Privacy Policy

What we collect depends on how you use jonbur:

• Account: your email address, a password (stored only as a scrambled hash we can't read), or, if you sign in with Google, your Google account name, email and profile photo.
• Profile: your username, display name, photo, bio, privacy settings, and creator details such as a linked YouTube or TikTok channel if you apply to be a verified creator.
• What you post: posts, comments, images, likes, reposts, bookmarks, follows and reports.
• Chat: messages you send in a stock's live chat, and reports you make about messages.
• Swipe and sharing: stocks you like or mark "not interested" in Swipe (so it shows you better picks), the return cards you share, and gifts you send or claim (which stock, when, and whether a gift was paid or held).
• Watchlists and interests: the stocks you follow and the sectors you pick during sign-up.
• Paper portfolios: your simulated trades and holdings. These use pretend money; no real money or real shares are involved.
• Questions and research: the questions you ask Warren and the research reports you request.
• Payments: if you subscribe, your plan, billing period and payment status. Card and PayPal details are handled by the payment provider; we never see or store your full card number.
• Usage: pages you visit, features you use, your daily visit streak and when you last used the site.
• Device and connection: IP address, approximate country (from our network provider), browser type, language and similar technical details sent with every web request.
• Notifications on your devices: if you turn on push notifications, your browser's push address and keys for that device, your time zone, quiet hours and which types you chose, plus which pushes we sent and whether you opened them.
• Reminders: the Korea events you ask us to remind you about.
• Memberships waitlist and invites: your place on the waitlist, the creators you're waiting for, who invited you, and how your own invites are doing.
• Messages to us: what you send through the help center or by email, with your email address.

• To run your account and the service: signing you in, showing your feed, saving your watchlists and paper portfolio, and answering your questions.
• To show the social side: your public profile and posts are visible to others as your settings allow.
• To take payments and manage subscriptions.
• To keep the community safe: spotting spam, fraud, market manipulation and other rule-breaking, and handling reports.
• To send service emails: confirming your email, password resets and important changes. We don't send marketing emails without your permission.
• To understand and improve the product, for example which features are used.
• To meet legal duties, such as keeping payment records and answering lawful requests from authorities.

"For you" mixes people's posts with items the site writes (news, filings, price movers, Korea events, research and the daily market wrap). We rank them using who you follow, the stocks on your watchlist and in your paper portfolios, the themes you picked, how recent and how popular a post is, how important a news item or filing is likely to be, and the feed settings you choose in Settings → Feed. "Following" shows only the people you follow, newest first.

We don't use information about you from other websites, nobody can pay to appear in your feed, and posts our team pins are labelled "Staff pick".

Discover, Swipe and the rankings use the same kinds of signals: what's popular on jonbur (posts, views, watchlist adds, paper buys), news and filings, price moves, the themes you picked and the stocks you liked or hid in Swipe. The buzz score and signals are calculated from these numbers; they describe activity and are not recommendations.

If EU or UK data protection law applies to you, we rely on:

• Contract: to provide the service you signed up for, including paid plans.
• Legitimate interests: to keep the service secure, prevent abuse and improve the product, where those interests aren't outweighed by your rights.
• Consent: for anything optional, such as marketing emails, non-essential cookies or connecting a partner service. You can withdraw consent at any time.
• Legal obligation: where the law requires us to keep or share information.

We don't sell your personal information, and we don't share it for advertising. We share it only with companies that help us run jonbur, under contracts that limit what they can do with it:

