Privacy policy
We may update this policy. The version and date below show which one you're reading, and we'll email parents before a change that matters takes effect.
First Bell is run by Matthew Giancristofaro, an individual ("we"). It's run by one person, so requests are handled by hand, within the times this policy gives.
First Bell is a practice investing app for high school students (about 14 to 18) and their parents. Teens invest pretend money in real companies, and parents set goals with rewards they give outside the app. There is no real money in the app: no deposits, no trading, no payments.
This policy says what we collect, why, who helps us run the app, how long we keep things and how to delete them. There's a shorter version for teens at the end.
Who can use it
- A parent or legal guardian creates a family and invites their teen. When they create the family, the parent confirms they're 18 or older and the teen's parent or legal guardian, and agrees to this policy and the terms for themselves and their teen. We keep a record of that agreement and which versions it was for.
- A teen can only join with an invite code from their parent. There's no way to use the app without a parent.
- The app is not for children under 13. We don't knowingly collect personal information from anyone under 13. If you believe a child under 13 has an account, email hello@tryfirstbell.app. We'll reply within 7 days, and if the account belongs to a child under 13, we'll delete it and tell you when it's done. We comply with the Children's Online Privacy Protection Act (COPPA) and with the privacy laws that apply to teenagers' information where our users live.
What we collect
| What | From whom | Why |
|---|---|---|
| Email address | parents and teens | signing in with a one-time code; account messages |
| First names, and the family's name | parents and teens | showing who's who in the family |
| Paper portfolio: practice trades, holdings, cash | teens | the app itself |
| Goals, rewards, progress | parents set them; the app tracks progress | the app itself |
| Pitches (why a teen picked a stock, what could go wrong) | teens | goals that ask for them, and the parent's approval |
| Coach conversations | teens | the AI coach (below) |
| Push notification token, time zone and platform (iPhone or Android) | each device that allows notifications | sending goal and pitch updates, and not at night |
| Sign-up steps reached (e.g. "finished the tour") | parents and teens | seeing where people get stuck; kept in our own database, never shared |
| Crash reports | the app, when it hits an error | fixing bugs (below) |
| Emails you send us | anyone who writes to hello@tryfirstbell.app | answering you |
We don't collect: location, contacts, photos, real financial or bank information, advertising identifiers, or anything for advertising. We don't sell or share personal information, and we don't track you across other apps or websites.
What parents can see
A parent can see their teen's portfolio, trades, goals, pitches and coach conversations, except messages about the teen's safety (below). Before a teen's first coach question, the app shows them, once, that the coach is an AI, that their parent can see their coach chats, and that messages about their safety are private. We record that they saw it.
The AI coach
- The coach (Doug) is an AI, not a person, and the app says so. It asks questions to help a teen think about a company. It's built never to recommend what to buy or sell and never to write a pitch for a teen.
- To answer, we send Anthropic, which provides the AI model: the teen's question, the earlier messages in that conversation (never messages about safety), the teen's pitch draft when they ask about a pitch, and public company information (prices, sector, figures from SEC filings). We don't attach the teen's name, email address or account ID.
- Before anything is sent or stored, we replace street addresses, phone numbers and email addresses with "[removed]": in the teen's messages, in the coach's replies and in pitch drafts. This catches the usual US formats but can miss some, so please don't share personal details with the coach.
- Anthropic doesn't use what we send to train its models, and deletes API inputs and outputs within 30 days by default (longer only if a message is flagged for a usage policy violation, or where the law requires). See Anthropic's privacy center.
- There's a daily limit on coach questions.
Messages about safety
If a teen writes about self-harm, abuse, danger at home or bullying (we check for these words, and the AI flags them too), the coach points them to real help (988, the Crisis Text Line by texting HOME to 741741, a trusted adult or school counselor, Childhelp at 1-800-422-4453, or 911).
- That message, the coach's reply, and everything after them in the same conversation are hidden from the parent, with no sign they existed.
- They're deleted from our database 24 hours after they're sent, and they're never sent to the AI again after that question. Anthropic keeps what it received for up to 30 days (above).
- We'd rather hide too much than too little: an ordinary question that uses one of those words may be hidden and deleted too.
Crash reports
When the app hits an error in a release build, it sends a report to Sentry, which we use to find and fix bugs. Crash reports are locked down:
- Only errors in the app's own code are reported. Sentry's native crash reporter and its session tracking are off, so nothing is sent when the app simply opens or closes.
- No session replay, no screenshots, no recording of the screen, and no tracking of taps.
