Privacy Policy

Last updated 8 October 2026

Lekanis (“we”, “the service”) is a free web application covering real estate, macro and geopolitical markets, with tools for preparing to discuss them. This policy explains what personal data the service collects, why, and who else processes it.

Who is responsible for your data. Lekanis is operated by Lekanis LLC, from New York, United States, which is the controller of the personal data described here. For anything in this policy, including a request to access or delete your data, contact hello@lekanis.com.

Data we collect

Account data. Your email address and an authentication record, held by our authentication provider. We store a password hash only through that provider; we never see or store your password in plain text.

No payment data. The service is free. We do not take payment and we do not collect or hold a card number, bank details or a billing address.

Signup consent record. When you create an account and agree to the Terms and this policy, we keep a record of that: the exact sentence you agreed to, its version, the time, and the IP address and browser identification of the request. It is proof of what you agreed to and is used for nothing else.

Activity data, created as you use the product:

• Items you save, the folders you create, and follow-up notes you add to a save.
• Likes. These are stored per user so the product knows what you liked, and are counted in public totals, the totals are anonymous and no other user can see which items you liked.
• Reading and interaction events (what you read, liked and saved), used to order your feed.
• Answers you write to daily questions, quizzes and interview practice, and the grades generated for them.
• Interview practice transcripts you create in the product.
• What you tell us you are recruiting for, at signup or later in Account: the verticals you want to work in (for example acquisitions or credit and debt), and optionally the firms or teams you are targeting and any topics you pick. Your verticals decide which deals your feed shows and which “why this matters” framing you see; firms and topics weight the order. We do not ask for your school.

Local device storage. Small values kept in your browser, not on our servers: the last time you visited each section (used to show “new since your last visit” badges).

We do not collect precise location, we do not buy data about you, and we do not run advertising or third-party ad trackers.

How we use it

• To sign you in and keep you signed in.
• To shape your feed: deals in the verticals you picked (plus the occasional market-moving deal outside them), ordered toward what you save, like and told us you care about, and how often something you have seen comes back. The Deals, Macro and Geopolitical pages and search show everything regardless.
• To generate the study material you request, such as folder briefings, interview questions and grading.
• To provide support.

We do not sell your personal data, and we do not use your content to train AI models.

Our legal bases (UK/EU users)

If you are in the UK or the European Economic Area, we rely on the following bases under the UK GDPR and GDPR:

• Performance of a contract, creating and running your account, giving you its features, and providing support. Without this data we cannot provide the service you have signed up for.
• Legitimate interests, keeping the service secure and available, preventing abuse, understanding usage, and shaping your feed around the verticals you picked and the things you save and like. We consider this proportionate because everything left out of your feed is still on the Deals, Macro and Geopolitical pages and in search, and you can change your verticals at any time in Account.
• Consent, where we ask for it specifically, which today means page-view analytics. You can withdraw consent at any time, and withdrawing it does not affect processing carried out before you did.
• Legal obligation, keeping records we are required to keep.

We do not make decisions producing legal or similarly significant effects about you by automated means. AI grading of a practice answer is study feedback; it decides nothing about your account or your access.

Third parties who process data for us

• Supabase, database, authentication and hosting of your account and activity data.
• Vercel, application hosting. Processes request data such as IP address and user agent in the ordinary course of serving the site, and produces operational logs. If you allow analytics, Vercel also provides the cookieless page-view counts described under “Analytics”.
• Anthropic, the AI provider that generates written briefings and grades your answers. Text is sent to Anthropic to produce a response, including the answers you write when you ask for grading and the items in a folder when you ask for a briefing.

The service also reads public market data from the US Treasury, the Federal Reserve Bank of New York, FRED (Federal Reserve Bank of St. Louis), public market quotes and Twelve Data (a market data provider). These are outbound requests for market data and send no personal information about you.

On our content pipeline. Our editorial material is produced from newsletters delivered to an inbox we operate. We do not read, access or ingest your email, and connecting an email account is not part of the product.

Cookies and local storage

We use only strictly necessary cookies. There are no advertising cookies and no analytics cookies. Page-view analytics run only if you allow them, and set no cookie (see “Analytics” below).

