Privacy Policy
Effective: 2026-08-15
Last updated: 2026-08-15
1. The short version
- We collect your email address so we can send you the briefing.
- We collect how you found us (the referral source or UTM tag on the link you signed up through).
- We collect whether you open and click emails, through beehiiv.
- We collect anonymous-ish product analytics on bellprep.com through PostHog, error reports through Sentry, and server logs through Cloudflare.
- We do not collect anything you type into the calculators. They run entirely inside your browser. Nothing you enter is sent to us or to anyone else.
- We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
- We never ask for and never want your brokerage login, your account balance, your positions, your net worth, or any financial account data.
- You can unsubscribe from every email with one click, and you can ask us to delete your data at
hello@bellprep.com.
The rest of this page is the detail. It is written to be read, not to be skipped.
2. Who the publisher is
BellPrep is published by:
Novelty Capital
Privacy contact: hello@bellprep.com, hello@bellprep.com
Novelty Capital is the controller of the personal data described here. BellPrep is offered to residents of the United States only, and is not offered to residents of the EEA or the UK.
Not applicable — the controller is established in the European Union (Bulgaria), so no Article 27 representative is required.
3. What is collected
3.1 Data you give us
| What | When | Why |
|---|---|---|
| Email address | When you subscribe | To send the daily briefing and service messages |
| Confirmation of subscription (double opt-in record) | When you click the confirmation link | Proof of consent, anti-abuse, deliverability |
| Anything you write to us | When you email hello@bellprep.com | To answer you, and to keep a record of the exchange |
| Correction reports and scorecard queries | When you send one | To investigate and to publish a correction if needed |
3.2 Data collected about how you signed up
| What | Source | Why |
|---|---|---|
| Referral source, UTM parameters, landing page, signup form used | The link you arrived through | To know which channels bring subscribers who actually read the briefing |
| Approximate signup date and time | Our systems | Record-keeping, consent proof |
| IP address and user agent at the moment of signup | Your browser | Anti-spam, anti-bot, and CAN-SPAM/consent record-keeping. Retained for a limited period; see Section 6. |
3.3 Email engagement (beehiiv)
beehiiv records email opens (via a tracking pixel), link clicks, bounces, spam complaints, and unsubscribes. Open tracking is unreliable by design (many mail clients block or pre-fetch pixels), and we treat it as a rough signal, not a fact about you.
3.4 Website analytics (PostHog)
On bellprep.com, PostHog records page views, referring URL, approximate location derived from IP at the country or region level, device and browser type, and events like “opened the position size calculator” or “clicked subscribe”.
PostHog records that a calculator was used. It does not record what was entered into it. See Section 4.
3.5 Error monitoring (Sentry)
If something breaks in your browser or on our side, Sentry captures the error: the message, a stack trace, the page URL, the browser and operating system, and a timestamp. This may incidentally include an IP address.
We configure Sentry to scrub form field values from error reports so that calculator inputs are not captured in a crash. If you ever see evidence that this failed, please tell us at hello@bellprep.com and we will treat it as a priority.
3.6 Server and network logs (Cloudflare)
bellprep.com is hosted on Cloudflare Pages and sits behind Cloudflare’s network. Cloudflare processes standard request data: IP address, timestamp, requested URL, response code, user agent, and security signals used to block attacks and abusive traffic.
4. What is deliberately NOT collected
This section is a design commitment, not just a description.
The calculators are stateless and run entirely in your browser. The position size calculator, the R-multiple calculator, and the other tools at bellprep.com are client-side JavaScript. When you type in an account size, an entry price, a stop, a risk percentage, or a position size:
- Nothing you type is transmitted to our servers.
- Nothing you type is transmitted to beehiiv, PostHog, Sentry, Cloudflare, or any other third party.
- Nothing you type is stored on any server, by us or by anyone else.
- Values exist only in your browser’s memory and are gone when you close or reload the page.
This was a deliberate choice. Calculator inputs would tell us your account size and your risk appetite, which is exactly the kind of information a market publisher should not be holding. Not collecting it means it cannot be breached, subpoenaed, sold, or used to make the content feel personalised, and it is one of the practical ways BellPrep stays clearly on the publisher side of the line described in the Disclosures page.
