Skip to content
Bobalor.

Privacy Policy

Last updated: October 22, 2026

1. Introduction

This Privacy Policy explains what personal data Bobalor collects, why, on what legal basis, who receives it, and the choices you have. It applies to bobalor.com and the Bobalor web application. Bobalor is operated by AllMyLooks AB (reg. no. 556786-4268), Hjälmvägen 21, 175 68 Järfälla, Sweden ("Bobalor", "we", "us"), which is the controller of the personal data described here. The policy covers readers and account holders, people who follow tickers, subscribe to the weekly letter or write to us, and the creators whose YouTube channels Bobalor analyzes (Section 11). Bobalor uses YouTube API Services (Section 10). If you have questions, write to info@bobalor.com.

2. Information We Collect

Account: your e-mail address, your first name, an optional last name, your language, your time zone, your date and time format, your currency, and a password (stored only as a hash through Supabase Auth; we never see it in plain text). If you sign in with Google or GitHub, we receive from that provider the details it shares for sign-in, such as your name and e-mail address. When you create an account you tick a box to accept the Terms of Service and this Policy and to confirm that you are at least 18. We keep the time of that acceptance and the versions of the Terms of Service and of this Policy that were shown to you, for as long as the account exists; an account with no such record is asked to accept when it next signs in. Profile: only if you add them in your settings: phone number, gender, date of birth, country, address, city, ZIP code, and a profile photo, which is stored at a publicly reachable address. Billing details: only if you enter them under Settings → Billing, a billing address (with a company name and VAT number for a business) and a billing e-mail address. Use of Bobalor: the tickers on your watchlist, notifications shown to you in the service, and the choices you make about analytics and e-mail, with the time you made them. Messages: what you send through the contact form or the in-app support form. Weekly letter: if you subscribe to the weekly letter, your e-mail address; a record of your request and of your confirmation (the times, the page and language you used, the campaign tags in the link that brought you to the form, if it had any, which say where the link was posted and for which campaign, and the versions of the Terms of Service and of this Policy that were shown to you); and whether an issue of the weekly letter was opened and which links in it were followed (see Section 8). Follow: if you use the Follow form, your e-mail address, the tickers you picked (if any), that you ticked the boxes for the Terms of Service and this Policy and for the weekly letter, and the same record of your request and of your confirmation as for the weekly letter. When you confirm through the link we e-mail you, we create an account for the address if it has none, add the tickers to its watchlist, record your acceptance of the Terms of Service and this Policy and your subscription to the weekly letter, and sign you in on the device you confirm on. Measurement: page-load timings and traffic counts (Vercel Speed Insights and Vercel Web Analytics) and product analytics (PostHog), described in Section 8. Server logs: our hosting provider keeps standard server logs, which can include your IP address, for a limited time, for security and troubleshooting. Abuse protection: when you send the contact form or the in-app support form, subscribe to the weekly letter, use the Follow form or ask for a sign-in link, we keep a scrambled form of your IP address (for the in-app support form, of your account ID) and, for the weekly letter, the Follow form and the sign-in link, of the e-mail address you typed, so that repeated submissions can be limited; when the link in a Follow e-mail or a sign-in link is used, we keep the same kind of value made from the link, so that one link cannot be tried over and over. The stored value is a one-way hash made with a secret key, so it does not reveal the address or the link; it counts for an hour at most, and it is cleared out when these forms are next used after a day has passed. Paid plans are not available yet; before the first purchase we will update this policy to describe the plan and payment details we then collect. We do not collect your YouTube viewing history, your investment portfolio or holdings, or personal data from anyone we know to be under 13. What we hold about creators is described in Section 11.

