Privacy Policy

This Privacy Policy describes how JagInsights LLC, a Virginia limited liability company ("JagInsights," "we," "us" or "our"), collects, uses, discloses and retains information about you when you use the JagSim website at jagsim.com and the related practice-trading and research services (together, "JagSim" or the "Services"). In this Privacy Policy, "you" means any visitor to or member of the Services. This Privacy Policy describes the Services as they operate on the date shown above.

1. Information We Collect

1.1 Information you provide when you create an account

• Your email address, the trader name you choose and a password. Supabase, our authentication provider, stores the password only in hashed form, and we never have access to it.
• A record that you checked the box agreeing to the Terms of Service and this Privacy Policy and confirming that you are at least 13 years of age, and the date of the version you accepted.
• Information about how you arrived: the website that referred you to JagSim, a source label in the link you followed, the page you signed up on and which of its buttons opened the sign-up, whether you used the practice demo first, and, for an account made before October 23, 2026, the league invitation that brought you, if any.
• If you arrived through one of our advertisements: the advertisement and campaign names contained in the link you followed, the advertising platform on which the advertisement appeared, the page on which you arrived and the time of arrival. We never collect the advertising platform's own click identifier.
• How you heard about JagSim, if you choose to tell us.

1.2 Content you create

Your practice trades, orders and portfolio; watchlists, price alerts, research notes, saved headlines and saved tests; poll votes; the traders you followed before Follow was retired on October 24, 2026; leagues you create or join; the messages in your JagSim inbox; and your settings.

1.3 Information collected while you are signed in

• The pages you open, the buttons you press, the searches you perform, the steps you take toward purchasing a plan, and your practice trading activity. This information is recorded with your account regardless of your cookie choice, because it is necessary to operate the Services.
• For each page you open: the time, the address of the referring page, the country from which your connection originates (as reported by Cloudflare) and your browser's user-agent description (its name and version and your operating system).
• When your cookie choice permits measurement (Section 4), also: whether you are using a phone, tablet or computer, your browser's name, the approximate size of your browser window, an identifier for the current visit, and a signal sent once per minute while a page is open in the foreground, so that time spent on the Services can be measured.
• For each sign-in: the time, the country, the type of device, the browser and device names, the network portion of your IP address and a one-way code derived from the full address (Section 7). Supabase also maintains your authenticated session, which contains your IP address and your browser's user-agent description.
• For each request for a sign-in code, a password reset or a sign-up email: the email address or trader name entered, the type of request and whether it succeeded.
• The emails we send you, a copy of the content of each, and whether each was delivered, delayed or returned undeliverable. We do not record whether you open an email or click its links.

A search is stored as the words you submitted, truncated to 40 characters. A search that resembles an email address or contains a long number is not stored.

1.4 Information collected when you visit without signing in

The information we record depends on your cookie choice (Section 4):

• When measurement is permitted: the pages you open, the address of the referring page, your country, whether you are using a phone, tablet or computer, your browser's name, the approximate size of your browser window, a random identifier stored in your browser so that a returning browser is counted once, an identifier for the current visit, the buttons and links you press (the name of the control and the page it is on), the searches you perform and the steps you take toward purchasing a plan. If you arrived through one of our advertisements, the advertisement and campaign names contained in its link and the advertising platform on which it appeared. If you create an account within seven days of such a visit and sign in to it on the same browser, these records of your visits before you signed up are joined to your account and are then treated as activity recorded with your account (Section 7).
• When you have not yet answered our cookie notice in the European Union, the European Economic Area, the United Kingdom or Switzerland (or when Cloudflare cannot determine your country): our pages send no page view and no search on your behalf, and we record nothing about your visit until you answer.
• When your browser sends a Global Privacy Control signal and you have not selected Accept all on the Services: a single count for each page you open, containing only the page and your country. Nothing is stored in or read from your browser for this purpose, our systems do not read your IP address for it, and your browser's user-agent description is used only to exclude automated traffic and is not retained.
• When you have selected Reject all: we record no page views and no searches for you.