We also do not collect, and will not ask you for:
- brokerage or bank credentials of any kind;
- account balances, buying power, margin, or net worth;
- positions, trade history, or order data;
- Social Security numbers or government identifiers;
- payment card numbers or bank account numbers (when the paid tier launches, Paddle handles payment data and we never see the full card details);
- precise geolocation;
- data about your health, race, religion, politics, sexual orientation, or any other special category of data.
We do not sell personal information. We do not share personal information for cross-context behavioural advertising. We do not rent, trade, or licence subscriber lists.
5. Why the data is processed, and on what basis
| Purpose | Data used | Basis |
|---|---|---|
| Sending the daily briefing you asked for | Email address, subscription record | Your consent, given by double opt-in, and performance of the service you signed up for |
| Confirming your subscription and proving consent | Email, timestamp, IP, user agent | Legal obligation and legitimate interests (proof of consent, anti-abuse) |
| Making the briefing better (which sections get read) | Aggregate engagement data | Legitimate interests in improving the product |
| Understanding which channels bring real readers | Referral source, UTM, aggregate signup data | Legitimate interests in running the business |
| Keeping the site up and blocking abuse | Server logs, security signals | Legitimate interests in security |
| Fixing bugs | Error reports | Legitimate interests in a working service |
| Answering your email | Whatever you send | Legitimate interests, and your request |
| Handling paid subscriptions (future) | Subscription status from Paddle | Contract performance |
| Meeting legal and record-keeping obligations | As required | Legal obligation |
We do not use your data for automated decision-making that produces legal or similarly significant effects. We do not profile you to change the content you receive: every subscriber on a given tier gets the same briefing.
Plain English (not part of the agreement): we use your email to send you the email. We look at aggregate numbers to see what is working. That is essentially it.
6. How long data is kept
| Data | Retention |
|---|---|
| Email address and subscription record | For as long as you are subscribed |
| After you unsubscribe | A suppression record (hashed or minimal email record) is kept indefinitely so we do not email you again by accident. This is required to honour your opt-out. Everything else about you is deleted or de-identified within 90 days. |
| Signup IP and user agent | 12 months |
| Email engagement data in beehiiv | 24 months, then aggregated or deleted |
| PostHog product analytics | 12 months |
| Sentry error reports | 90 days |
| Cloudflare logs | Per Cloudflare’s standard retention, generally short. See their documentation. |
| Email correspondence with us | 24 months, longer where there is a legal reason to keep it |
| Billing and tax records (future paid tier) | As required by law. Note these mainly sit with Paddle as merchant of record. |
If you ask us to delete your data, we will, except for the suppression record and anything we are legally required to keep.
7. Sub-processors
These are the third parties that process personal data on our behalf. Each has its own privacy policy and its own security commitments.
| Sub-processor | Role | Data involved | Where | Policy |
|---|---|---|---|---|
| beehiiv, Inc. | Email platform: stores the subscriber list, sends the briefing, records opens, clicks, bounces, unsubscribes | Email address, engagement data, signup metadata | United States | https://www.beehiiv.com/privacy |
| PostHog, Inc. | Product analytics on bellprep.com | Page views, events, device and browser data, IP-derived coarse location | United States and/or EU depending on the instance used | https://posthog.com/privacy |
| Functional Software, Inc. (Sentry) | Error and performance monitoring | Error messages, stack traces, URLs, browser and OS, incidental IP | United States | https://sentry.io/privacy/ |
| Cloudflare, Inc. | Hosting (Cloudflare Pages), CDN, DNS, security | Request logs, IP addresses, security signals | Global edge network | https://www.cloudflare.com/privacypolicy/ |
| Paddle.com Market Limited (from paid-tier launch only) | Merchant of record: payment processing, billing, refunds, tax | Name, billing address, payment data, transaction records. Paddle is an independent controller for the payment relationship, not only our processor. | United Kingdom / global | https://www.paddle.com/legal/privacy |
We will update this table when it changes. If you want notice of changes to sub-processors, ask at hello@bellprep.com.