- No account identity: no user ID, email address or name is attached.
- Before a report leaves the phone, the app removes email addresses, phone numbers, anything in quotes, and values from our database (which is where names and the text of messages, pitches and coach conversations would appear). It also removes the phone's name (which can include its owner's name) and anything after "?" in a web address.
- A report contains what went wrong in the code, the app version, the phone's operating system and version, and the last few things the app did just before (for example, a network request that failed), without their contents.
- Sentry sees the phone's IP address when a report arrives; we've told it not to store IP addresses, and turned on its own scrubbing too. It keeps reports for 30 days.
Who helps us run the app
| Service | What it does | What it receives |
|---|---|---|
| Supabase | hosting, database, sign-in | everything above, stored in the United States, and the IP address of each sign-in |
| Anthropic | the AI coach | coach messages and pitch drafts (after removing contact details), and public company information (above) |
| Expo and Apple | push notifications; Apple also distributes the beta (TestFlight) | the push token, an installation ID, and each notification's text, which can include first names (the teen's and the parent's), the reward, company names and how a goal is going |
| Resend | sign-in code emails | email addresses and the sign-in code emails |
| Sentry | crash reports | scrubbed error reports (above), and the phone's IP address when a report arrives |
| Twelve Data | stock prices | no personal information |
| The SEC | company filings | our servers ask for public filings, with no personal information. If you tap a link to a filing, your phone opens sec.gov, which sees your IP address like any website |
| GitHub Pages | hosts this website (tryfirstbell.app) | the IP address and browser details of anyone who visits the site, in its standard server logs |
| Porkbun and Google (Gmail) | email to hello@tryfirstbell.app: Porkbun forwards it to our Gmail inbox | your email address and what you write to us |
Each one only uses the information to provide its service to us.
How long we keep it
- Account information, portfolios, goals, pitches and coach conversations: until the account is deleted.
- Safety messages: 24 hours.
- Coach messages at Anthropic: up to 30 days (see above).
- Notifications: each notification, and its text, is deleted within 90 days of being sent.
- Push tokens and time zones: until you sign out on that device, delete the account, or Apple tells us the device can't receive notifications. Turning notifications off in iOS Settings stops them from showing, but the token stays until one of those happens.
- A deleted teen's name: when a teen deletes their account, their parent keeps a note in the app, with the teen's first name, saying the account was deleted.
- Crash reports: 30 days.
- Emails to hello@tryfirstbell.app: as long as we need them to answer you and keep a record of what was asked, then deleted.
- Backups: our database host keeps daily backups for up to 7 days. They expire on their own.
Deleting an account
Anyone can delete their account in the app: Account → Delete account. It's immediate and can't be undone.
- A teen who deletes their account removes their own portfolio, trades, goals, pitches and coach conversations. Their parent is told.
- A parent who is the family's only parent deletes themself, every teen in the family, and the family. The app shows this before confirming.
- A parent with another parent in the family deletes only themself.
Copies in backups expire within 7 days.
If you can't sign in, or a parent wants their teen's account deleted without deleting their own: email hello@tryfirstbell.app from the email address on the account (a parent, from theirs). We'll reply within 7 days, delete the account within 30 days, and tell you when it's done. If we can't tell that the request comes from the account's owner or the teen's parent, we'll ask you to confirm from the address on the account first.
Your choices and rights
- Turn notifications on or off any time in iOS Settings (Account in the app takes you there).
- Ask for a copy of your or your teen's information, or for it to be corrected or deleted: email hello@tryfirstbell.app from the address on the account. We'll reply within 7 days and send the copy (or make the change) within 30 days. Depending on where you live, you may have more rights under local law; we'll honor them.
Security
Data is encrypted in transit, and access is limited by database rules so each family sees only its own information. The keys that run the app's services are kept on our servers, never in the app; every production build is checked for them before it's made.
Changes
If we change this policy in a way that matters, we'll email every parent at the address on their account before the change takes effect, and the new version and date will be at the top of this page.
The short version, for teens
- Your parent can see your portfolio, goals, pitches and coach chats, except messages about your safety and what you say after them in that chat. Those are private, and First Bell deletes them after a day.
- Doug is an AI. What you ask him goes to the company that runs the AI, with phone numbers, emails and addresses taken out first. Don't put private things in your questions.
- It's all practice money. Nothing here can cost real money.
- You can delete your account any time in Account.
- Questions? Ask your parent, or email hello@tryfirstbell.app.