Security

BEAR applies commercially reasonable safeguards to protect your data: encryption in transit and at rest, database-level isolation between users, and strict confinement of the credentials that could ever touch your brokerage or your money. No system — ours included — can guarantee absolute security, and we won’t tell you otherwise.

Data moving between your device and BEAR is encrypted in transit via TLS. Data at rest — your trades, notes, patterns, and coaching history — is encrypted at rest by our database provider. Sensitive tokens (see Key confinement below) are additionally encrypted at the application layer before storage, so a database-level exposure does not hand over a usable credential.

Every table that holds your trading data is protected by Row-Level Security enforced at the database itself, not by application code. Every read and write is scoped to your authenticated user ID. Another user’s application code cannot query your trades, patterns, DNA, or coach history — the database refuses the request regardless of what the application asks for.

Login is handled by our authentication provider using industry-standard session tokens and secure, http-only cookies. We do not store your password — it never reaches our database in plain form. Sessions are validated on every request to a protected route.

BEAR never collects, stores, or transmits your brokerage password or API secret. There is no field in this app that asks for one. Where brokerage connections exist, they use OAuth: you authenticate on the broker’s own page, and BEAR receives a read-only token, never a credential. Service-level keys that bypass normal access controls are confined to a small number of server-side systems — never shipped to the browser, never logged, never included in an error message.

We apply commercially reasonable safeguards and follow industry practice, but no method of transmission or storage is 100% secure. We cannot and do not promise absolute security, and no service honestly can. If we become aware of a breach affecting your data, we will notify you as required by law.

If you believe you’ve found a security vulnerability in BEAR, tell us before you tell anyone else: withbear.app@gmail.com. Give us a reasonable window to investigate and fix the issue before any public disclosure. Do not access, modify, or delete data that isn’t yours while testing.

If we materially change our security practices, we will update the “Last updated” date at the top and, where appropriate, notify you in the app.

Questions: withbear.app@gmail.com.