• Hosting and databases: our servers and database are run by a cloud hosting provider (currently Railway, in the United States).
• Email: transactional emails are sent through an email delivery provider (currently Postmark).
• Payments: Stripe and PayPal process subscription payments.
• Sign-in: Google, if you choose to sign in with Google.
• AI and translation: questions you ask, company documents we translate or summarise, and public posts and chat messages about a stock (without names or account details, to summarise the community's mood for that stock) are processed by AI and translation providers (for example Anthropic). We send only what's needed for the task, and we don't allow them to use it to train their models where we can control this.
• Video platforms: YouTube and TikTok, only if you connect a creator channel.
• Analytics: if we add an analytics tool, it will only run after you agree to it in a cookie notice.
• A future brokerage partner: if we later offer real trading through a licensed broker, we'll only share your information with that broker if you choose to open an account with them and agree to it at that time.
• Analytics: Google (Google Analytics), as described below.
• Bot protection: Cloudflare Turnstile checks the sign-up, login and help forms for automated abuse. It looks at your browser and network, not at your account.
• Push notifications: delivered through your browser maker's push service (for example Google, Apple or Mozilla), which only passes on an encrypted message to your device.

We may also share information if the law requires it, to protect people's safety or our rights, or as part of a merger or sale of the business (in which case this policy keeps applying).

This section covers the optional "Connect YouTube" feature (Settings > Connected accounts) and "Also post to YouTube" in the composer.

• When you choose "Connect YouTube", jonbur asks Google for two permissions: youtube.readonly, to show your own channel's name, picture and videos on your jonbur profile and in posts you create; and youtube.upload, to upload and schedule videos to your channel, only when you choose "Also post to YouTube" for a post.
• jonbur never uploads anything without your action, never edits or deletes your existing videos (except cancelling a scheduled upload you made through jonbur), and does not access any other Google data.
• We keep your channel's ID, name and picture, a Google refresh token (stored encrypted) so uploads can run in the background, and the details of the uploads you ask for (title, description, tags, privacy, schedule and status).
• This data is used only to provide this feature. It is not sold, not used for advertising, and not transferred to others except as needed to run the service (for example our hosting provider).
• You can disconnect at any time in Settings > Connected accounts ("Disconnect YouTube"): we revoke jonbur's access with Google and delete the stored YouTube data. Posts you already published, and videos already on YouTube, stay until you delete them. You can also revoke access at https://myaccount.google.com/permissions.

JONBUR's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

When you use the YouTube feature you agree to YouTube's Terms of Service. Google's handling of your data is covered by the Google Privacy Policy.

We are based in Korea, and most of our providers store or process data in the United States and other countries. When your information leaves your country, we use the protections the law requires, such as contracts based on standard data protection clauses. Under Korea's Personal Information Protection Act (PIPA), the details are: the information listed above; sent to the providers named above; to the United States and the other countries where they operate; sent over encrypted connections when you use the service; for the purposes above; and kept as described in the next section. If you don't want your information transferred, you can close your account, but we can't run the service without these providers.

• Account and profile: while your account is open. When you delete it, it is switched off at once and deleted or anonymised after 14 days, except as below.
• Posts and comments: deleted with your account, unless you choose to keep them shown as "Deleted user" (without your name, photo, bio or links). Copies quoted or reposted by others may show as "deleted".
• Payment and subscription records: 5 years, as Korean e-commerce law requires.
• Records of complaints and disputes: 3 years.
• Access logs (IP address and visit times): at least 3 months, as Korean law requires, and generally no longer than 12 months.
• Security and abuse records, such as bans: as long as needed to stop the same abuse coming back.

We use encrypted connections (HTTPS) everywhere, store passwords only as strong one-way hashes, encrypt sensitive tokens, limit who on our team can access personal data, and keep sign-in links short-lived and single-use. No system is perfectly secure, so please use a strong password you don't use elsewhere. If a breach affects you, we'll tell you and the authorities as the law requires.

We use a small number of cookies:

• Essential: keeping you signed in, protecting forms against misuse, and remembering security steps during sign-in. The site can't work without these.
• Preferences: remembering your language and the currency you chose for prices.
• Invites and fraud prevention: if you open someone's invite link, we remember their code for 30 days so they get credit when you sign up. We also set a random device ID (no personal details) and keep one-way scrambled versions of it and of your network address, only to spot people inviting themselves for paper-money rewards.
• Analytics: Google Analytics cookies, only as described in "Google Analytics" below. Visitors in the EU/EEA, UK and Switzerland are asked first; everyone can switch them off with "Cookie settings" at the bottom of every page.
• On your device only (not cookies): the app remembers how many times you've visited (to decide when to suggest installing it), banners you closed and whether you've read today's market wrap. This never leaves your device.