1.5 Error reports and security records

The following records are created for all users, regardless of cookie choice:

• When a page encounters an error, an error report containing the error message and the location in our code where it occurred, the page address (with sign-in codes and advertising click identifiers removed), your browser's user-agent description, the version of the Services and, if you are signed in, your account.
• When activity appears to be an attack or abuse (for example, repeated failed sign-in attempts, an excessive number of requests or requests for files that do not exist), a security record containing a description of the event, the page, your IP address, your country, your browser's user-agent description, a random identifier for the browser tab and, if you are signed in, your account. For a failed sign-in attempt, we retain only the first character and the domain of the text entered (for example, a***@example.com) and a short code derived from the full text, never the full address and never a password.
• To prevent overuse, our price service counts the requests received from each IP address in each hour, and our sign-in and other forms count attempts. These counters may contain your IP address, your account number or the text entered into the sign-in field (Section 7).

1.6 Problem reports and support

A problem report you submit through the Services contains the text you write, any screenshots you attach, the page you were viewing, your browser's user-agent description and, if you are not signed in, your email address. Email sent to [email protected] is received in our support mailbox, which is hosted by Zoho, and a copy of each problem report is sent to the same mailbox. Before October 2026, those copies were sent to a Yahoo Mail mailbox, where the earlier copies remain.

1.7 Payment information

If you purchase a plan, you pay on a page hosted by Stripe. Your card details are provided directly to Stripe and never pass through JagSim. We retain the plan, its price, its dates and its status, the steps you took to purchase it, your acceptance of the billing terms (together with your email address and the version of the wording presented to you), and Stripe's identifiers for you, your plan and your payment.

1.8 Google Analytics

When your cookie choice permits measurement (Section 4), whether or not you are signed in, our pages also load Google Analytics, a measurement service provided by Google. Google Analytics receives the address and title of each page you open, without the sign-in codes, email addresses or advertising click identifiers a link may carry (of the details in a link, we pass on only our campaign labels), the address of the referring page, how you use the page (for example, how far you scroll and which links to other websites you select), your browser and device type, your screen size and language, and your IP address, from which Google estimates your approximate location. Google states that Google Analytics does not log or store IP addresses. Google Analytics stores two random identifiers in your browser so that a returning browser is recognized (Section 4). We do not send Google your email address, trader name, account number, practice trades or searches, and we have turned off Google's advertising features for Google Analytics on our pages (Google signals and advertising personalization). Google explains how it uses information from sites that use its services, and offers a browser add-on that blocks Google Analytics on every website.

2. Information Visible to Others

• Rankings. After you make at least one practice trade, your trader name, the value and return of your practice account, your number of trades and whether you have Pro are listed on Rankings. Rankings are visible to anyone, whether or not signed in.
• Trader profile. Anyone may open the profile page for your trader name. It shows when you joined, your practice return for the current month and in total, your number of trades, your percentile rank and whether you have Pro.
• Holdings. The shares and coins you hold, their quantities, your average cost and the dates of purchase are shown to other signed-in members only if you enable portfolio sharing. Sharing is disabled unless you enable it.
• Leagues. Members of a league can see one another's trader names, standings, returns, numbers of trades and Pro badges and, in the league's activity, the practice trades each member makes while in the league (the stock or coin, buy or sell, the quantity and the time). Anyone with a league's invitation link can see the league's name, its creator's trader name, how many members it has, the days it has left, and the trader name and return of the member in first place. Leagues were retired from October 23 to November 6, 2026; their records were kept.
• Trader names. Your email address is never shown to other members. Your trader name is the name you choose at sign-up, and it is public; you should choose a name other than your real name. Rankings does not offer a setting to hide your name; to be excluded from Rankings, contact us by email.

3. How We Use Information

We use the information described above for the following purposes:

• to operate your account and the features of the Services you use, including Rankings and leagues;
• to secure the Services and prevent abuse, which is the principal use of IP addresses;
• to understand how the Services are used, identify errors and improve the Services;
• to determine which of our advertisements and links bring visitors to the Services, using the names contained in the link (no information is sent back to the advertising platform);
• to send you email. Account emails are always sent: the sign-up code, sign-in codes and links, password resets, notices that your email address or password has changed, receipts and cancellation notices, a reminder before a yearly plan renews, notices about a free try of Pro you started, and replies to your problem reports. Product emails concern JagSim and your practice activity: a welcome email when you confirm your address, reminders to complete sign-up or make a first trade, the results of your trades, notices when you have been inactive or an order has filled, surveys, a weekly summary when we send one, and news about the Services. You choose whether to receive product emails when you create your account and may change that choice in Settings at any time; account emails are sent either way. You may also disable product emails by using the Unsubscribe link in each one. Every product email contains that link and our postal address, and an unsubscribe request takes effect immediately; and
• to process payments for plans and maintain the records required by law.

