Privacy Policy

1. About this policy

This policy explains how Lemnal ("we", "us" or "our") collects, uses, shares and protects personal information in Lemnal: the app at app.lemnal.com, the website at lemnal.com, and our emails (together, "Lemnal").

Lemnal is run from Australia. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

"Personal information" means information or an opinion about a person who is identified, or who can reasonably be identified.

2. What we collect

When you sign in with Google

Google gives us your Google account id (a number that identifies your Google account), your name and your email address. We don't use your Google profile picture or any other Google data, and we never see your Google password.

What you save in Lemnal

• Your journal: the trades you type in or import, and your notes on them.
• Your prop accounts and their rules.
• Your strategies and the tests you run on them.
• Your settings and your progress, such as XP, ranks and badges.

We store this in our database so that it syncs across your devices.

What you post in the community

Your profile name, posts, write-ups, comments and likes, anything you attach to a post (such as a test result), and any reports you make.

If you joined the lemnal.com waitlist

Your email address, when you joined, where you joined from, and when you confirmed your email. To stop abuse of the sign-up form, we also keep a salted hash of your IP address (a scrambled code, not the address itself): one per hour for about a day for the sign-up limit, and the one you joined from for 30 days for the referral rules below.

Referrals and early access

When you join, you get your own short link. We record:

• your referral code (the short code in your link);
• whose link you joined through, if you joined through a friend's link;
• whether a sign-up through your link counts toward your three. It doesn't count if it came from the same connection (the same IP address hash) as you, or as another friend who already counted;
• whether, and when, you were marked for early access.

Anyone who has your code can see how many friends have joined through it, as a number out of three. It never shows who they are or their email addresses, and we never tell the people you invite who else is on the list.

What early access means: once three friends have joined through your link and confirmed their email, you are marked for early access, and your invite goes out before the rest of the waitlist. The friends you bring don't get early access from your three: each of them gets it only by bringing three friends of their own. Without three friends, your invite goes out with the rest of the waitlist. It doesn't promise a date or how much earlier, and it isn't a prize or a payment.

When you use Lemnal

Like any website, Lemnal runs on servers that receive technical information with each request: your IP address, your browser and device type (user agent), the page you asked for and the time. Our hosting provider, Cloudflare, keeps a sample of these request logs for us, which we use to find and fix problems and to stop abuse.

When you contact us

Your email address and whatever you tell us.

What we don't collect

We don't collect payment details, government identifiers, your precise location, your contacts, or logins for your broker or prop firm accounts. We don't ask for sensitive information, such as information about your health, religion or political views. Please don't put sensitive information, or anyone else's personal information, in your journal or your posts.

3. How we collect it

• From you, when you sign in, save things in Lemnal, post in the community, join the waitlist or email us.
• From the link you arrive by: if you join the waitlist through a friend's link, the link tells us whose code it was.
• From Google, when you choose to sign in with Google.
• Automatically, through request logs and the cookies and local storage described in section 11.

We don't buy personal information or collect it from data brokers.

You can browse lemnal.com without telling us who you are. To use the app you need to sign in, because what you save is tied to your account. In the community you can use any profile name you like; it doesn't have to be your real name.

4. How we use it

We use your personal information to:

• sign you in and keep your account secure;
• store and sync your journal, accounts, strategies, tests, settings and progress;
• run your strategy tests (your strategy text is read by Lemnal's own code);
• show your posts, comments and profile name to other signed-in users, and run likes, comments and reports;
• award XP, ranks and badges;
• moderate the community, enforce our Terms of Use and keep people safe;
• detect, prevent and fix abuse, security problems and bugs;
• reply when you contact us, and tell you about your account, the beta, and changes to Lemnal, our terms or this policy;
• send one email to confirm your waitlist sign-up (and a fresh one if you ask for it by joining again);
• count the friends who joined through your link, and mark early access;
• tell people on the waitlist when their access opens;
• meet our legal obligations.

We don't:

• show ads, or let anyone else show ads in Lemnal;
• sell, rent or trade your personal information;
• use third-party analytics, tracking pixels or advertising cookies;
• send your data to any AI provider, or use your content to train AI models.

Lemnal makes two decisions about you automatically: it hides a post once it has three reports (one of our admins then reviews it), and on the waitlist it decides whether a sign-up through your link counts toward your three and, once you have three, marks you (and only you) for early access, by the rules in section 2. If you think a referral was missed, email us and we'll look at it.

We'll only use your personal information for another purpose if the law allows it, for example with your consent or where you would reasonably expect it. If we send you marketing emails, every one will include a way to unsubscribe, and we'll stop when you ask.

5. Who can see it and who we share it with

Other users

Other signed-in users can see your profile name, posts, write-ups, comments and likes, and your community profile. They can't see your email address, your journal, your prop accounts, your strategies or your tests, unless you choose to share something in a post. When you report a post, the person you report isn't told it was you.

Our admins

A small number of people who run Lemnal can access account data when they need to, to run Lemnal, fix problems, moderate the community or respond to requests.

Our service providers

• Cloudflare hosts Lemnal and our database, processes request logs, and protects Lemnal from attacks.
• Resend sends the email that confirms your waitlist sign-up. It receives your email address and the email itself (your confirmation link and your referral link), and keeps a delivery log.
• Google runs sign-in with Google and our email (Google Workspace), including any email you send us.