3. How We Use Your Information

We use personal data for these purposes, on these legal bases. To create and run your account, let you log in, show your watchlist and answer your messages: the contract between you and us (Article 6(1)(b) of the GDPR) and, for contact and support messages, our legitimate interest in answering you (Article 6(1)(f)). To keep a Follow request until you confirm it, e-mail you its link and, when you confirm it, create your account if the address has none, add the tickers you picked to your watchlist and sign you in: the contract between you and us, and the steps you ask us to take before entering into it (Article 6(1)(b)). We keep the record of the request with your account so that we can show what you asked for and accepted: our legitimate interest (Article 6(1)(f)). To keep Bobalor secure, prevent abuse, and understand in aggregate how it is used and how fast it runs, through traffic and performance measurement and PostHog's anonymous count: our legitimate interests (Article 6(1)(f)). To see whether the weekly letter is opened and which links in it are followed (Section 8): our legitimate interest in seeing whether it is worth sending (Article 6(1)(f)). For product analytics that recognise you across visits and for session replay: your consent (Article 6(1)(a)), which you give through the banner and can withdraw at any time. To send you the weekly letter by e-mail: your consent (Article 6(1)(a)), which you give by asking for it (where a box asks, it is never ticked in advance) and which counts only once the address is confirmed as yours, for instance through the link we e-mail you. You can withdraw it at any time; if you have an account and a watchlist, they stay as they are. To publish our analysis of creators' public videos: our legitimate interests (Article 6(1)(f)), explained in Section 11. To keep the records the law requires and to respond to authorities: a legal obligation (Article 6(1)(c)). We do not run advertising networks and we do not profile you across other websites. Today we do not sell your personal data and we do not use it to train models; if that changes, we will tell you in advance and ask for your consent where the law requires it. We do not take decisions about you based solely on automated processing that have legal or similarly significant effects on you.

4. How We Share Your Information

We share personal data only with the providers that help us run Bobalor, each acting for us under its own privacy and security commitments, and with authorities where the law requires it. The categories are: hosting, database and sign-in; e-mail delivery, for the contact and support messages, the confirmation e-mails (including the one for a Follow request), the sign-in links you ask for and the weekly letter; analytics and performance measurement (Section 8); sign-in with Google or GitHub, if you choose it; and, once paid plans start, payment processing. The text of creators' public videos goes to transcription and AI providers (Section 11); they receive no personal data about readers. We use YouTube API Services for public channel and video data (Section 10). We also disclose data where the law requires it or to protect Bobalor's or our users' rights and safety. Where a provider is outside the European Economic Area, Section 12 describes the safeguards.

5. Data Retention

Our database schema defines retention windows for pipeline data — raw video transcripts for 24 hours, and processed video and mention data for 30 days — after which they are designed to be automatically deleted. During Bobalor's current active development phase, the automated cleanup job that enforces those windows is deliberately paused so we can validate and improve the underlying scoring pipeline against a longer history; as a result, pipeline data is being retained longer than the 24-hour and 30-day windows described above for the time being. This is a temporary, disclosed state, not an indefinite policy — we will resume automatic cleanup and update this section when we do. Transcript text is never shown to you or to other users regardless of how long it is retained. Your account data is kept until you delete your account; deleting it also removes your watchlists, your subscription to the weekly letter, your Follow request, your profile photo and the billing details you have entered. If you subscribe to the weekly letter without an account, we keep your e-mail address with the record of your subscription. When you unsubscribe, we stop sending to it but keep the record, with the time you unsubscribed, so that we can show what you agreed to and when you withdrew it, until you ask us to delete it. A request for the weekly letter that you do not confirm expires after seven days and is deleted when the form is next used after that. A Follow request you do not confirm is deleted in the same way, when the Follow form is next used seven days or more after you made it, although the link in its e-mail works for only 24 hours; one you confirm is kept with your account until you delete the account, or until a new request from the same address replaces it. Messages you send us are kept for as long as needed to handle your request. If you buy a paid plan, billing records are kept for as long as the Swedish Bookkeeping Act requires. Our COPPA content-filter log (Section 9) is kept for as long as it is needed as an audit trail for the channels on our panel.

6. Data Security

All traffic to and from Bobalor is encrypted via HTTPS/TLS. Your account records are stored in a Postgres database protected by Row Level Security, so other users cannot read them; the one exception is a profile photo, which is stored at a publicly reachable address that anyone who has it can open. Passwords are hashed using Supabase Auth's secure storage (bcrypt) — we never see your plain-text password. API keys and service credentials are stored as environment variables and are never committed to our codebase.

7. Your Rights

You have the right to: access the personal data we hold about you; have inaccurate data corrected; have your data erased; restrict how we use it; object to processing that rests on our legitimate interests; receive your data in a portable format; and withdraw a consent you have given, at any time, without affecting what was done before. You can export your data and delete your account yourself under Settings → Privacy; deleting your account also removes your watchlists, your subscription to the weekly letter, your Follow request, your profile photo and the billing details you have entered. To use any other right, write to info@bobalor.com. We answer within one month; if a request is complex, or we receive many, we may extend that by up to two further months and tell you why within the first month. If we are unsure who is asking, we may ask you to confirm your identity before we act, and we may refuse a request that is manifestly unfounded or excessive, or charge a reasonable fee for it. Every issue of the weekly letter carries a link to unsubscribe, as does the welcome e-mail, and following it takes you off the list. If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (IMY) or to the supervisory authority in the country where you live or work.