8. Email: double opt-in, unsubscribe, CAN-SPAM
8.1 Double opt-in
We use double opt-in. After you enter your email, we send a confirmation message. You do not receive the briefing until you click the link in it. If you never click, you never get added, and the pending record is discarded.
This is deliberate. It means nobody can sign you up without your knowledge, and it means our list only contains people who actually asked.
8.2 Unsubscribing
Every email we send contains a working unsubscribe link. One click, no login, no confirmation screen, no “are you sure”, no exit survey you have to complete. We also support List-Unsubscribe headers, including one-click unsubscribe, so your mail client’s own unsubscribe button works.
Unsubscribes are processed immediately, and in any case within 10 business days as required by law. You can also email hello@bellprep.com and we will do it for you.
We will not send you marketing email after you unsubscribe. We will not add you back if you sign up again through a form we cannot verify.
8.3 CAN-SPAM
BellPrep complies with the US CAN-SPAM Act, 15 U.S.C. §7701 et seq. In practice:
- The “From” line and header information identify the sender honestly.
- Subject lines describe the content and are not deceptive.
- The message is identifiable as a commercial email where required.
- Every email includes a valid physical postal address. This is a legal requirement and it is why our address is at the bottom of every send.
- Every email includes a clear and working opt-out mechanism, honoured promptly.
- We do not sell or transfer your address to another sender after you opt out.
If you get an email that appears to be from BellPrep and it does not have those things, it is not from us. Please forward it to hello@bellprep.com.
9. Cookies and analytics, and how to opt out
9.1 What is set
| Type | Set by | Purpose |
|---|---|---|
| Strictly necessary | Us / Cloudflare | Site security, bot mitigation, load balancing. The site does not work without these. |
| Analytics | PostHog | A first-party identifier so repeat visits are not counted as new people, plus event data |
| Attribution | Us | Remembers the UTM or referral source between landing on the site and subscribing |
| Email tracking pixel | beehiiv | Records that an email was opened |
We do not use advertising cookies, retargeting pixels, or third-party ad network tags on bellprep.com. If that ever changes, this page changes first, and we will say so plainly.
9.2 How to opt out
- Analytics: use the “Do not track me” control at
https://bellprep.com/privacy, or set your browser’s Global Privacy Control (GPC) signal. We honour GPC as an opt-out of analytics and, for California residents, as a valid opt-out signal under CPRA. - Cookies generally: block or delete them in your browser settings. Strictly necessary cookies may be reinstated because the site needs them.
- Email open tracking: turn off remote image loading in your email client. This blocks the pixel. Nothing else about your subscription changes.
- Everything: unsubscribe. Then we have essentially nothing on you but a suppression record.
10. California rights (CCPA/CPRA)
If you are a California resident, the California Consumer Privacy Act as amended by the CPRA gives you the rights below. We honour them for everyone, whether or not the statute applies to us and whether or not you live in California, because running two standards is a poor way to treat people.
10.1 Categories of personal information
In the 12 months before the date at the top of this page, we may have collected these statutory categories:
| Category | Collected? | Examples | Source | Disclosed to |
|---|---|---|---|---|
| Identifiers | Yes | Email address, IP address, device identifiers | You, your browser | beehiiv, PostHog, Sentry, Cloudflare |
| Internet or network activity | Yes | Page views, email opens and clicks, referral source | Your browser, beehiiv | PostHog, beehiiv, Cloudflare |
| Geolocation (coarse only) | Yes | Country or region derived from IP | Your browser | PostHog, Cloudflare |
| Commercial information | Only from paid-tier launch | Subscription status, transaction records | Paddle | Paddle |
| Financial account information | No | |||
| Biometric information | No | |||
| Precise geolocation | No | |||
| Sensitive personal information | No | |||
| Inferences / profiles | No | We do not build profiles about you |
10.2 We do not sell or share
Novelty Capital does not sell personal information, and does not share personal information for cross-context behavioural advertising, as those terms are defined in the CCPA/CPRA. We have not done so in the preceding 12 months. We do not sell or share the personal information of minors, and we do not knowingly have any, because BellPrep is for adults only.
10.3 Your rights
- Right to know what we collect, why, where it came from, and who we disclose it to, including the specific pieces of personal information we hold about you.
