Privacy Policy

1. Who we are

RightBonds (rightbonds.com) is an independent bond yield aggregator for the Indian fixed-income market. We aggregate publicly available bond listings from multiple investment platforms - GoldenPi, Jiraaf, GripInvest, BondScanner, WintWealth, EquiRize, Groww, NSE, and BSE - and present them in a single, filterable interface to help investors compare options.

RightBonds is not a registered investment adviser, broker, or financial institution. Nothing on this site constitutes investment advice.

2. Data we collect - and what we do not

2.1 Bond listings (server-side scraper)

Our automated scraper runs once daily. It fetches publicly available bond data from partner platforms (prices, yields, maturity dates, ISIN numbers) and writes the result to a static JSON file. This scraper processes only public market data and never interacts with any user account or personal information.

2.2 Portfolio analysis (entirely in-browser)

The Portfolio feature lets you upload a holdings statement (CDSL or NSDL depository export) to analyse your bond portfolio. This feature is built with a privacy-first architecture:

• Parsing happens locally. Your uploaded file is parsed entirely within your browser using a self-hosted copy of the SheetJS library. The raw file bytes never leave your device.
• No data is transmitted. Extracted holdings data (issuer names, quantities, maturity dates, ISIN codes) is stored only in your browser's localStorage. Nothing is sent to RightBonds servers, analytics services, or any third party.
• No server component. The portfolio page is a static HTML file with no backend API. There is no server that could receive your data even if we wanted to.
• You are in full control. Clicking Clear All permanently erases all portfolio data from localStorage. You can also clear it from your browser's developer tools at any time.

2.3 What we do NOT collect

2.4 Anonymous product analytics (PostHog)

We use PostHog to understand which features people use, so we can improve RightBonds. It is configured to be anonymous and privacy-first. The PostHog library is self-hosted from our own server, so analytics loads no third-party script into your browser. (Google's advertising script is separate and is described in section 5.)

What is recorded - anonymous, non-identifying usage events only: which page was viewed, that a search or filter was used (and the bond-related terms typed), that a bond detail or platform link was opened, aggregate portfolio counts (whether the statement was CDSL or NSDL, and how many bonds and issuers it contained), and the country a visit came from, worked out from the truncated IP described in the table above.

Heatmaps - we also collect anonymous heatmap data: where on a page people click, where the mouse pointer moves (sampled, not a continuous trail), clicks that produced no visible response, and how far down the page people scroll. All of it is stored as plain coordinates on the page. It tells us which parts of a page get used and which get ignored. It is not tied to any identifier, it records only the position of a click or pointer and never what was clicked, typed or shown, and it is not a recording of your screen or your session.

What is never recorded - your full IP address (our edge truncates it before the data is forwarded, so neither we nor PostHog ever hold the complete address), any cookie or persistent identifier (the session id lives in memory and is gone when you close the tab), your name or email, your portfolio value, and your individual holdings, units or ISIN codes. Autocapture and session replay are switched off, so beyond the anonymous click, pointer and scroll positions described above we never record keystrokes, form contents or your screen.

In short: we can see that a feature was used and roughly where in the world it was used, never who used it or what they hold.

3. Third-party libraries and vendor dependencies

To protect user privacy, all JavaScript libraries used in the Portfolio feature are self-hosted on our servers. We do not load any scripts from external CDNs during the portfolio session, eliminating the possibility of a CDN operator logging your IP address while you analyse your holdings.

Both libraries have been reviewed: neither version contains telemetry, outbound network calls, or data collection of any kind. SheetJS 0.18.5 is the final open-source release and performs all spreadsheet parsing synchronously in memory without any network activity.

