Privacy

Last updated October 15, 2026

Latticework collects as little as possible. Here's exactly what happens when you visit.

Optional AI research questions

When AI questions are available, you must explicitly choose to send your question and the selected company's public evidence to Anthropic. Private account notes, email addresses and your Saved list are not included. Do not type confidential or personal information. Anthropic processes these requests under its own API policies. Latticework does not save question text or conversation transcripts on its server; guided questions and searching existing evidence do not contact an AI provider.

The pilot allows four attempted AI questions per browser across companies every 48 hours. An essential signed HTTP-only cookie lasts 48 hours to enforce that allowance. We store protected hashes of browser and network identifiers with counters and expiry, not raw network addresses or cookie tokens. Expired limit records are removed during later question activity. A separate network safety ceiling can affect people sharing Wi-Fi. These identifiers are not used for analytics or linked to private accounts. Failed attempts may count toward the allowance.

To enforce the shared pilot spending cap and prevent duplicate charges, we retain request IDs, timestamps, status and available token/cost totals in dedicated accounting records. They contain no question text, company selections or email addresses. Takeaways you explicitly keep remain dated excerpts in this browser's Saved workspace, not server-stored chat history.

Optional private research accounts

Public research remains free to read without signing in. If you choose My Research, we verify your email using a short-lived code sent through Resend. We store your email, thesis cards, version history, and evidence reviews in our hosted Neon Postgres database. These records are private to your account unless you explicitly publish selected thesis fields using the sharing preview. Private text is not sent to analytics or AI providers. Do not include account numbers, passwords, or sensitive third-party information in your notes.

Essential, HTTP-only cookies maintain your research session for seven days and bind a sign-in code to its requesting browser for ten minutes. We store hashes of session tokens and protected hashes of codes and abuse-limit identifiers, not plaintext codes or raw IP addresses in the research database. Expired authentication records are cleaned up during sign-in activity. Account creation does not subscribe you to email briefings.

You can export your research or delete your account from My Research. Deletion removes your account, sessions, cards, versions, and reviews from the active database; provider backups and transactional email records may persist under their retention policies. Separate Weekly subscriptions are managed independently. Local Saved items are not uploaded unless you explicitly complete and save a research card from them.

Optional selected research sharing

Sharing is off by default. You choose individual thesis fields, inspect the exact preview and confirm publication. The link shows those fields, ticker, thesis version and publication date—not your email, unselected fields, reviews or other history. It is a frozen copy that does not follow later edits. Anyone with the link can read or redistribute it; it is not confidential. We do not publish a directory, include these links in the sitemap, or send their identifiers or contents to analytics. Shared pages request no search indexing and use no-store responses and no-referrer links; these measures cannot prevent third-party copying. Normal hosting request logs may contain the link address.

Revoke a link from its thesis card to stop future access on Latticework. Revocation removes the published text from the active sharing record; a minimal attempt record remains to prevent an old publish request from restoring it. Deleting the thesis or account removes its shared records. Copies already saved by recipients and provider backups cannot be recalled. Do not share confidential, personal or third-party material you do not have permission to publish.

Weekly email and follows

Personal research notifications are a separate optional setting in My Brief. They require a confirmation code sent to your account email. We store consent status and notification attempts to enforce quiet weeks, sending limits and duplicate protection. Notification emails contain only counts and a private-workspace link, not your thesis text or stock list. You can stop them in My Brief or through the stop link in each notification without signing in. Account deletion also removes these preferences and attempt records from our active database. Provider email records may persist under their retention policy. Local keyword suggestions do not send your assumptions to AI providers.

If you choose to subscribe to Latticework Weekly, we store your email address solely to confirm the subscription, deliver reviewed weekly briefings, and honor unsubscribe requests. The subscription uses double opt-in: it is not activated until you click the confirmation link we send. Every briefing includes a one-click unsubscribe link.

If you follow a stock or investor by email, we also store that selected preference. It is activated only after email confirmation. Follow-only subscribers receive a message only when a reviewed weekly edition contains a material new decision connected to that selection—a new position, exit, or at least a 20% share-count change that also clears the published size threshold—so quiet weeks produce no email. Each message includes a link to manage individual follows or stop Weekly and follow emails. Personal research notifications are managed separately.

Email delivery is handled by Resend, and subscription records are stored in our hosted Neon Postgres database. We do not sell email addresses or use them for unrelated marketing. Historical records from a retired alert experiment are not automatically enrolled in the current weekly briefing.

Analytics

We use Vercel Analytics to count page views and understand which pages people find useful. Vercel Analytics is cookie-free and privacy-respecting by design: it records anonymized aggregate metrics (path, referrer, country-level location, browser family) without setting tracking cookies and without selling any data. Its visitor identifier resets daily and does not measure distinct visitors across a month.

If you explicitly allow optional visit measurement below, Latticework uses a random first-party browser identifier that expires 30 days after your last measured visit and a session identifier that expires after 30 minutes of inactivity. We store a protected hash of those identifiers in our own database with public page paths, broad referral categories, and research interactions. We do not store raw IP addresses, search text, or your Saved list in this measurement. These identifiers are not sent to third-party analytics services. A separate protected network hash is used briefly to limit abusive measurement requests; the original network address is not stored. We honor Do Not Track and Global Privacy Control signals.

For subscriptions, we record the signup page and referral category and whether email confirmation completed. With optional measurement allowed, the original signup can be linked to that anonymous browser cohort to measure confirmation and return use. Your email remains in the separate subscription records. Detailed research measurement and attribution records older than 90 days are removed on the next active-day maintenance pass; withdrawing optional measurement stops future collection and clears its browser identifiers.

Hosting

The site is hosted on Vercel. Vercel's edge network logs basic request metadata (IP address, user-agent, path, timestamp) as part of standard hosting infrastructure. We do not retain these logs ourselves and do not link them to any other data.

Local storage

We use localStorage to remember your light/dark preference, your optional Saved workspace, the tickers in your portfolio lens, and recently viewed research. Those lists stay in your browser: there is no account, and the companies or investors you save are not sent to Latticework.

If you choose Share collection, the direct link you copy contains only the public identifiers for the selected stocks, investors, or members of Congress. It does not contain your notes, email address, or identity. Latticework receives the identifiers only if that link is opened.

Anonymous interaction events tell us that someone used search, opened a research page, or added or removed a type of item such as a stock or investor. These events do not include the search text, email address, name, or the specific item saved. Optional first-party measurement records a save action on the public page being viewed, never the contents of your Saved workspace.

Third-party links

We link to SEC EDGAR filings, the project's GitHub, and other external resources. Those sites have their own privacy practices, which are outside our control.

Children

This site is not directed at children under 13.

Changes

This notice may change. The "Last updated" date at the top reflects the most recent revision.

See also our terms of use. Source on GitHub.