8. Cookies & Tracking

Bobalor runs no advertising scripts and does not track you across other websites. We measure in two layers, and only the second one asks your permission. The first layer runs for everyone without asking: the three cookies below are strictly necessary, and for the measurement in this layer we take the position that it needs no consent, because it only counts in aggregate, for our own use, and does not recognise anyone from one day to the next. Three cookies are strictly necessary to run the service and are not measurement: a Supabase authentication-session cookie that keeps you logged in; NEXT_LOCALE, which keeps the language of the page you opened (we set it when you open an address that starts with /sv or /en, including when we send you there from a bare address according to your browser's language) so that the next page, and the app's pages that carry no language in their address, are shown in it; and — once you answer the banner below — bobalor_consent, which records your answer so we stop asking. If you change the colour theme in the app, your browser also keeps that choice in its local storage. Vercel Speed Insights measures how fast Bobalor's pages load and respond: each measurement carries the page address, a timing value, and a randomly generated per-visit identifier used only to avoid double-counting. Vercel Web Analytics counts page views and a small number of product events — reaching a signup form, or clicking through an upgrade prompt — so we can see which parts of Bobalor are actually used. Visitors are distinguished by a hash derived from the incoming request which is discarded after 24 hours; no IP address is stored, and nothing is linked to your Bobalor account, your email, or your identity. Addresses of our sign-in, sign-up and password-reset pages, and of the pages that confirm an e-mail address, a subscription to the weekly letter or a Follow request, or end a subscription, and of the page a sign-in link opens, have their query strings removed before they are measured, so the tokens those addresses carry, including the ones in a Follow link and a sign-in link, which sign you in, are not part of the measurements sent to Vercel or PostHog. The second layer is PostHog, and it is the one the banner asks about. Whatever you answer, PostHog receives, without a cookie and without a profile of you: page views, which buttons and links are clicked, where on a page people click and how far they scroll (heatmaps), page-speed measurements, reports of errors in our pages, and whether the banner was accepted or declined. You are identified only by a hash derived from the incoming request, using a secret that changes every day and is then destroyed, so the same person cannot be recognised from one day to the next. We take the position that this anonymous count needs no consent: it stores nothing that identifies you on your device, and we have a legitimate interest in knowing in aggregate how Bobalor is used. If you decline, PostHog stores one thing on your device — a note that you declined — for the same reason we do: it is how a refusal is honoured rather than forgotten and asked again. If you allow it, PostHog additionally sets its own cookies so we can recognise your visits over time — which is what lets us see whether people come back and follow a journey across several sessions — and records a replay of your visit: what is shown on the page, your clicks and scrolling, and the messages your browser prints to its developer console, with the text you type into forms masked. Replay does not run on the sign-in, sign-up, password-reset and e-mail confirmation pages, on the pages that confirm or end a subscription to the weekly letter or confirm a Follow request, on the page a sign-in link opens, or on the account, settings and billing screens. PostHog processes this on servers in Frankfurt, and your browser sends it through bobalor.com rather than contacting PostHog directly. Your answer is saved in a cookie for one year. To change it, use Cookie settings in the site footer, which opens the banner again, or, when you are signed in, the Product analytics switch under Settings → Privacy; both change the answer in the browser you use them in. Clearing the cookies and site data that bobalor.com has stored in your browser also makes the banner ask again. If you are signed in when you answer, your account also keeps a dated record of each change to your answer, where you made it (the banner or Settings) and which version of this Policy applied; it is part of your data export. Separately, our e-mail provider Resend records whether an issue of the weekly letter was opened (using a small tracking image) and which links in it you followed. The weekly letter is sent from news.bobalor.com, with its links routed through links.news.bobalor.com; the other e-mails we send, such as the confirmation e-mails and the e-mails about your account, are not measured. That information is tied to your e-mail address rather than being anonymous, it is used only to see whether the weekly letter is worth sending, and unsubscribing ends it.

