Privacy Policy
Last updated: August 7, 2026
1. Introduction
This Privacy Policy explains what personal data Bobalor collects, how we use it, and the choices you have. It applies to bobalor.com and the Bobalor web application. Bobalor is operated by AllMyLooks AB, Hjälmvägen 21, 175 68 Järfälla, Sweden ("Bobalor", "we", "us"). If you have questions, contact us at info@bobalor.com.
2. Information We Collect
Account data: your email address, an optional display name, and a password (hashed via Supabase Auth — we never see or store it in plain text). Usage data: the tickers on your watchlist and your subscription plan and billing status (managed via Stripe). Content you send us: messages you submit through the contact form or the in-app support form. Performance data: page-load and responsiveness timings, collected via Vercel Speed Insights (see Section 8, Cookies & Tracking) and never linked to your Bobalor account. Traffic data: aggregated page views, referring website, country, device type, and the steps that make up our signup and upgrade funnel, collected via Vercel Web Analytics (see Section 8) — cookieless, aggregate-only, and never linked to your Bobalor account. Email engagement: if you subscribe to the Daily Bubble Brief, whether a given issue was opened and which links in it were followed. Product analytics: if you allow it, how you move through Bobalor between visits — which pages you open, which of a small set of product events you trigger, and a replay of your session on the public pages, with text you type into forms masked and the account, settings and billing screens never recorded. You can decline this and change your mind at any time; declining costs you nothing you can read. We do not run advertising networks, we do not profile you across other websites, and we do not sell data. We do not collect your YouTube viewing history, your personal investment portfolio or holdings, or personal data from anyone we know to be under 13.
3. How We Use Your Information
We use your account data to let you log in, personalize the Bubble Radar to your watchlist, process billing through Stripe, and send you service-related email (account confirmations, billing receipts, and, if you opt in, the daily brief by email). We use support and contact-form messages solely to respond to your request. We do not use your data to train models, and we do not sell it.
4. How We Share Your Information
We do not sell your personal data. We share it only with the service providers who help us run Bobalor, each acting under their own privacy commitments: Supabase (database, authentication, and hosting — hosted in the EU); Vercel (application hosting and the traffic and performance measurement described in Section 8); PostHog (product analytics, described in Section 8 — hosted on PostHog Cloud EU in Frankfurt, and reached through bobalor.com rather than directly, so your browser never contacts them); Stripe (payment processing — Stripe never shares your full card details with us); Resend (transactional and newsletter email delivery, including the open and click measurement described in Section 8); and, if you sign in with Google or GitHub, that provider (identity verification only). Our content-ingestion pipeline also draws on the YouTube Data API to source the public videos we analyze — this does not involve your personal data. Video transcript text is processed by one or more third-party AI providers, chosen per task and cost, as part of that same pipeline. We disclose data if required by law or to protect Bobalor's or our users' rights and safety.
5. Data Retention
Our database schema defines retention windows for pipeline data — raw video transcripts for 24 hours, and processed video and mention data for 30 days — after which they are designed to be automatically deleted. During Bobalor's current active development phase, the automated cleanup job that enforces those windows is deliberately paused so we can validate and improve the underlying scoring pipeline against a longer history; as a result, pipeline data is being retained longer than the 24-hour and 30-day windows described above for the time being. This is a temporary, disclosed state, not an indefinite policy — we will resume automatic cleanup and update this section when we do. Transcript text is never shown to you or to other users regardless of how long it is retained. Your account data is kept until you delete your account; subscription and billing records are retained for 7 years to meet financial record-keeping requirements; our COPPA content-filter log (Section 9) is retained indefinitely as a compliance audit trail.
6. Data Security
All traffic to and from Bobalor is encrypted via HTTPS/TLS. Your data is stored in a Postgres database protected by Row Level Security, so your account data can only be accessed by you and by Bobalor's own systems. Passwords are hashed using Supabase Auth's secure storage (bcrypt) — we never see your plain-text password. API keys and service credentials are stored as environment variables and are never committed to our codebase.
