Who this policy covers
This policy applies to this website and the Lagani application behind it. It is run by the Lagani team ("we", "us"). It covers anyone who visits the public pages and anyone who has an account.
What Lagani stores
Lagani stores the following on its servers, and nothing else about you.
- Your account
- Your email address, first and last name, the role your account has, whether it is active, and when it was created and last changed. Your password is stored only as a one-way hash; the password itself is never kept and nobody can read it back.
- Sign-in and security records
- When you last signed in and when you were last active; a count of recent failed sign-in attempts and, if sign-in was paused after too many, until when; a hashed record of each sign-in session with the time it was created and expires; and, while an invitation or password-reset link is outstanding, a hashed copy of that link and its expiry time. If you turn on two-factor sign-in, the secret your authenticator app shares with Lagani is stored so codes can be checked. To stop forms being sent over and over, Lagani also keeps a short-lived count of how often certain actions, such as signing in, sending the contact form or asking the assistant a question, were made from your account or from your network address. The address is scrambled before it is counted, and each count is removed soon after its time is up.
- Your portfolio records
- The portfolios you create (name and description) and what you enter into them: transactions (the scrip, type, quantity, price, date, the charges and tax worked out for it, and any note or tag you add), cash dividends, money you record as sent to or taken back from your broker, IPO applications, and your notes on individual scrips. When you import a file from MeroShare or TMS, the file is read in your browser and only the trades you confirm are saved; the file itself is not uploaded or kept.
- Your watchlist
- The scrips you follow, the price targets and trailing stops you set, and your notes on them.
- Notification settings
- Which alerts you have turned on, what you have muted, and when each kind was last sent. If you connect Discord, the webhook address you provide. If you connect Telegram, the identifier and name of the chat you linked.
- Display preferences
- Choices such as the calendar (BS or AD) and the limits and comparison rates you set, saved with your account so they are the same on every device.
- Who you have shared a portfolio with
- A record linking the portfolio to the other person's account.
Lagani does not ask for, and does not store, your MeroShare or TMS login, your bank details, your citizenship or other identity documents, or your phone number.
The questions you type to the assistant, and its answers, are not saved. Only the short-lived count of questions asked, described above, is kept.
What stays in your browser
Some things are kept only on the device you are using, in the browser's own storage:
- whether you chose the light or the dark theme;
- your sign-in state: a short-lived access token and your name, email address and role, so the app can open without asking you to sign in on every page;
- a working copy of your display preferences, which is also saved to your account.
Market news, company figures and similar reference information are requested by your browser directly from third-party websites when you open the pages that show them. They do not pass through Lagani's servers and Lagani does not store them. Those requests are sent without cookies or any sign-in information, but the third-party site receives them as it would any visit, which includes your IP address and which company you asked about.
Who can see your information
- You
- Everything in your account.
- People you share a portfolio with
- Sharing is your choice, one portfolio at a time, with another Lagani account you name by its email address. That person can view the portfolio and its records but cannot change them, and sees your name as its owner. You can end the sharing at any time.
- Administrators
- The administration screens show each account's email address, name, role, whether it is active, when it last signed in and was last active, how many portfolios and transactions it has, and when a transaction was last changed. They do not show what anyone holds. Administrators can create accounts, send invitation and reset links, set a new password for an account, change its role, and suspend or reactivate it.
- Our team and service providers
- The members of our team who operate the system have technical access to the database that holds all of the above, and use it only to run, maintain and fix the service. Our hosting and database providers store and process the data on our behalf and may keep technical logs of requests, such as IP addresses and times, as part of running their infrastructure.
We do not sell, rent or trade your information, and we do not use it for advertising.
What is sent to third parties
- Discord or Telegram, if you connect one
- The alerts and summaries you turn on are sent to the Discord webhook or Telegram chat you connected. These messages can include the scrips you hold or follow, prices, your targets and figures from your portfolio. If you turn on the weekly backup, a file containing everything you have entered is sent to that same channel. Once delivered, those messages are held by Discord or Telegram under their own terms, and anyone with access to that channel or chat can read them. If you send messages to the Lagani bot on Telegram, Telegram delivers them to Lagani so it can answer. Nothing is sent to either service unless you connect it, and you can disconnect at any time.
- Your email address is passed to our email delivery provider to send invitations, password-reset links and security notices, such as a notice that your password was changed. Lagani does not send marketing email.
- Requests for an account
- When you fill in the form on the contact page, the name, email address, phone number and message you type are emailed to our team, through the same email delivery provider, so that we can answer you. The request is not saved in Lagani's database; it exists as that email.
- The assistant
- When you ask the assistant about a scrip, the reading Lagani has worked out for that scrip, such as its price, the day's change, its signal and its price levels, may be sent to a third-party language model service so that it can be put in plainer words. That text describes the scrip only. It does not include your question, your name, email address or account identifier, what you hold, how much, at what cost, or any plan made for you, and it is not linked to your account. The service receives it as it would any request and may keep it under its own terms. Answers about your own portfolio, and answers to the slash commands, are worked out on Lagani's servers and are not sent to it. If the service is unavailable, the answer is given without it.
- Market data
- Prices and other market information come from third-party market data. Requests Lagani's servers make for it concern the market, not you.
We may disclose information where the law requires it. Otherwise it is not passed to anyone outside the cases on this page.
Deleting, restoring and backing up
- When you delete a transaction, a cash dividend, a cash entry, an IPO application or a whole portfolio, it stops counting at once and moves to the trash. You can restore it from there for 30 days. After that it is cleared out for good, together with everything inside a deleted portfolio.
- You can remove a Discord webhook or disconnect Telegram at any time; Lagani then stops sending and no longer holds that address or chat.
- You can download a backup of everything you have entered from the Reports page, and restore from one. A backup file is yours to keep safe: it contains your full records.
- There is no button to delete your own account. To have your account and everything in it removed, ask us, and we will delete it.
We keep your information for as long as your account exists. Our database provider may keep its own backups for a limited time, so information removed from Lagani can remain in those copies until they expire.
For a deletion request, or a copy of or correction to your information, write to us through the contact page. Our team reads every message and will act on your request.
How it is protected
Passwords are stored only as hashes. You can add two-factor sign-in with an authenticator app. Sign-in is paused for a while after repeated wrong attempts. You can sign out of every device at once from your account page, and changing your password does the same. Session tokens are stored hashed and each one works only once.
No system is perfectly secure, and we cannot promise that information will never be accessed, lost or disclosed. Use a strong password that you do not use elsewhere, and keep your Discord webhook address and Telegram chat private.
Changes to this policy
When what Lagani stores or shares changes, this page will be updated and the date at the top changed. The version on this page is the one in force.