9. Children's Privacy

Bobalor is not directed at children, and you must be at least 18 years old to create an account (see our Terms of Service). We do not knowingly collect personal data from anyone under 13. Separately, at the content level, videos flagged by their creators as "made for kids" are automatically excluded from our analysis pipeline before a transcript is fetched or any analysis is made, and we keep a log of videos excluded for that reason for audit purposes — this keeps child-directed content out of our database and our analysis, independent of our user-account age policy.

10. YouTube API Services

Bobalor uses YouTube API Services to read public information about the channels and videos it analyzes: channel names, descriptions, thumbnails and subscriber counts, and video titles, descriptions, tags, publication times and counts. By using Bobalor you also agree to be bound by the YouTube Terms of Service, and Google's handling of data is described in the Google Privacy Policy. Bobalor does not ask for access to your YouTube account, and nothing from your YouTube account or viewing history reaches us. Because this data is about creators, it is described in Section 11; reading Bobalor involves no personal data from YouTube about you.

11. Creators on Our Panel

Bobalor analyzes what a panel of finance creators says in public YouTube videos. If you are one of them, this section is the information we owe you under Article 14 of the GDPR. What we hold: your channel's name, description, thumbnail, declared country and subscriber count, and, for your videos, the titles, descriptions, tags, publication times and counts that YouTube provides. What we publish: your channel's name, thumbnail, declared country, subscriber count (with the size tier derived from it) and a link to your channel; the titles and dates of your videos, with links to them on YouTube; and our own analysis of what is said about each ticker (stance, conviction, signal type and a short explanation written by an AI model). Where it comes from: the channel and video data comes from YouTube API Services; the spoken words come as a transcript from a transcription provider in the EU and are analyzed by an AI provider in the United States (Section 12); the transcript is never shown. We publish this on bobalor.com, on your profile page and on the pages of the tickers you discuss, and we link to your videos on YouTube. Our legal basis is our legitimate interest, and our readers', in reading what a panel says publicly about financial instruments with the source one click away (Article 6(1)(f)); we have weighed that against your interests and documented the assessment, and can share it on request. We keep the data as described in Section 5, including that cleanup is paused for now, and channels that are no longer on the panel keep their public profile. You can access your data and have it corrected. You can object at any time to our processing of your data as a creator: write to info@bobalor.com; we assess each objection on its own merits, weighing your situation against our interest in reporting what is said publicly, and we answer within one month with our decision and our reasons. If the case is complex, we may take up to two further months, and we tell you why within the first month. You can also complain to the Swedish Authority for Privacy Protection (IMY). Our analysis classifies what is said about each ticker; it decides nothing about you.

12. International Data Transfers

Our primary database is hosted in the European Union (Ireland), our application runs in Ireland, our e-mail provider sends from its EU region, and PostHog processes in Frankfurt. Several of our providers are US companies, so personal data can be processed in, or reached from, the United States. For providers certified under the EU–US Data Privacy Framework we rely on the European Commission's adequacy decision for it; on the date of this policy that is Vercel (hosting), Resend (e-mail; its re-certification is under review), PostHog (analytics) and Google (YouTube API Services and, if you choose it, sign-in), and GitHub if you sign in with it. Supabase, our database and sign-in provider, is not on that list; we rely on the standard contractual clauses in its data processing terms. Our AI provider, OpenAI, which receives the text of creators' public videos (Section 11) but no personal data about readers, is in the United States and is not certified under the framework; we are putting the standard contractual clauses in its data processing terms in place for that transfer. You can ask us for details of the safeguards for any of these transfers.

13. Readers in the United States

Bobalor does not respond to Do Not Track signals today. We do not sell your personal data and we do not use it for targeted advertising. If that changes, we will tell you before it does and ask for your consent where the law requires it. We tell you about changes to this policy as described in Section 14.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to our practices or to legal requirements. We will post the updated policy with a new "Last updated" date and, for a material change, give registered users at least 30 days' notice in the service or by e-mail before it takes effect.

15. Contact Us

Questions about this Privacy Policy, or requests to exercise your data rights, can be sent to info@bobalor.com. Bobalor's data controller is AllMyLooks AB (reg. no. 556786-4268), Hjälmvägen 21, 175 68 Järfälla, Sweden. You can also complain to the Swedish Authority for Privacy Protection (IMY).