Privacy Policy

Last updated: November 2026

RetailBonds.in is run from India by its founder, Arindam. For India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and its Rules, we are the Data Fiduciary for the personal data described here. Questions, requests and complaints about your data go to [email protected] (see Your rights).

In short: you can use the whole site without an account. We keep as little as the site needs, we never sell or share data for marketing, and you can download or delete your account data yourself at any time.

What we hold and why

When you visit the site

Server logs: IP address, browser (user agent), page address and time, kept about two weeks for security and fixing faults.
Our own analytics: for each page view, the page, the referring site, country, browser and device type, an anonymous visit identifier (the rb_session cookie), and, to tell automated scraping from people, a salted one-way hash of your network (the first three parts of an IPv4 address, not the full address) and your network operator’s number (ASN). The network hash and ASN are deleted after 30 days. The remaining rows carry no IP address or account and are kept to count visits over time.
Cloudflare Web Analytics: a small Cloudflare script counts page views, referring sites and page load times. It sets no cookies, stores nothing in your browser and does not track you across sites. We do not use Google Analytics or any advertising trackers.
Sign-up counts: daily totals of a few steps (a signed-out star clicked, a sign-in started or finished, a new account, a first watchlist item), with nothing that identifies who did them.
Search terms typed in the screener, with no IP address, visitor identifier or account attached.
Page feedback: if you use the Feedback button on a tool page, the page, your rating and any comment you type, with no IP address, visitor identifier or account attached. Please don’t put personal details in comments.

Forms you can use without an account

Email alerts (weekly rating digest, issuer alerts): your email address and which alerts you chose. Your email is deleted 7 days after you unsubscribe. To stop repeat sign-up abuse we also note the IP address of each sign-up request, deleted after a day.
Bounces and spam reports: if an email we send you bounces or is reported as spam, our email provider tells us, and we note the address, the reason and the date so we stop sending to it. Sign-in codes and security notices still go. You can start emails again from your account’s email settings, or by confirming an email alert.
Email send log: for each email we send, its type (for example “watchlist” or “sign-in”), whether our email provider accepted it, the time, your account number if you have one, and a one-way hash of the address so we can answer “did my email go out?”. Never the content or the address itself. Kept 90 days.
Questions sent through the Ask form: the question, your email if you give it (so we can tell you when it is answered) and your IP address (to stop spam). Answered questions may be published, without your email or IP address.
Suggested corrections to issuer data: the suggestion, any note and your IP address (to stop spam).
Pro enquiries from the pricing page: what you enter (name, email, organisation, role, SEBI registration number if given, client range, message) so we can reply, and a scrambled form of your network address to limit spam.

If you create an account (optional, for people aged 18 or over)

Account: your email address, which version of the Terms and this policy you agreed to and when, when you confirmed being 18 or older, when you last signed in, your plan, your email settings and, if you sign in with Google, Google’s identifier for your Google account. We receive nothing else from Google.
Sign-in: there are no passwords. A sign-in code or link is emailed to you; it expires after 15 minutes and is stored only in hashed form, together with the email it was sent to and the requesting IP address, both deleted after a day. The sign-in form uses Cloudflare Turnstile to tell people from bots.
Signed-in browsers: for each browser you sign in on, a hashed session token, a label such as “Chrome on Android” worked out from the browser’s user agent, and when it was last used, so you can see and sign out browsers from your account page. A session ends after 30 days without use and after 90 days at most. We also keep a hash of a random browser identifier (the rb_device cookie) so we can email you when a browser you haven’t used before signs in.
Watchlist: the bonds and issuers you watch, any groups and tags you create, and any yield alerts you set, with a record of which alerts have fired so you are not emailed twice.
Portfolio: for each holding, the bond’s ISIN and the number of units, in the portfolios you name. No purchase prices, dates, broker, demat or bank details. Advisers on the Pro plan can keep portfolios for their clients: please use labels or initials rather than clients’ full names; the adviser is responsible for having their clients’ consent. An optional firm name can be shown on reports.
CAS statement import (Premium): if you upload an NSDL or CDSL Consolidated Account Statement PDF, it is read in memory only to find your bonds and discarded when the page loads. It is never saved to disk, backups or logs. The PDF password is used only to open the file and is not kept. Only the holdings you confirm (ISIN and units) are saved. Your name, PAN, address, demat and DP IDs, transactions, shares, mutual funds and values are never stored.
Notes: the text of notes you write on bonds and issuers. Please don’t put account numbers or other sensitive details in notes.
Saved screens: the names and filter settings of screener searches you save, and whether you asked for email alerts on them, with a record of bonds already reported so each is emailed once.
Emails to you: NCD issue emails and saved-screen alerts are off until you turn them on; the daily or weekly watchlist email starts when you watch something. Each can be turned off from your account or from the link in every email. We also send the emails an account needs: sign-in codes, a notice when a new browser signs in, a confirmation when you change your email or delete your account, and a warning before an unused account is deleted. We record which NCD issues we have emailed you about, so none is sent twice.
Data API keys, if you create one: a hash of the key, its label and hourly usage counts.
Payments: paid plans are not open yet. When they open, payments will be handled by Polar (polar.sh) as merchant of record: Polar is the seller, takes your card or UPI details and issues tax invoices. We will never see or store card, bank or UPI details. Polar tells us your plan, its status, the amount and currency, and when the current period ends, linked to your account.