4. How your portfolio data is stored

When you upload a holdings statement, the following data is parsed from the file and stored in your browser's localStorage:

• ISIN codes of your holdings
• Quantity (number of units held)
• Issuer names (as they appear in your depository statement)
• A portfolio label you optionally assign

localStorage is a browser-native storage mechanism. It is:

• Local only - data never leaves the device unless you explicitly export it
• Origin-scoped - accessible only to pages served from rightbonds.com
• Not shared between browsers or devices
• Persistent until cleared - survives browser restarts until you choose to remove it

Deleting your data

To remove all portfolio data:

• Click the Clear All button on the Portfolio page. This immediately deletes all rb:portfolio:* keys from localStorage.
• Alternatively, use your browser's "Clear site data" or developer tools (Application → Local Storage → rightbonds.com) to delete individual keys or all data for the site.

5. Cookies & local storage

RightBonds sets no cookies of its own. Our analytics runs in-memory only (persistence: 'memory') - no cookie, no device identifier, nothing written to your device by us.

Advertising. The site is funded partly by advertising, and we use Google AdSense. Google is a third-party vendor: it loads its own script into your browser and may set and read cookies to serve ads, including ads based on your previous visits to this and other websites. We do not receive that data, we pass nothing to Google about you, and nothing you upload to the Portfolio page is available to it. You can review or switch off personalised advertising at Google My Ad Center, opt out of personalised advertising from Google and other participating vendors at aboutads.info/choices, and read how Google uses data from sites that use its services at policies.google.com/technologies/partner-sites.

Four pages are deliberately excluded. No advertising script is served on /portfolio/ or on the Monthly Finance Review, so your depository statement or bank statement is parsed with no third-party code on the page at all. The homepage is excluded so the first page you land on carries no ad code, and this privacy policy is excluded because the page explaining which third parties we load should not itself load one. All four are build-time exclusions, not settings.

The site uses your browser's localStorage for functional preferences you set yourself - theme choice, wishlist, saved filters, and the portfolio data described in section 4. This data stays on your device, is never transmitted, and can be cleared at any time via Clear All or your browser's "Clear site data".

Our host, Cloudflare, may set a strictly-necessary security cookie (such as __cf_bm for bot protection) as part of serving the site. It is essential-only, not used for tracking by RightBonds, and is covered by Cloudflare's Privacy Policy.

6. Hosting and infrastructure

RightBonds is hosted on Cloudflare Workers. Cloudflare operates as a CDN and DDoS protection layer. When you visit RightBonds, your request is handled by Cloudflare's edge network. Cloudflare may process your IP address and basic HTTP headers as part of their infrastructure service. This processing is governed by Cloudflare's Privacy Policy.

RightBonds does not have access to, and does not retain, any logs from Cloudflare's infrastructure. We run no session recording and no A/B testing. The anonymous heatmaps described in section 2.4 are the only behavioural analytics we collect.

Analytics events are sent to our own domain at /ph/ and forwarded from there to PostHog. This is a transport detail, not extra collection: the data is exactly what section 2.4 describes, and our edge truncates your IP address before forwarding, so PostHog receives a country-level prefix and never the full address.

The daily scraper runs on an automated CI/CD pipeline. It accesses only public bond platform APIs and writes a static JSON file to the repository. No user data is processed in this pipeline.

7. Referral links

Some bond listings on RightBonds include referral links to investment platforms (GoldenPi, Jiraaf, GripInvest, WintWealth, BondScanner, EquiRize, Groww). These links contain referral codes appended as URL parameters (e.g., ?ref=RIGHTBONDS). If you click a referral link and subsequently register on a partner platform, RightBonds may receive a referral commission from that platform.

Where a link goes depends on whether you have portfolio data loaded. Without it, bond links point at the platform's signup page. With it, they point at that bond's own page on the platform, so you can verify a holding quickly. Both carry our referral code. This page previously said the second kind did not, which was wrong, and it was corrected on 28 September 2026.

Clicking any external link will share your IP address and browser information with the destination platform, governed by that platform's own privacy policy.

8. Children's privacy

RightBonds is intended for adult investors. We do not knowingly collect personal information from individuals under 18 years of age. If you wish to delete any locally stored data, use the Clear All button on the Portfolio page or clear site data from your browser settings.

9. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For material changes, we will post a notice on the RightBonds homepage.

10. Contact

If you have questions about this Privacy Policy or how RightBonds handles data:

• Email: contact@rightbonds.com