7. Your Rights (GDPR/CCPA)
Depending on where you live, you may have the right to: access the personal data we hold about you; correct inaccurate data; delete your account and associated data; export your data (available now from Account Settings for your profile and account records); and opt out of marketing email at any time via the unsubscribe link in every email we send. To exercise any of these rights, contact us at info@bobalor.com or use the relevant control in Account Settings.
8. Cookies & Tracking
Bobalor runs no advertising scripts and does not track you across other websites. We measure in two layers, and only the second one asks your permission. The first layer never touches your device and runs for everyone. Three cookies are strictly necessary to run the service and are not measurement at all: a Supabase authentication-session cookie that keeps you logged in, a cookie that remembers your language preference (English or Swedish), and — once you answer the banner below — a cookie that records your answer so we stop asking. Vercel Speed Insights measures how fast Bobalor's pages load and respond: each measurement carries a page path, a timing value, and a randomly generated per-visit identifier used only to avoid double-counting. Vercel Web Analytics counts page views and a small number of product events — reaching a signup form, or clicking through an upgrade prompt — so we can see which parts of Bobalor are actually used. Visitors are distinguished by a hash derived from the incoming request which is discarded after 24 hours; no IP address is stored, and nothing is linked to your Bobalor account, your email, or your identity. Addresses from our sign-in and password-reset pages have their query strings removed before measurement, so one-time login tokens never reach a measurement provider. The second layer is PostHog, and it is the one the banner asks about. Whatever you answer, PostHog counts your visit without measuring anything on your device: you are identified only by a hash derived from the incoming request, using a secret that changes every day and is then destroyed, so the same person cannot be recognised from one day to the next. If you decline, PostHog stores one thing and one thing only — a note that you declined — for the same reason we do: it is how a refusal is honoured rather than forgotten and asked again. If you allow the identified layer, PostHog additionally sets its own cookies so we can recognise your visits over time — which is what lets us see whether people come back, follow a journey across several sessions, and watch a replay of how a page was actually used. Session replay masks the text you type into forms and never runs on the account, settings or billing screens. If you decline, none of that happens and only the daily anonymous count remains. You can change your answer at any time under Settings → Privacy, and signed-in accounts keep a record of the choice and when it was made. PostHog processes this on servers in Frankfurt, and your browser sends it through bobalor.com rather than contacting PostHog directly. Separately, if you subscribe to the Daily Bubble Brief, our email provider Resend records whether an issue was opened (using a small tracking image) and which links you followed, with links routed through links.bobalor.com. That information is tied to your subscriber record rather than being anonymous, it is used only to see whether the brief is worth reading, and unsubscribing ends it.
9. Children's Privacy
Bobalor is not directed at children, and you must be at least 18 years old to create an account (see our Terms of Service). We do not knowingly collect personal data from anyone under 13. Separately, at the content level, videos flagged by their creators as "made for kids" are automatically excluded from our analysis pipeline before any processing occurs, and each exclusion is logged for audit purposes — this protects against child-directed content entering our system at all, independent of our user-account age policy.
10. International Data Transfers
Our primary database is hosted in the European Union (Ireland). Some of the service providers listed in Section 4 — including Stripe, Resend, and Google — may process data outside the European Economic Area, including in the United States. Where that happens, we rely on those providers' own compliance mechanisms, such as Standard Contractual Clauses, to ensure your data continues to receive an adequate level of protection.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes to our practices or to legal requirements. We will post the updated policy with a new "Last updated" date and, for material changes, make reasonable efforts to notify registered users by email.
12. Contact Us
Questions about this Privacy Policy, or requests to exercise your data rights, can be sent to info@bobalor.com. Bobalor's data controller is AllMyLooks AB, Hjälmvägen 21, 175 68 Järfälla, Sweden.