- Right to delete the personal information we hold about you, subject to legal exceptions.
- Right to correct inaccurate personal information.
- Right to opt out of sale or sharing. There is nothing to opt out of, because we do not sell or share, but the right stands and the GPC signal is honoured.
- Right to limit use of sensitive personal information. We do not collect any.
- Right to non-discrimination. We will not deny you the service, charge you a different price, give you a lower quality service, or treat you worse in any way for exercising a privacy right. Practically: asking us to delete your data, or opting out of analytics, does not change the briefing you receive or what it costs.
10.4 How to exercise them
Email hello@bellprep.com with the subject line PRIVACY REQUEST and say which right you are exercising.
- We will verify you by confirming control of the email address we hold. Since an email address is generally the only identifier we have, replying from that address is usually enough.
- We respond within 45 days, extendable once by another 45 days if we tell you why.
- Using the right is free.
- An authorised agent may act for you with written permission, which we may ask to see, and we may still ask you to confirm directly.
- If we refuse a request, we will tell you why, and you may appeal by replying to our response with the subject line
PRIVACY APPEAL.
Residents of other US states with comparable privacy laws (including Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and Montana) may use the same route, and we will apply the same process.
11. Where data is processed
The publisher is in Bulgaria, which is in the European Union. That means personal data about US subscribers is processed in the EU, as well as in the United States.
We say this plainly because it is unusual for a US-facing product and because you should know where your data physically sits:
- The subscriber list is held by beehiiv in the United States.
- Cloudflare serves the site from an edge network with locations worldwide.
- PostHog and Sentry process data in the United States, and PostHog may process in the EU depending on the instance used.
- The people who run BellPrep, and who can access the subscriber list and the analytics, are in Bulgaria, and administrative access happens from there.
- If and when the paid tier launches, Paddle processes payment data in the UK and elsewhere.
Where personal data moves between the EU and the US, or the other way, we rely on the transfer mechanisms available under applicable law, which may include the European Commission’s Standard Contractual Clauses and, where a provider is certified, the EU-US Data Privacy Framework. Our agreements with the sub-processors in Section 7 include data protection terms.
Drafting note: the wording here is deliberately factual rather than jurisdictional. A US-facing service run from an EU member state has to be careful not to imply either (a) that EU data protection law has no application, which is likely wrong because the controller is EU-established under Article 3(1) GDPR, or (b) that EU-resident data subject rights are being offered, which would conflict with the “not offered to EEA/UK” position in the Terms. Bulgarian counsel should decide whether this Privacy Policy needs a full GDPR rights section (Articles 13 to 22), a Bulgarian-language version, a registration or notification with the Commission for Personal Data Protection, and whether a DPO is required under Article 37. Do not treat the current wording as settling that question.
12. Security and breach notification
We take reasonable technical and organisational measures to protect personal data: encryption in transit (TLS), access limited to people who need it, multi-factor authentication on administrative accounts, reputable sub-processors, and a deliberately small data footprint.
The strongest security measure here is the data we never collect. We cannot lose calculator inputs, brokerage credentials, or account balances, because we never had them.
No system is completely secure, and we do not claim ours is.
If a breach affects your personal data and creates a real risk to you, we will tell you. We will notify affected subscribers without undue delay and in any event within 72 hours of becoming aware, by email to the address we hold, and we will say what happened, what data was involved, what we are doing, and what you can do. We will notify regulators where the law requires it. We will not delay notice to manage the news.
13. Children
BellPrep is for adults. It is not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has subscribed, email hello@bellprep.com and we will delete the record.
14. Changes
We may update this policy. The “Last updated” date at the top changes when we do, and the current version always lives at https://bellprep.com/privacy.
If a change materially affects how we handle your data, we will notify subscribers by email before it takes effect. We will not quietly start collecting something new.
15. Contact
Privacy questions, requests, and complaints:
hello@bellprep.com
Novelty Capital
hello@bellprep.com
If you are not satisfied with our answer, you may complain to a supervisory authority. For the publisher’s home authority: Commission for Personal Data Protection (Комисия за защита на личните данни), 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, Bulgaria — cpdp.bg.