Privacy Policy

What we collect

• Account details. Your name, email address and sign-in method (Apple, Google or email) through Firebase Authentication. If you use Sign in with Apple and hide your email, we only get Apple's relay address.
• Your answers during setup. Things like your country, experience level, goals and the account types you hold (for example TFSA, RRSP, 401(k)), so Bywell can tailor what it shows you.
• Brokerage information, if you connect a brokerage. Connections are read-only and go through SnapTrade, our brokerage connection provider. You sign in to your brokerage on SnapTrade's or your brokerage's own page; Bywell never sees or stores your brokerage username or password, and can't place trades or move money. We receive your positions, quantities, account types and balances to show them to you. We fetch holdings when you use Bywell rather than keeping a copy of them, and we store the access credential SnapTrade issues for your account encrypted.
• Things you create. Watchlists, earnings reminders, alerts, goals, notes and journal entries, investment theses, and questions you ask Bywell AI along with its answers.
• Voice input, if you use it. When you speak a question or note, your phone's built-in speech recognition (Apple or Google) turns it into text, under their privacy terms. We receive the text, not the audio.
• Notifications. A push token for your device, if you allow notifications, and your notification and email preferences.
• Purchases. Your plan and subscription status. Payments are handled by Apple, Google or Stripe; we never receive your full card number.
• Connector use. If you add Bywell to an AI assistant, we store the access tokens that let it reach your Bywell account (hashed) and the requests it makes on your behalf. The assistant's provider handles your conversation under its own policy.
• Technical data. Basic logs such as IP address, device and app version, and error reports, used to keep Bywell running and secure.
• Usage analytics. Which screens and features are used, how far people get through setup and upgrading, and device information such as browser or phone model, operating system and approximate region. See "Usage analytics" below.

How we use it

• To provide Bywell: show news, earnings and fundamentals for what you own and follow, send the reminders and summaries you ask for, and answer your questions.
• To run your account and subscription, including free trials and restoring purchases.
• To send service messages and, if you leave them on, the weekly portfolio summary by push or email. You can turn these off in the app or with the unsubscribe link in any email.
• To keep Bywell secure, prevent abuse, fix problems and understand which features are used so we can improve them.
• To meet legal obligations.

We rely on your consent (which you can withdraw), on performing our agreement with you, and on our legitimate interest in running and securing Bywell, as the law where you live allows.

Bywell AI

When you use Bywell AI research or the weekly summary, the relevant information (for example the stocks you hold and their weights, recent news on them, and your question or thesis) is sent to Anthropic, which provides the AI model, to generate the response. Anthropic processes it on our behalf and doesn't use it to train its models under our commercial terms. Your name and email aren't included.

Usage analytics

To understand which parts of Bywell are used and where people get stuck, we use Google Analytics on the website and Google Analytics for Firebase in the apps. They record usage events (for example that a setup step was completed, a guide was read or the upgrade page was opened) along with device information and a random account identifier. We don't send your name, email address, anything you type, your holdings or the amounts in your accounts. Google processes this data for us as a service provider, and we don't use it for advertising or sell it. Google Analytics shortens (truncates) IP addresses and doesn't log or store them.

You can opt out on the web by blocking cookies or Google Analytics in your browser's settings, with a content or ad blocker, or with Google's opt-out browser add-on. In the apps, turn off analytics in Account.

Who we share it with

Only with service providers that help us run Bywell, under contracts that limit their use of it to that purpose:

• Google Cloud and Firebase (hosting, database and sign-in)
• Google Analytics and Google Analytics for Firebase (usage analytics, described above)
• SnapTrade (read-only brokerage connections)
• Anthropic (Bywell AI)
• Stripe, Apple, Google and RevenueCat (payments and subscription status)
• Expo (push notification delivery) and our email delivery provider
• Market data providers, which receive the ticker symbols we look up, never who you are

We may also disclose information if the law requires it, to protect people's safety or our rights, or as part of a merger or acquisition, in which case this policy continues to apply. We never sell or rent personal information.

Where it's stored

We're based in Canada, and Bywell's servers run on Google Cloud in Canada (Montréal). Some providers above, possibly including our database host, process data in the United States and other countries, where it may be accessible to local authorities under their laws.

How long we keep it

We keep your information while your account is open. When you delete your account (in the app under Account, or on the web at bywell.org/account), we delete your profile and everything you created, cancel any Stripe subscription, remove your SnapTrade connection and delete your sign-in. Backups and logs roll off on our providers' schedules, generally within about 30 days. We keep limited records longer only where the law requires it, such as tax records of payments. Apple and Google subscriptions are cancelled in your device's settings.

Your choices and rights

You can see and change most of your information in the app, disconnect a brokerage at any time, and delete your account. Depending on where you live (including under Canada's PIPEDA, Québec's Law 25, and US state laws such as California's), you may also have the right to access, correct, delete or get a copy of your information, to withdraw consent, and to know how it's used. We don't sell or "share" personal information for cross-context behavioural advertising. Email privacy@bywell.org and we'll respond within 30 days. We won't treat you differently for exercising these rights. If you're not satisfied, you can complain to the Office of the Privacy Commissioner of Canada or your local regulator.

Security

Data is encrypted in transit, brokerage credentials from SnapTrade are encrypted at rest, connector tokens are stored hashed, and access is limited to what's needed to run Bywell. No system is perfectly secure; if a breach affects you, we'll tell you and the regulators as the law requires.

Age

Bywell is for people 18 and older (or the age of majority where you live). We don't knowingly collect information from children.

Changes and contact

If we make a material change, we'll tell you in the app or by email before it takes effect. Questions or requests: our privacy officer at privacy@bywell.org, or Kunolu Applications Inc., Toronto, Ontario, Canada.