They handle personal information for us under their contracts with us, and only to provide their services.

When the law requires it, or to keep people safe

We may disclose personal information when the law requires or authorises it, for example under a court order or a notice from a regulator such as the eSafety Commissioner, or where we reasonably believe it's needed to lessen or prevent a serious threat to someone's life, health or safety.

If Lemnal changes hands

If Lemnal or its business is sold or merged, personal information may pass to the new owner, who must handle it in line with this policy. We'll tell you before that happens.

Otherwise, we only share your personal information with your consent.

6. Overseas disclosure

Cloudflare and Google run global networks, so your personal information is likely to be stored or processed outside Australia, including in the United States, Europe and the Asia-Pacific region, and in other countries where they have facilities. Resend processes waitlist emails in the United States.

Before we disclose personal information overseas, we take reasonable steps to make sure the recipient handles it in a way that is consistent with the Australian Privacy Principles, including through our contracts with them. You can read their privacy policies at cloudflare.com/privacypolicy, policies.google.com/privacy and resend.com/legal/privacy-policy.

7. How long we keep it

• Your account, synced data and community content: until you delete them or delete your account.
• Backups: our database keeps recovery copies for up to 30 days, so deleted data is gone from backups within 30 days.
• The waitlist, with your referral code, who invited you, confirmation and early access: until you're invited and create an account, you ask us to remove you, or we close the waitlist.
• The salted hashes of your IP address from the sign-up form: about a day for the hourly sign-up limit, and 30 days for the one you joined from.
• Request logs: a few days. Cloudflare may also keep some logs for its own security purposes under its own privacy policy.
• Emails with us: as long as we need them to deal with your request and keep reasonable records.

We may keep information for longer if the law requires it, or if we need it to deal with a legal claim or a serious safety issue. When we no longer need personal information, we delete it or de-identify it.

8. How we protect it

• Every connection to Lemnal is encrypted (HTTPS).
• Our database provider encrypts stored data.
• You sign in through Google, so we never hold a password for you.
• Only the people who need access to account data have it.
• Lemnal uses strict browser security policies, rate limits, and checks on every request that changes data.

No system is perfectly secure. If a data breach is likely to cause you serious harm, we'll tell you and the Office of the Australian Information Commissioner (OAIC), as the Notifiable Data Breaches scheme requires.

9. Access and correction

• You can see and edit most of your information directly in Lemnal.
• You can ask for a copy of the personal information we hold about you, or ask us to correct it, by emailing yuvrajsharma@lemnal.com from the address linked to your account. We may need to confirm it's you.
• We'll respond within 30 days, and there's no charge. If we can't give you access or make a correction, we'll tell you why, as far as the law allows, and how to complain.

10. Deleting your account and data

• You can delete your account in Settings. This removes your account, your synced data and your community posts. You can also email yuvrajsharma@lemnal.com and we'll do it for you.
• Deleted data is gone from our backups within 30 days.
• Anything kept only in your browser's local storage stays on that device until you clear it, either in Lemnal's Settings or in your browser's settings for app.lemnal.com.
• To remove Lemnal's access to your Google account, go to the third-party connections page of your Google Account at myaccount.google.com/connections.
• To leave the waitlist, email us.

11. Cookies and local storage

lemnal.com sets no cookies. app.lemnal.com uses only cookies that are strictly necessary:

Cloudflare may also set a strictly necessary security cookie if it needs to check that a visitor is a person and not a bot.

Your browser's local storage holds your preferences, such as theme and sound, and small things such as what you've already seen, on that device. On lemnal.com it holds your referral code and progress, so the page shows your link when you come back, and the code of a friend's link you arrived by until you join. It isn't used to track you.

We don't use analytics, advertising or tracking cookies, and no third-party scripts run on our pages. Because everything we use is strictly necessary, there's no cookie banner. If you block cookies, you won't be able to sign in.

12. Children and teens

If you're 13 to 17, this part is for you.

• Lemnal is for people aged 13 and over. If you're under 18, you need your parent or guardian's permission to use it.
• You get the same Lemnal as everyone else, with the same protections: no ads, no selling your data, and no tracking you around the internet.
• Other signed-in users can see your profile name, posts and comments. You don't have to use your real name. Don't post your full name, where you live, your school, your phone number, photos of yourself, or anything else that could identify you.
• You can delete your posts, or your whole account, at any time.
• If someone makes you uncomfortable, report their post, tell an adult you trust, and email us. You can also get help from eSafety at esafety.gov.au.

Parents and guardians can email yuvrajsharma@lemnal.com to ask what we hold about their child, to correct it, or to delete the account.

If we learn that someone under 13 has an account, we'll delete the account and its data.

The OAIC is developing a Children's Online Privacy Code, due in late 2026. Once it is registered, we'll review Lemnal and this policy against it.

13. Complaints

If you're unhappy with how we've handled your personal information, email yuvrajsharma@lemnal.com with the details. We'll reply within 7 days to say we've received it, and aim to resolve it within 30 days.

If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

14. Changes to this policy

We'll update this policy when Lemnal or the law changes. The date at the top of this page shows the latest version. If a change is significant, we'll tell you in Lemnal or by email before it takes effect.

15. Contact

Lemnal, Australia. Privacy questions, requests and complaints: yuvrajsharma@lemnal.com.