Privacy Policy

1.Who is responsible

Nova is responsible for the data described here. The operating legal entity and its registered address are being confirmed and will be named on this page before public launch. Until then, every request under this policy reaches us at the address at the bottom of this page and is handled by a person.

2.What we collect

Account data, when you sign up: your handle, display name, email address, and either a hashed password or the identifier your sign-in provider gives us. We never store your password itself — only a bcrypt hash of it, which cannot be turned back into the password.

Profile data, if you choose to add it: avatar image, bio, location, website, time zone, locale, display currency and your notification preferences. All of it is optional and all of it except your preferences is public.

Content you create: posts, comments, direct messages, bookmarks, watchlists, saved setups, mentoring bookings, webinar registrations, reports you file and any images you upload.

Account security data: when you last signed in and were last seen, how many sign-in attempts have recently failed, whether the account is locked, and short-lived hashes of any outstanding email-verification code or password-reset token.

Your credits balance and the ledger of credit movements behind it.

3.What we do not collect

No card or bank details. No card processor is connected to the product, so there is nothing for us to store.

No broker or exchange credentials. We do not connect to your trading accounts, and the connections screen shows placeholder rows, not real links to a venue.

Your IP address is not written to our database. It is used in memory, for a few minutes at a time, to rate-limit sign-in and password attempts so that one address cannot grind through passwords. Our hosting provider keeps its own request logs, which are outside our application.

No advertising identifiers, no cross-site tracking, no data broker feeds, and no profiles bought from anybody.

4.Signing in with Google or X

If you sign in with Google we ask Google for your email address and basic profile (name and picture), and we store the account identifier Google gives us so that the same Google account signs you into the same Nova account next time.

If you sign in with X we get your X user record. X does not give us an email address, so an account created that way has none until you add one.

We never receive your password from either provider, and we do not post anything on your behalf.

5.Why we hold it, and on what basis

• To give you the account and the product you asked for — that is the contract between us.
• To keep the service and your account secure: rate limiting, lockouts, session revocation and abuse investigation. Our legitimate interest, and yours.
• To send you transactional email — an email-verification code and a password-reset link. Nothing else is sent to your inbox; there is no marketing email in the product.
• To answer you when you write to support.
• To meet legal obligations where we have them.

6.What is public

Your handle, display name, avatar, bio, badges, posts, comments and the public parts of your profile are visible to anyone, including people who are not signed in and search engines that index the page. Your email address, your preferences, your direct messages and your credit ledger are not.

Images you upload are stored in private storage but are served through long-lived signed links. Anyone who has the link can open the image without signing in, so treat an uploaded image as effectively public once it has been shared.

7.Who else sees it

We do not sell your data and we do not share it for anyone else's advertising.

Microsoft Azure hosts the application, the database, the file storage and the transactional email service, so your data is processed on Microsoft infrastructure on our behalf. Your sign-in provider, if you use one, sees that you signed in.

We will also disclose data where the law requires it, or where it is necessary to investigate abuse or protect someone's safety.

The hosting region and the transfer terms that go with it are being confirmed as part of the legal review and will be stated on this page before public launch.

8.Monitoring and analytics

There is no third-party analytics, advertising or session-recording script anywhere in the product. Nothing on the page reports to Google Analytics, an ad network or a marketing tool.

We use first-party error and performance monitoring (Microsoft Application Insights) on our servers, to find crashes and slow pages. It records which request was made and how long it took. There is no monitoring script in your browser. Email addresses and authentication tokens are stripped from every event before it is stored.

9.How long we keep it

Your account and content stay until you delete the account. Verification codes and password-reset tokens are single-use and expire within minutes. Rate-limit counters live in memory and disappear when the process restarts.

There is no automatic deletion of dormant accounts today. A retention schedule with actual periods is one of the items going into the legal review, and it will be stated here.

10.Deleting your account

Ask us and we will delete your account. There is no delete button in the product yet, so today this is an email — see the address at the bottom of this page. Deletion erases the personal data on the account: email address, password hash, sign-in provider identifier, bio, location, website and avatar are removed, your display name becomes "Deleted account" and your handle is released for reuse.

What survives is the content itself — posts, comments, messages you sent, mentoring bookings and credit ledger entries — now attached to an anonymous account. That is deliberate: those records belong to conversations and transactions with other people, and removing them would take another member's message thread or booking history with them.

If you want specific content taken down as well, write to us and we will do it.

Deletion is refused while a mentoring booking of yours is still open, because credits are held against it. Close those first. A self-service delete control is on the list to build.

11.Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to what we do with it, and to receive it in a portable form. Depending on where you live you may have some or all of these rights by law; we will honour them regardless of where you live.

There is no self-service export button yet. Ask us by email and we will put your data together for you.

If you think we have handled your data badly, tell us first — and you are also entitled to complain to your local data protection authority.

12.Security

• Passwords are stored as bcrypt hashes, never in a form that can be read back.
• Your session lives in a cookie that JavaScript cannot read, and it is sent over HTTPS only.
• Changing your password, or signing out everywhere, invalidates every session issued before that moment.
• Repeated failed sign-in attempts are throttled and then locked out.
• Reset tokens and verification codes are stored only as hashes, so a copy of the database does not let anyone reset your password.

13.Children

Nova is for adults. It is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has an account, tell us and we will remove it.

14.Changes to this policy

When the product changes what it collects, this page changes with it and the date at the top moves. For a material change we will tell you in the product or by email.