You can delete cookies in your browser settings; you'll then be signed out.

Separately from Google Analytics, we count page views and actions (such as signing up, posting, adding to a watchlist or making a paper trade) in our own database, to see how jonbur is used and what to improve. This is first-party only: nothing goes to other companies and no cookie is used. A visit is recognised by a scrambled code made from your network address and browser that changes every day, so it can't follow you from one day to the next. If you're signed in, the action is linked to your account. We also note the country (from our network provider), the type of device and the website that sent you. Raw records are deleted after 13 months; after that we keep only daily totals that don't identify anyone.

We use Google Analytics 4 to understand which pages and features are used, so we can improve jonbur. It sets cookies in your browser and sends Google:

• the pages you view and how you got there (for example a search engine or a link), your approximate location (country/city from your IP address, which Google doesn't store), device, browser and language;
• events such as signing up, logging in, finishing onboarding, adding a stock to your watchlist, a paper trade, creating a post or comment, following someone, viewing a research page, asking Warren a question, starting a checkout or subscribing (with the plan and price);
• if you're signed in and have allowed analytics, a random internal user number so visits on different devices can be counted together. We never send your email, name, username or anything you write.

Consent: in the EU/EEA, the UK and Switzerland analytics stays off until you accept it in the cookie banner (Google Consent Mode: no analytics cookies are set before that). Elsewhere it's on by default and you can switch it off any time.

Opt out: use "Cookie settings" at the bottom of any page, or Google's browser add-on (tools.google.com/dlpage/gaoptout). Google Analytics isn't used on admin pages or for our own staff.

Google processes this data as our processor under its data processing terms and keeps it for 14 months. Google's privacy policy: policies.google.com/privacy.

Wherever you live, you can ask to see the personal information we hold about you, correct it, download a copy, or delete it, and you can object to how we use it. Depending on where you live, the law gives you specific rights:

• Korea (PIPA): you can ask to access, correct, delete or suspend the processing of your information, and withdraw consent. You can also contact the Personal Information Dispute Mediation Committee or the Korea Internet & Security Agency's privacy report centre.
• EU and UK (GDPR): access, correction, deletion, restriction, portability, objection, and the right to withdraw consent. You can also complain to your local data protection authority.
• California (CCPA/CPRA): the right to know what we collect, to delete and correct it, and to opt out of the "sale" or "sharing" of personal information (we don't do either). We won't treat you differently for using these rights. You can use an authorised agent.

Email [email protected] from the address on your account. We may need to confirm it's you, and we'll answer within the time the law sets (usually within 10 days in Korea and one month in the EU and UK).

You can delete your account yourself in Settings → Account → Delete account (or email [email protected] from the address on your account). You choose whether your posts and comments are deleted too or kept as "Deleted user". Any active subscription is cancelled at once, so nothing more is charged.

Your account is switched off and hidden straight away and deleted after 14 days; until then you can sign in and restore it. We email you when deletion starts and when it's done. Our backups are kept for 14 days, so a deleted account disappears from them within 14 days after that.

You can also download a copy of your data (profile, posts, comments, paper trades, watchlist) in Settings → Account → Download my data.

jonbur is for adults. You must be 18 or older to create an account. We don't knowingly collect information from anyone under 18; if we learn we have, we'll delete it. If you think a child has signed up, please tell us.

If we make important changes, we'll tell you by email or on the site before they take effect. The date at the top shows when this policy last changed.

Privacy questions and requests: [email protected]. Our privacy officer can be reached at the same address. Everything else: [email protected].