Privacy Policy

Limnal Research is a daily-updated macro-regime allocation research product. We collect the minimum data needed to authenticate you and deliver the service. We do not sell your data. We do not run advertising. We do not collect financial account credentials, payment cards, or any sensitive personal data beyond what Google provides during sign-in.

• Account info from Google sign-in: your email address, name, and profile picture URL. This is the only data we receive from Google. We request the standardemail and profile OAuth scopes — nothing sensitive.
• Usage events: standard server logs (request paths, timestamps, IP, user agent) for security and debugging. Not used for tracking or behavioral profiling.
• Auth session cookie: a single signed cookie that keeps you signed in across visits. Cleared when you sign out.

• Your Google account password (handled by Google, never reaches us).
• Brokerage credentials or account numbers.
• Payment cards or banking information.
• Health, biometric, or precise-location data.
• Contacts, calendar, drive contents, or any other Google services.

• To sign you in and keep your session active.
• To grant access to private-beta features (admin manually approves your account after sign-in).
• To send transactional notices (invitation, access changes) when needed.
• To diagnose and fix issues, and to keep the service secure.

Limnal is hosted on the following infrastructure providers, each under their own privacy commitments:

• Vercel — serves the Next.js web application.
• Supabase — stores user records and the model outputs that power the dashboards. US data centers.
• Railway — runs the FastAPI backend that computes the daily model rows.
• Anthropic — generates the daily Overview "Quick read" prose summary. Receives only the aggregated daily model outputs (regime score, allocation %s); does not receive user identifiers.
• Google — operates the OAuth sign-in flow. Receives only the OAuth handshake; does not receive any Limnal usage data after sign-in.

We use a single first-party authentication cookie set by Supabase. We do not use third-party analytics or advertising cookies. We do not embed Google Analytics, Meta Pixel, or similar tracking.

Account data persists for as long as your account is active. If you ask us to delete your account, we remove your user record and any personally identifying information within 30 days. Anonymous server logs are retained for up to 90 days for security and operational diagnostics, then rotated.

You can request access to, correction of, or deletion of your account data at any time by emailing aakash.desai@gmail.com. We will respond within a reasonable period. If you live in a jurisdiction with specific privacy rights (EU, UK, California, Virginia, etc.), those rights apply to your account data.

Limnal is not directed at children under 18. We do not knowingly collect data from anyone under 18. If you believe a child has provided data to us, contact us and we will delete it.

We may update this policy as the product evolves. The effective date above is updated when changes ship. Material changes (new data categories collected, new third-party recipients) will be communicated via email to active accounts.

Questions or requests: aakash.desai@gmail.com.