• Your authentication session, keeps you signed in across visits, set to persist up to 400 days so you are not logged out repeatedly. In production it is marked secure, so it is only ever sent over HTTPS. Signing out clears it.
• The demo cookie, set only if you choose “Try it instantly”: it lets you read the app without an account for up to 30 days. It holds no identifier, just the fact that you chose the demo, and signing in clears it. In the demo we record nothing about what you read.
• Local storage on your device, when you last visited each section, and your answer to the analytics question; in the demo, how many things you have tapped this visit, so the sign-up suggestion is not shown too early or too often. These never leave your browser.

Because all of these are strictly necessary to deliver a service you asked for, they do not require prior consent under the ePrivacy Directive, and we do not ask you to accept them. We will ask for your opt-in consent before introducing any advertising or any cookie-based or cross-site tracking, and will not set anything of that kind before you give it.

Analytics

Only with your permission. When you first visit, we ask whether we may count page views. If you choose “No thanks”, or do not answer, nothing is counted and the analytics script is never loaded. You can change your answer at any time with the “Analytics choice” link at the foot of every page.

If you allow it, we use Vercel Web Analytics, provided by Vercel, our hosting provider. It records which pages are viewed, the referring site, the country, and the type of device and browser, plus a small number of named steps (for example that a signup was started). It sets no cookie, does not follow you across other websites, and does not identify you: visits are grouped using a short-lived anonymous hash that is discarded daily, and it is not linked to your account. We use it to see how many people visit and where they stop, so we can fix what gets in the way.

Separately, the operator’s administrator can see, inside the product, the list of accounts (each account’s email address, the date it was created, the last day it was active and the verticals it picked) and totals drawn from the activity data described above, such as how many accounts read, liked or saved something. This is used to run the service and see who is using it; it is not shared with anyone.

Do Not Track

Some browsers send a “Do Not Track” or Global Privacy Control signal. We do not track you across other websites or over time for advertising, with or without one. If your browser sends either signal we treat it as a “no” to page-view analytics: we do not load them and we do not ask. California law (CalOPPA) asks us to say how we respond to these signals; this is that statement.

AI-generated content

Most written material in the product is generated by an AI model from source data. It can be incomplete, out of date or wrong, and it is presented for study, not as fact. Verify anything before you rely on it, especially in an interview. Grades and feedback on your answers are automated opinions, not assessments by a person.

Retention

We keep your account and activity data for as long as your account exists, because the product’s value comes from what you have accumulated. If you delete your account we delete your personal data, except where we must keep records for a legal purpose. Cached AI-generated material that is not specific to you may be retained.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to complain to your data protection regulator. To exercise any of these, email hello@lekanis.com. We will respond within the period our law requires, and within 30 days in any case. We will not charge you for exercising a right, and we will not treat you differently for having exercised one.

In practice: access and portability, use “Download my data” in Account for a machine-readable file of everything held against your account, or ask us. Deletion, use “Delete my account” in Account, or ask us: the account and the personal data in it are deleted, and your likes are taken out of the public totals. Correction, your email and interests are editable in Account, and we will correct anything else on request.

If you are in the UK or EEA and think we have handled your data wrongly, you can complain to your national data protection authority, in the UK, the Information Commissioner’s Office. We would rather you told us first so we can put it right.

Security

Access to your rows is restricted at the database level so one user cannot read another’s data, and API routes independently scope every read and write to the signed-in user. Traffic is encrypted in transit. No system is perfectly secure, and we do not claim otherwise.

Children

The service is intended for university students and other adults. It is not directed at children, and you must be at least 16, or the minimum age of digital consent where you live, if that is higher, to create an account.

International transfers

We operate from the United States, and our providers process data there. If you use the service from the UK or the EEA, your personal data is transferred to and processed in the US.

Our processors offer transfer safeguards for that: Supabase, Vercel and Anthropic each publish a data processing agreement incorporating the European Commission’s Standard Contractual Clauses (and the UK Addendum), which is the mechanism we rely on. You can ask us for details of the safeguards that apply to you at hello@lekanis.com.

Changes

If we change this policy we will update the date above, and we will tell you in the product before a material change takes effect.

Contact

Questions about privacy: hello@lekanis.com.