We do not sell your personal information, and we do not share it with anyone for advertising purposes. The Services display no advertising from other companies, and no advertising code, pixel or cookie operates on the Services. We use Google Analytics only to measure how the Services are used, never for advertising (Section 1.8).

4. Cookies and Similar Technologies

We store two categories of information in your browser:

• Strictly necessary (always active): your sign-in session (maintained by Supabase's authentication code); your cookie choice (a cookie named jag_cc, retained for approximately 10 years, with copies in your browser's storage); your settings and records of what you have already viewed, such as a completed tour; whether this browser has been signed in before, so that a first visit is not greeted as a return; steps in progress, such as the plan you selected during sign-up or payment, the steps of a purchase you have begun while signed in, the button that brought you to the plans page, or a league invitation; and a random identifier for the open tab that groups its security records. Some of these items contain your account number, so that one member's settings are never shown to another member on a shared computer. Cloudflare, our network provider, also sets its own security cookie (cf_clearance) for every visitor to distinguish people from automated traffic.
• Measurement: a random identifier that allows a returning browser to be counted once (jag_anon); an identifier for the current visit, stored in the open tab (jag_visit); a random identifier for a practice demo session (jag_demo_sid); if you are not signed in, a random identifier that links the steps toward purchasing a plan, stored in the open tab; a record of how you first arrived, including the trader name of a member whose invitation link you followed (jag_acq, jag_ref, jag_signup_src); if you arrived through one of our advertisements, the names contained in that advertisement's link, for 30 days (jag_ad); and, for Google Analytics, two cookies set by Google's code for jagsim.com, each retained for up to two years, that hold a random identifier for your browser and for your current visit (_ga and _ga_ZFTCH936JY).

Your location determines the default setting. In the European Union, the European Economic Area, the United Kingdom and Switzerland, and wherever Cloudflare cannot determine your country, measurement is off until you select Accept all, a notice requests your choice on our public pages, and until you answer, our pages record nothing about your visit. Elsewhere, measurement is on unless you select Reject all, and no notice is displayed. Google Analytics follows the same choice. We treat a Global Privacy Control signal from your browser as a request to keep measurement off, unless you select Accept all on the Services. We do not respond to other "do not track" signals. You may change your choice at any time using the button below or the Cookie choices button at the foot of most of our pages.

Cookie choices

When measurement is off, no measurement identifier is stored in your browser and Google Analytics is not loaded, and selecting Reject all also removes the measurement identifiers and records listed above, including Google's cookies, and turns Google Analytics off. If you are signed in, your cookie choice does not affect the account activity described in Section 1, which is necessary to operate the Services.

Cloudflare Web Analytics, which our network provider adds to our pages, also counts page loads and page load speed for visitors outside the European Union, regardless of cookie choice and before any answer; it is not loaded for visitors in the European Union. It stores nothing in your browser, and Cloudflare states that it does not use cookies or fingerprinting for this purpose.

We use no advertising cookies, and no company uses JagSim to track your activity across other websites for advertising.

