Privacy Policy

Louby Labs, LLC is the controller of personal information processed through the Service. This Policy covers our websites at nakag.ai and its subdomains and the Nakagai platform. It does not cover third-party services you connect (such as brokerages), which have their own policies.

• Information you provide: your email address, account credentials, strategy configurations, watchlist and mandate settings, and any messages you send us.
• Comments: if you post a public comment on a stock, the comment, the handle attached to it, and any strategy badge on it. This is information you choose to publish, not information we collect about you: posting it puts it on the open web, where no sign-in stands between it and a reader, and where we expect search engines to find and list it.
• From Google sign-in: if you sign in with Google, we receive your name, email address, and profile picture, limited to what you authorize.
• Automatically: essential authentication session cookies, IP address, and basic logs and security telemetry. When you create an account with an email and password, we also record which of our pages you signed up from and the referring source named in that page’s link (such as a social post), kept with your account. If you arrive through a friend’s invite link, we keep that link’s invite code in one first-party cookie, nk_invite, for up to 30 days; if you then create an account, we record the code with it so we can credit the friend who invited you. The cookie is usually deleted sooner, when you sign up or sign in.
• Billing (when live): when you subscribe to a paid plan, our payment processor, Stripe, collects your payment details. We never store your full card number.

Your broker credentials live only on your own user-run broker connector, stored locally on disk, and are never transmitted to or stored on our servers. We hold signed approval decisions and audit metadata about actions you authorize, not your brokerage secrets, and not the ability to place trades on your behalf.

Separately, the platform does hold service credentials it needs to operate: our own market-data credentials (used to sync bars and quotes) and the credentials for any non-broker connector you or an admin configures. Those are ours to run the Service, not your brokerage secrets, and they are held under the same access controls described in Security below.

We use information to:

• provide, operate, and secure the Service and authenticate you;
• run the signals and automations you request;
• generate the AI features you use, by sending the relevant content to our AI providers: the plain-English screen you describe to the builder, the evidence behind a signal you ask us to explain, the details of an order awaiting your approval, the market facts behind the daily brief, the plain-English cadence you write into your mandate, and what you say to your managed desk;
• deliver notifications and respond to your requests;
• process payments and manage subscriptions;
• comply with legal obligations and enforce our Terms; and
• improve the Service, generally using aggregated or de-identified data.

Inside the signed-in app we use only essential cookies needed to keep you signed in (managed by our authentication provider).

A friend’s invite link (nakag.ai/join/…) sets one first-party cookie, nk_invite, holding only that link’s invite code. It lasts up to 30 days, is never readable by scripts or shared with anyone, and exists only so that an account you create can be credited to the friend who invited you. It is usually deleted sooner, when you sign up or sign in.

Our public pages, the ones anyone can read without an account (the home page, the daily briefs, the public stock, fund, insider, politician and calendar pages, and the legal, about and contact pages), show ads served by Google AdSense. The signed-in app, the sign-in pages and our iOS app show no ads. As a third-party vendor, Google uses cookies, including the DoubleClick cookie, to serve ads based on your prior visits to this site and other sites on the internet. You can opt out of personalized advertising in Google Ad Settings, and learn how Google uses information from sites that use its services at policies.google.com/technologies/partner-sites. You can also opt out of other third-party vendors’ use of cookies for personalized advertising at www.aboutads.info. Visitors in the European Economic Area, the United Kingdom and Switzerland are asked for consent through Google’s consent message before those cookies are used, and visitors in US states with consumer privacy laws are offered an opt-out through Google’s message.

Our hosting provider, Vercel, runs Vercel Web Analytics and Vercel Speed Insights on the Service to measure page views and site performance. Per Vercel’s own documentation, both are recorded anonymously, without identifying an individual visitor, and Web Analytics does so without any third-party cookies. The data points collected may include the route or URL visited, the referrer, approximate geography, browser, device, and operating system, and, for Speed Insights, network speed and Web Vital performance data. See Vercel Web Analytics’ privacy documentation and Vercel Speed Insights’ privacy documentation for the full list of what is collected.

We share information only with service providers that help us operate the Service (see the subprocessors below), when required by law or to protect rights and safety, and in connection with a merger, acquisition, or sale of assets. We do not sell your personal information.

• Supabase: authentication and database hosting.
• Vercel: web application hosting, plus Vercel Web Analytics and Speed Insights.
• Fly.io: platform/API hosting.
• Google: sign-in (OAuth), if you choose it.
• Google AdSense: ads on our public pages. Google receives the page you are reading, your IP address, browser and device details, and its own cookies, as described in Cookies, advertising & analytics above. It receives nothing from the signed-in app.
• Stripe: payment processing (when paid plans are live).
• OpenRouter: the AI features. Every model call the Service makes is routed through OpenRouter, so it receives the screen prose you write in the builder, the evidence bundle behind a signal explanation you request, the details of an order awaiting your approval, the market facts behind the shared daily brief, the plain-English cadence you write into your mandate, and what you say to your managed desk.
• Z.AI, SiliconFlow, BaseTen, Fireworks, Together and DigitalOcean: the model-serving providers OpenRouter hands those calls to, and therefore where the text physically lands. Each feature has a short, named list of them, in order. OpenRouter sends a call to the first provider on that feature’s list and moves to the next only when one is unavailable; it never sends the call to a provider outside the list. Your managed desk and the cadence you write into your mandate go to Z.AI first, with SiliconFlow and BaseTen as its backups; the screener prose, signal explanations, order-approval details, and the shared daily brief go to Fireworks first, with Together and DigitalOcean as its backups.
• Resend: transactional email. It receives the email address of anyone we invite, in order to deliver the invitation.
• Web Push services: if you switch on approval notifications, your browser’s push service (Google, Apple, Mozilla, or whichever your browser uses) receives the subscription endpoint and keys your browser generates, so we can deliver the alert. We store that endpoint and those keys until you switch the notifications off.
• Market-data providers: market data used by the Service.

We keep your information while your account is active and as needed to provide the Service, and longer where required for legal, audit, or security purposes. You may request deletion of your account and associated personal information as described below.

Removing a comment takes it off the stock’s comments, but it does not recall it from copies we retain or from any third-party cache or search index that already captured it.

We protect information with encryption in transit, scoped access controls, and the custody split described above (broker secrets stay on your broker connector, never our servers). No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If you are a California resident, you have the right to know and access the personal information we collect, to request deletion or correction, and to opt out of the sale or sharing of personal information. We do not sell personal information. The Google advertising cookies on our public pages, described in Cookies, advertising & analytics, may count as sharing for cross-context behavioral advertising under California law; you can opt out of them through Google Ad Settings or www.aboutads.info as described there. We will not discriminate against you for exercising these rights.

To exercise these rights, contact legal@nakag.ai. We will verify your request, and you may use an authorized agent to submit it.

If you are in the European Economic Area or the United Kingdom, we process your personal data to provide the Service (contract), to comply with law, and for our legitimate interests in operating and improving it. You have rights of access, correction, erasure, portability, and objection, and the right to lodge a complaint with your local supervisory authority. Contact legal@nakag.ai to exercise them. Your data is processed in the United States.

The Service is not directed to anyone under 18, and we do not knowingly collect personal information from children. If we learn we have collected such information, we will delete it.

We operate in the United States, and your information is processed and stored there. If you use the Service from outside the United States, you consent to that transfer and processing.

We may update this Policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, provide reasonable notice.

For privacy questions or data requests, contact legal@nakag.ai.