, price alerts, recently viewed coins and stocks, saved posts, and notification preferences
• Device push-notification token (only if you enable push notifications)
• Basic device and app information for crash reports (device model, OS version, app version)

If you buy a Boost or apply for Verification, we also collect the details you enter on the checkout page: your email, the coin (name, ticker, contract address, network, website and social links you provide), the amount paid, the payment method, and — for crypto payments — the wallet address you give us for any refund.

Your profile picture is stored only on your device. We do not collect or store wallet private keys, exchange logins, trading history, or bank details. BullStreet never executes trades on your behalf.

We use the information we collect to:

• Authenticate you and keep you signed in
• Sync your watchlist, alerts and preferences across your devices
• Check your price alerts on our servers and send the push notifications you asked for
• Send transactional emails (sign-in and password-reset codes, purchase receipts, verification results)
• Process Boost and Verification purchases and review verification applications
• Diagnose crashes and errors so we can fix them
• Detect and prevent abuse of the service

Your account, watchlist, alerts, preferences, purchase records and verification applications are stored in our backend on Supabase, a data-hosting provider that processes data on our behalf in the United States. Data is encrypted in transit (HTTPS) and at rest. Row-level security ensures you can only read and write your own records.

BullStreet relies on the following third parties to operate:

• Supabase — authentication, database and serverless functions
• Resend — delivery of transactional emails
• Sentry — crash and error reporting (device model, OS version, app version and an anonymous user identifier; never your email or watchlist)
• Expo push service, Apple Push Notification Service and Google FCM — only if you enable push notifications
• NOWPayments (crypto) and Square (cards) — process Boost and Verification payments. They receive your email and payment details and handle them under their own privacy policies
• Market data: CoinGecko and Databento are requested through our servers and never receive personal information. GeckoTerminal, DexScreener and Binance market data are requested directly from your device, so — like any website you visit — those services see your device's IP address
• Trading partners: the "Trade" button opens third-party exchanges (currently FOMO and Toobit) through referral links. BullStreet may earn a commission at no cost to you. Anything you do on those sites is governed by their terms and privacy policies, not ours.

We do not sell, rent or trade your personal information. We share data only with the processors listed above, strictly to provide the service, or when required by law, court order, or to protect the rights and safety of BullStreet and its users.

You can:

• Edit your username, display name and picture in Profile → Edit Profile
• Turn push notifications, price alerts and news announcements on or off in Settings → Notifications (announcements are off unless you opt in)
• Delete your account from Settings → Delete Account. This is immediate and irreversible.

We keep your account data for as long as your account is active. When you delete your account, your profile, watchlist, alerts, saved posts, recently viewed items, notification preferences, push tokens and login records are permanently removed from our backend immediately.

Records of Boost and Verification purchases (order ID, email, coin details, amount, payment status and refund address) are kept for up to 7 years after the purchase, as required for accounting, fraud prevention and dispute handling, and are no longer linked to a profile once the account is deleted. Crash and error logs in Sentry are retained for up to 90 days and are not linked to your email address.

We use industry-standard security measures including TLS encryption, encrypted storage at rest, hashed passwords and one-time codes, and row-level access control on every database table. Paid API keys and payment credentials live only on our servers, never in the app. No system is perfectly secure, however; you are responsible for protecting your device and the email account associated with your BullStreet login.

BullStreet is not intended for and may not be used by anyone under the age of 18. We do not knowingly collect data from children. If you believe a child has provided us information, contact us and we will delete it.

Depending on where you live, you may have rights to access, correct, export or delete the personal data we hold about you, and to object to or restrict certain processing. You can exercise the most common of these directly in the app (Profile → Edit Profile, Settings → Delete Account). For other requests, contact us at the email below.

BullStreet is operated from the United States. By using the app, you consent to the transfer of your information to the United States and other jurisdictions where our service providers operate.

We may update this Privacy Policy from time to time. Material changes will be communicated through the app or by email before they take effect. The date at the top of this page is always the date of the most recent revision.

For privacy-related questions, data requests or concerns, contact us at BullStreetApp.com@bullstreetapp.com.