Privacy Policy

Louby Labs, LLC is the controller of personal information processed through the Service. This Policy covers our websites at nakag.ai and its subdomains and the Nakagai platform. It does not cover third-party services you connect (such as brokerages), which have their own policies.

• Information you provide: your email address, account credentials, waitlist email, strategy configurations, watchlist and mandate settings, and any messages you send us.
• Board content: if you post on a public ticker board, the post, the handle attached to it, and any play badge on it. This is information you choose to publish, not information we collect about you: posting it puts it on the open web, where no sign-in stands between it and a reader, and where we expect search engines to find and list it.
• From Google sign-in: if you sign in with Google, we receive your name, email address, and profile picture, limited to what you authorize.
• Automatically: essential authentication session cookies, IP address, and basic logs and security telemetry.
• Billing (when live): when you subscribe to a paid plan, our payment processor, Stripe, collects your payment details. We never store your full card number.

Your broker credentials live only on your own user-run edge, stored locally on disk, and are never transmitted to or stored on our servers. We hold signed approval decisions and audit metadata about actions you authorize, not your brokerage secrets, and not the ability to place trades on your behalf.

Separately, the platform does hold service credentials it needs to operate: our own market-data credentials (used to sync bars and quotes) and the credentials for any non-broker connector you or an admin configures. Those are ours to run the Service, not your brokerage secrets, and they are held under the same access controls described in Security below.

We use information to:

• provide, operate, and secure the Service and authenticate you;
• run the backtests, signals, and automations you request;
• generate the AI features you use, by sending the relevant content to our AI providers: the plain-English strategy or screen you describe to the builder, the evidence behind a signal you ask us to explain, the details of an order awaiting your approval, the market facts behind the daily brief, the plain-English cadence you write into your mandate, and what you say to your managed desk;
• deliver notifications and respond to your requests;
• process payments and manage subscriptions;
• comply with legal obligations and enforce our Terms; and
• improve the Service, generally using aggregated or de-identified data.

We use only essential cookies needed to keep you signed in (managed by our authentication provider). We do not use third-party advertising cookies.

Our hosting provider, Vercel, runs Vercel Web Analytics and Vercel Speed Insights on the Service to measure page views and site performance. Per Vercel’s own documentation, both are recorded anonymously, without identifying an individual visitor, and Web Analytics does so without any third-party cookies. The data points collected may include the route or URL visited, the referrer, approximate geography, browser, device, and operating system, and, for Speed Insights, network speed and Web Vital performance data. See Vercel Web Analytics’ privacy documentation and Vercel Speed Insights’ privacy documentation for the full list of what is collected.

We share information only with service providers that help us operate the Service (see the subprocessors below), when required by law or to protect rights and safety, and in connection with a merger, acquisition, or sale of assets. We do not sell your personal information.

• Supabase: authentication and database hosting.
• Vercel: web application hosting, plus Vercel Web Analytics and Speed Insights.
• Fly.io: platform/API hosting.
• Google: sign-in (OAuth), if you choose it.
• Stripe: payment processing (when paid plans are live).
• OpenRouter: the AI features. Every model call the Service makes is routed through OpenRouter, so it receives the strategy or screen prose you write in the builder, the evidence bundle behind a signal explanation you request, the details of an order awaiting your approval, the market facts behind the shared daily brief, the plain-English cadence you write into your mandate, and what you say to your managed desk.
• Sail Research, Fireworks, Parasail and NextBit: the model-serving providers OpenRouter hands those calls to, and therefore where the text physically lands. Each feature has a short, named list of them, in order. OpenRouter sends a call to the first provider on that feature’s list and moves to the next only when one is unavailable; it never sends the call to a provider outside the list. Your managed desk and the cadence you write into your mandate go to Sail Research first; the builder and screener prose, signal explanations, order-approval details, and the shared daily brief go to Fireworks first. Parasail and NextBit are the backups for both.
• Resend: transactional email. It receives the email address of anyone we invite, in order to deliver the invitation.
• Web Push services: if you switch on approval notifications, your browser’s push service (Google, Apple, Mozilla, or whichever your browser uses) receives the subscription endpoint and keys your browser generates, so we can deliver the alert. We store that endpoint and those keys until you switch the notifications off.
• Market-data providers: market data used by the Service.

We keep your information while your account is active and as needed to provide the Service, and longer where required for legal, audit, or security purposes. You may request deletion of your account and associated personal information as described below.

Removing a board post takes it off the boards, but it does not recall it from copies we retain or from any third-party cache or search index that already captured it.

We protect information with encryption in transit, scoped access controls, and the custody split described above (broker secrets stay on your edge, never our servers). No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If you are a California resident, you have the right to know and access the personal information we collect, to request deletion or correction, and to opt out of the sale or sharing of personal information, although we do not sell or share your personal information. We will not discriminate against you for exercising these rights.

To exercise these rights, contact legal@nakag.ai. We will verify your request, and you may use an authorized agent to submit it.

If you are in the European Economic Area or the United Kingdom, we process your personal data to provide the Service (contract), to comply with law, and for our legitimate interests in operating and improving it. You have rights of access, correction, erasure, portability, and objection, and the right to lodge a complaint with your local supervisory authority. Contact legal@nakag.ai to exercise them. Your data is processed in the United States.

The Service is not directed to anyone under 18, and we do not knowingly collect personal information from children. If we learn we have collected such information, we will delete it.

We operate in the United States, and your information is processed and stored there. If you use the Service from outside the United States, you consent to that transfer and processing.

We may update this Policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, provide reasonable notice.

For privacy questions or data requests, contact legal@nakag.ai.