DRAFT. Not reviewed by a lawyer and not in force.
Text in [square brackets] is a placeholder for you to fill in or decide. Have a lawyer in your country review and complete this page before launch, then remove this banner and the search-engine block on the page.
مسودة. لم يراجعها محامٍ وليست سارية. هذه الصفحة بالإنجليزية فقط، وتحتاج ترجمة قانونية عربية قبل الإطلاق.
Privacy Policy
Draft updated 2026-10-22
This policy explains what Nuqood (“we”) collects, why, who else handles it, and your choices. It covers the website and web app at [your domain]. The service is run by [legal name of the company or person, address, registration number].
What we collect
- Account: your email address, name, base currency, language and theme. If you sign in with Google, the name and email Google gives us.
- What you enter: holdings (ticker, quantity, price, date), properties, startup investments, cash, debts, budget amounts and categories, and transactions. This is financial information about you. We use it only to show it back to you.
- Subscription: your plan, its status and renewal date, and a Stripe customer id. We never see or store your card number.
- Technical: your IP address and basic request logs, kept by our host to run and protect the service.
We do not collect your bank logins, broker passwords or government ids. If you upload a CSV from a broker, it is read in your browser and only the rows you confirm are saved.
Why we use it
- To provide the service: show your net worth, screening, budget and reports.
- To run your account and subscription, and to email you about them (confirmation, password reset, receipts).
- To keep the service secure and working, and to answer your support messages.
Legal basis (where the law asks for one): performing our contract with you, our legitimate interest in running a secure service, and your consent where we ask for it. [lawyer: confirm the legal bases for your country]
We do not sell your data
We do not sell your data, and we do not share it for advertising. We do not run advertising or marketing trackers.
Who handles your data (processors)
These companies help us run the service. Those that receive personal data:
| Company | What for | What they receive |
|---|---|---|
| Supabase | Database, accounts and sign-in, backups | Your email, name, password (stored as a hash), preferences, and everything you enter: holdings, properties, startups, cash, debts, budget and transactions. [region of the production project: choose when you create it] |
| Stripe | Payments and subscriptions | Your name and email and your payment details. Card numbers go from your browser to Stripe and never reach our servers. We keep only your Stripe customer id, plan, status and renewal date. |
| Vercel | Hosting: serves the website and runs the server code | Your IP address and request logs as part of serving pages. [Confirm the host once chosen.] |
| Email provider [Resend or Postmark: not chosen yet] | Sends confirmation, password-reset and receipt emails | Your email address and the text of the message. |
| Optional sign-in with Google | Only the sign-in request. If you use it we receive your name and email address from Google (scopes: openid, email, profile). |
These supply market data and receive no personal data, only symbols, coin identifiers or currency codes:
- Twelve Data: Stock, ETF and commodity prices and market status. Ticker symbols only. No personal data. [The provider may change: update this line.]
- CoinGecko: Cryptocurrency prices. Coin identifiers only. No personal data.
- Frankfurter: Exchange rates (European Central Bank data). Currency codes only. No personal data.
The fonts on this site are downloaded once when the site is built and served from our own host, so your browser does not contact Google Fonts.
Not used today: Analytics, Advertising or marketing trackers, [Error tracking [decide: Sentry or the host's own]]. If we add any of them we will list them here before we switch them on.
Cookies and storage
We use one kind of cookie: the sign-in session cookie, which is essential and cannot be switched off. Your browser also keeps your language and theme choices. There are no advertising or analytics cookies today. [if you add analytics, say which and whether it needs consent in the EU and UK]
International transfers and where data is stored
Our database and host are in [region and country]. Some processors above may handle data in other countries. [lawyer: transfer mechanism, for example standard contractual clauses]
How long we keep it
We keep your data while your account is open. When you delete your account in Settings, we delete your account, your data and your Stripe customer record. Backups are removed on their normal schedule, [number of days]. We may keep invoices and tax records as the law requires, [period].
Your choices and rights
- See, correct or export your data: you can see and edit everything in the app. [export: say how you will answer an export request]
- Delete your account and data yourself in Settings, any time.
- Object, restrict or complain. Depending on where you live you may have more rights, including to complain to a data-protection authority. [lawyer: list the rights that apply]
Security
Each person's data is separated by database rules so one account cannot read another's. Connections use HTTPS. No system is perfectly secure: [breach-notification promise, with a time limit].
Children
Nuqood is not for people under [minimum age].
Changes and contact
If we change this policy in a way that matters, we will tell you by email or in the app before it takes effect. Contact: [privacy email address].