Privacy Policy

We collect only what we need to run the Service:

• Account information — your name, email address, and optionally your phone number and date of birth, which you provide when you register or edit your profile.
• Authentication data — password credentials (stored only as a secure hash) and, if you choose Google sign-in, the identity details Google shares with a linked account.
• Content you create — portfolios, watchlists, price alerts, feedback, and messages you send to the AI market assistant.
• Technical data — session tokens, cookies, and diagnostic error reports needed to keep you signed in and to detect and fix problems.

• To provide, maintain, and personalise the Service — showing your portfolios, watchlists, and alerts;
• To send you the emails and notifications you have opted into, such as price alerts and account security messages;
• To operate the AI market assistant, including abuse-prevention and cost-control safeguards;
• To secure the Service, prevent fraud and misuse, and comply with legal obligations;
• To diagnose issues and improve reliability and features.

We use a minimal set of tokens to keep you signed in. Your short-lived access token is held in memory and sent only as a bearer token; a refresh token is stored in an httpOnly cookie scoped to our authentication endpoints. We do not store access tokens in your browser's local storage. These tokens are strictly necessary for the Service to function.

We share data with a limited set of service providers only as needed to operate the Service:

• The Dhaka Stock Exchange and related public sources, from which we retrieve market data;
• Our AI provider (Groq), which processes the messages you send to the AI assistant to generate responses;
• Our email provider, which delivers transactional and alert emails on our behalf;
• Google, when you choose to sign in with or link a Google account.

We do not sell your personal information.

Signing in with Google is optional — you can always use an email address and password instead. If you do choose Google sign-in, Google sends us a signed identity token containing a limited set of basic profile fields:

• Your name, as it appears on your Google account;
• Your email address and whether Google has verified it;
• Your profile picture, if your Google account has one;
• Your Google account identifier, which we store so we can recognise you on your next sign-in.

We use this information for one purpose only: to create your StockWatch account, or to sign you in to an existing account, and to show your name and picture inside the app. We request no other Google scopes, we never receive your Google password, and we have no access to your Gmail, Drive, Calendar, Contacts, or any other Google service.

StockWatch's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not transfer this data to third parties except as needed to provide the Service, we do not use it for advertising, and we do not allow humans to read it except with your explicit consent, for security purposes, to comply with applicable law, or where the data has been aggregated and anonymised.

You can unlink Google from your StockWatch account at any time on your profile page, and you can revoke StockWatch's access from your Google account permissions page. Deleting your StockWatch account removes the Google identifier we stored.

We keep your account and content for as long as your account is active or as needed to provide the Service. When you delete your account or specific content, we remove it, subject to any retention required for security, dispute resolution, or legal compliance.

You can view and update your name, email, phone number, and date of birth at any time from your profile page. You can manage or unlink Google sign-in, and you may request deletion of your account and associated data by contacting us. Depending on your jurisdiction, you may have additional rights to access, correct, or export your data.

We take reasonable technical and organisational measures to protect your information, including hashed passwords, scoped authentication cookies, and access controls. No method of transmission or storage is completely secure, however, so we cannot guarantee absolute security.

The Service is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, please contact us so we can remove it.

StockWatch is operated from Bangladesh, and your information may be stored and processed in Bangladesh and in the regions where our service providers operate. By using the Service you consent to this processing.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above. Material changes may be communicated through the Service.

Questions about your privacy, or want your account and data deleted? Email us at softoversetech@gmail.com and we will respond as soon as we can.

You can also reach us through the feedback form on our site or via our GitHub repository. See also our Terms of Service.