What we do not collect

No passwords.
No PAN, Aadhaar, bank, card, demat or trading account details.
No purchase prices or trading history.
No third-party advertising, tracking pixels or cross-site tracking.

Cookies

All our cookies are first-party and none is used for advertising. Cookies needed only for something you choose to do (sign in, send a form) are set when you do it.

Cookie	What it is for	How long
`theme`	Your light or dark theme choice	1 year
`dw_hide`	Remembers that you closed the Diwali greeting, so it stays closed	8 days
`rb_session`	Anonymous visit identifier for our own analytics	30 days
`rb_user`	Keeps you signed in (holds a random token; we store only its hash)	Ends after 30 days without use, 90 days at most
`rb_in`	Tells the page you are signed in so it can load your account menu; holds no identity	Same as `rb_user`
`rb_device`	Random browser identifier for the new-browser sign-in email	About 13 months
`rb_goauth`	Protects a Google sign-in while it is in progress	10 minutes
`rb_csrf_u`	Security token that protects account and email-alert forms from forged requests	7 days, renewed when a form is shown
`rb_admin_session`, `rb_csrf`	Site staff sign-in to the admin pages; never set for visitors	8 hours

Cloudflare, which protects the site, may also set its own security cookies (such as __cf_bm and cf_clearance) to tell people from bots. See Cloudflare’s cookie policy.

Who processes data for us

We do not sell, rent or share your data for anyone’s marketing, and we do not use it for advertising profiling. These service providers process limited data on our behalf, only to run the site:

Vultr: the server that runs the site and holds the database, located in India.
Cloudflare: network, security, the Turnstile bot check on the sign-in form (which reads browser signals and your IP address), and Web Analytics page-view counts without cookies.
Resend: delivers the emails we send you (your email address and the message), and tells us when one bounces or is reported as spam.
Google: sign-in, only if you choose “Sign in with Google”; and storage of our off-site backups, which are encrypted before they leave our server.
Polar: payments, once paid plans open (see above).

Some of these providers may process data outside India. We may also disclose data where Indian law requires it, for example to a court or regulator.

How long we keep it

Data	Kept for
Account, watchlist, portfolio, notes, saved screens, alerts	Until you delete them or the account. An account not used for 12 months (no sign-in and no visit while signed in) gets a warning email and is deleted 30 days later unless used again; accounts on an active paid plan are not deleted this way.
Sign-in codes and links, with their email and IP address	15 minutes to use; deleted after a day
Signed-in browser sessions	30 days without use, 90 days at most
Email alert subscriptions (no account)	Until you unsubscribe, then 7 days
Email send log (type, outcome, time; no content)	90 days
Bounce and spam-report records	Until you start emails again, sign in with an emailed code or link (bounces only), confirm an email alert, or delete your account together with its email subscriptions; otherwise 30 days after nothing is sent to the address any more
Questions, suggested corrections, Pro enquiries	Kept as a record once dealt with. Ask us and we will delete them, or remove your email and IP address.
Analytics network hash and ASN	30 days
Server logs	About two weeks
Backups	Nightly backups for 7 days, and encrypted off-site copies for up to about 6 months (daily for 8 days, weekly for 4 weeks, monthly for 6 months). Data you delete stays in these until they expire; we restore from a backup only to recover from a fault.

Security

The site is served only over HTTPS. Sign-in codes, session tokens and API keys are stored only as hashes. The database, logs and backups are readable only by the site’s own account on the server, and off-site backups are encrypted. Access is limited to the founder. No system is perfectly secure; if a breach affects your personal data, we will tell you and the Data Protection Board of India as the DPDP Act requires.

Your rights

Under the DPDP Act you can:

Get a copy of your data: download everything linked to your account as a file from your account page (Download my data), or email us for anything else we hold about you.
Correct it: change your sign-in email on your account page, and edit or remove any watchlist item, holding, note or saved screen yourself. Email us to correct anything else.
Erase it: delete your account yourself from your account page. This removes the account and everything linked to it straight away (watchlist, portfolios and holdings, notes, saved screens and alerts, signed-in browsers, pending sign-in codes and any API keys); you choose whether email alerts you subscribed to without an account end too. Email us to erase anything else, such as a question or enquiry.
Withdraw consent: unsubscribe from any email from the link in it, turn emails off in your account, or delete the account. Withdrawing consent does not affect what was done before.
Nominate someone: you can name a person to exercise these rights for you if you die or become unable to. Email us the person’s name and email address from your account’s email address.
Raise a grievance: email [email protected] with “Privacy” in the subject. We will acknowledge it within 3 working days and reply in full within 30 days. If you are not satisfied with our reply, you can complain to the Data Protection Board of India.

We may ask you to confirm a request from the email address on the account, so that nobody else can get or delete your data.

Children

Accounts are for people aged 18 or over. If you believe a child has created an account, email us and we will delete it.

Changes

We may update this policy. The date at the top shows the latest version. If a change materially affects how we use your data, we will email account holders and ask for agreement again before relying on it.