Privacy Policy

Last updated 30 July 2026

Lekanis (“we”, “the service”) is a subscription web application covering real estate, macro and geopolitical markets, with tools for preparing to discuss them. This policy explains what personal data the service collects, why, and who else processes it.

Who is responsible for your data. Lekanis is operated from New York, United States, and is the controller of the personal data described here. For anything in this policy — including a request to access or delete your data — contact privacy@lekanis.com.

Data we collect

Account data. Your email address and an authentication record, held by our authentication provider. We store a password hash only through that provider; we never see or store your password in plain text.

Subscription data. Your plan tier, subscription status, and a customer identifier issued by our payment processor. We do not receive, store, or have access to your card number, CVC, or bank details — those are handled entirely by Stripe.

Activity data, created as you use the product:

• Items you save, the folders you create, and follow-up notes you add to a save.
• Likes. These are stored per user so the product knows what you liked, and are counted in public totals — the totals are anonymous and no other user can see which items you liked.
• Reading and interaction events used for your daily goal, your streak, freezes and weekly unlocks.
• Answers you write to daily questions, quizzes and interview practice, and the grades generated for them.
• Chat and interview transcripts you create in the product.
• The interests you select at signup (verticals, firms, topics), used to weight your feed.

Local device storage. Small values kept in your browser, not on our servers: whether you have seen today’s streak screen, and the last time you visited each section (used to show “new since your last visit” badges).

We do not collect precise location, we do not buy data about you, and we do not run advertising or third-party ad trackers.

How we use it

• To sign you in and keep you signed in.
• To provide the paid features your tier includes, and to determine access.
• To weight your feed toward what you save, like and told us you care about. This is weighting only — it never hides categories of content from you.
• To generate the study material you request, such as folder briefings, interview questions and grading.
• To operate streaks, goals and weekly unlocks.
• To take payment, handle failed payments, and provide support.

We do not sell your personal data, and we do not use your content to train AI models.

Our legal bases (UK/EU users)

If you are in the UK or the European Economic Area, we rely on the following bases under the UK GDPR and GDPR:

• Performance of a contract — creating and running your account, giving you the features your plan includes, taking payment, and providing support. Without this data we cannot provide the service you have signed up for.
• Legitimate interests — keeping the service secure and available, preventing abuse, understanding aggregate usage, and weighting your feed toward the things you save and like. We consider this proportionate because it only ranks content you already have access to; it never hides categories from you, and you can change your interests at any time in Account.
• Consent — where we ask for it specifically. You can withdraw consent at any time, and withdrawing it does not affect processing carried out before you did.
• Legal obligation — keeping records we are required to keep, such as tax and payment records.

We do not make decisions producing legal or similarly significant effects about you by automated means. AI grading of a practice answer is study feedback; it decides nothing about your account, your access or your money.

Third parties who process data for us

• Supabase — database, authentication and hosting of your account and activity data.
• Vercel — application hosting. Processes request data such as IP address and user agent in the ordinary course of serving the site, and produces operational logs.
• Stripe — payment processing, checkout, and the billing portal. Stripe collects your payment details directly and is the controller of that payment information under its own privacy policy.
• Anthropic — the AI provider that generates written briefings and grades your answers. Text is sent to Anthropic to produce a response, including the answers you write when you ask for grading and the items in a folder when you ask for a briefing.

The service also reads public market data from FRED (Federal Reserve Bank of St. Louis) and public market quotes. These are outbound requests for public data and send no personal information about you.

On our content pipeline. Our editorial material is produced from newsletters delivered to an inbox we operate. We do not read, access or ingest your email, and connecting an email account is not part of the product.

Cookies and local storage

We use only strictly necessary cookies. There are no advertising cookies, no analytics cookies, and no third-party trackers of any kind.

• Your authentication session — keeps you signed in across visits, set to persist up to 400 days so you are not logged out repeatedly. In production it is marked secure, so it is only ever sent over HTTPS. Signing out clears it.
• An administrator preview setting — set only if an administrator switches the app into a preview mode. It is never set for ordinary accounts.
• Local storage on your device — whether you have seen today’s streak screen, when you last visited each section, and whether you have dismissed the cookie notice. These never leave your browser.

Because all of these are strictly necessary to deliver a service you asked for, they do not require prior consent under the ePrivacy Directive, and the notice you see is an explanation rather than a consent request — we do not ask you to accept tracking, because there is none to accept. If we ever introduce analytics or advertising, we will ask for your opt-in consent first and will not set anything non-essential before you give it.

AI-generated content

Most written material in the product is generated by an AI model from source data. It can be incomplete, out of date or wrong, and it is presented for study, not as fact. Verify anything before you rely on it — especially in an interview. Grades and feedback on your answers are automated opinions, not assessments by a person.

Retention

We keep your account and activity data for as long as your account exists, because the product’s value comes from what you have accumulated. If you delete your account we delete your personal data, except where we must keep records for a legal or tax purpose — for example, Stripe retains payment and invoice records under its own obligations. Cached AI-generated material that is not specific to you may be retained.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to complain to your data protection regulator. To exercise any of these, email privacy@lekanis.com. We will respond within the period our law requires, and within 30 days in any case. We will not charge you for exercising a right, and we will not treat you differently for having exercised one.

In practice: access and portability — ask and we will send you the data held against your account in a machine-readable file. Deletion — ask and we will delete your account and the personal data in it, keeping only what a legal or tax obligation requires (payment and invoice records held by Stripe under its own obligations, for example). Correction — your email and interests are editable in Account, and we will correct anything else on request.

If you are in the UK or EEA and think we have handled your data wrongly, you can complain to your national data protection authority — in the UK, the Information Commissioner’s Office. We would rather you told us first so we can put it right.

You can see and change your plan at any time in Account, and cancel from the billing portal there.

Security

Access to your rows is restricted at the database level so one user cannot read another’s data, and API routes independently scope every read and write to the signed-in user. Traffic is encrypted in transit. No system is perfectly secure, and we do not claim otherwise.

Children

The service is intended for university students and other adults. It is not directed at children, and you must be at least 16 — or the minimum age of digital consent where you live, if that is higher — to create an account.

International transfers

We operate from the United States, and our providers process data there. If you use the service from the UK or the EEA, your personal data is transferred to and processed in the US.

Our processors offer transfer safeguards for that: Supabase, Vercel, Stripe and Anthropic each publish a data processing agreement incorporating the European Commission’s Standard Contractual Clauses (and the UK Addendum), which is the mechanism we rely on. You can ask us for details of the safeguards that apply to you at privacy@lekanis.com.

Changes

If we change this policy we will update the date above, and we will tell you in the product before a material change takes effect.

Contact

Questions about privacy: privacy@lekanis.com.