5. How We Share Information

The following service providers operate parts of the Services on our behalf and receive information only as necessary to perform that work:

• Supabase provides our database, authentication and file storage. The records described in Section 1 are stored with Supabase, except for email held in our mailboxes.
• Cloudflare hosts the website and our server programs and carries every request to the Services, and therefore receives your IP address and your browser's user-agent description. Cloudflare also protects the Services from attacks and automated traffic, reports the country from which a visit originates and counts page loads (Web Analytics).
• Stripe processes payments for plans. Stripe receives your email address, our identifier for your account and the plan you selected, as well as the card details you enter on Stripe's page. Stripe maintains its own payment records under its own privacy policy.
• Resend delivers every email we send, including sign-up and sign-in emails, and therefore receives your email address and the content of each email, and reports to us whether it was delivered.
• Zoho hosts our support mailbox. Zoho receives the email you send to [email protected] and a copy of each problem report.
• Google provides Google Analytics, which measures how our pages are used when your cookie choice permits measurement, and receives the information described in Section 1.8.
• Market data and news providers (Tiingo, StockNewsAPI and the public filings of the U.S. Securities and Exchange Commission). Our servers request prices, company figures and news from them by ticker symbol or by the words of a ticker search. They receive no information about you. Images in news stories load directly from the servers of the news source or the news provider, which receive your IP address in the same way as any website you visit.

We may also disclose information when required by law, to protect JagSim, its members or the public, and to a successor in the event of a sale or merger of the business, subject to this Privacy Policy.

6. International Transfers

JagSim is operated from the United States. Our database is hosted in Supabase's United States (Ohio) region, and Cloudflare carries requests through its servers worldwide. If you use the Services from another country, your information is transferred to the United States, where data protection laws may differ from those of your country.

Transfers from the European Union, the United Kingdom and Switzerland

The following service providers process information about members and visitors from Europe outside Europe. For each provider, the legal basis for the transfer is stated below as set out in the provider's own documentation (reviewed October 17, 2026, and for Google October 24, 2026):

• Supabase (Supabase Pte. Ltd., with our database hosted on Amazon Web Services servers in Ohio, United States): the European Commission's Standard Contractual Clauses (2021), with the UK Addendum for the United Kingdom, incorporated in Supabase's data processing agreement, which forms part of its terms. Supabase is not certified under the Data Privacy Framework; Amazon Web Services is.
• Cloudflare (Cloudflare, Inc., United States): certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework. Its data processing addendum, which forms part of its terms, adds the Standard Contractual Clauses for any transfer the framework does not cover.
• Stripe (Stripe, LLC, United States): certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework, on which its data transfer addendum relies first, with the Standard Contractual Clauses otherwise. For certain payment information, Stripe determines the purposes of use itself, under its own privacy policy.
• Resend (Plus Five Five, Inc., United States): certified under the EU-U.S. Data Privacy Framework and its UK Extension. Its data processing agreement, which forms part of its terms, also incorporates the Standard Contractual Clauses, with the UK Addendum and the Swiss amendments.
• Zoho (Zoho Corporation, United States data center), which hosts our support mailbox: Zoho is not certified under the Data Privacy Framework (its earlier certification was withdrawn). Zoho offers a data processing agreement incorporating contractual clauses that must be executed separately; until we have executed it, email you send to [email protected] is received in Zoho's United States data center under Zoho's standard terms.
• Google (Google LLC, United States), for Google Analytics, which is loaded for visitors from Europe only after they select Accept all: certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework, with the Standard Contractual Clauses in Google's data processing terms for Google Analytics where a transfer is not covered by the framework. Google states that, for visitors from the European Union, the United Kingdom and Switzerland, Google Analytics uses the IP address on servers in those countries only to estimate location, and discards it before the data is stored.

The European Commission determined on July 10, 2023 that the EU-U.S. Data Privacy Framework provides an adequate level of protection for personal data; the United Kingdom did so for its UK Extension effective October 12, 2023, and Switzerland for the Swiss-U.S. framework effective September 15, 2024. Our market data providers receive no information about you, and no information about you is therefore transferred to them. To request a copy of the applicable clauses, contact us by email.

7. Data Retention

We retain information for the following periods:

• Account information, content you create and activity recorded with your account: for as long as your account exists. When your account is deleted, this information is deleted, except as described in Section 8.
• Searches: 90 days. After that period, we retain only an aggregate daily count of how often each short search term (such as a ticker symbol) was searched, which does not identify you.
• IP addresses in our security and usage logs: 30 days. This period applies to security records, sign-in history, authenticated sessions and the price service's request counters. After 30 days, only the network portion of the address is retained (for example, 203.0.113.0/24), and your sign-in history also retains a one-way code derived from the full address, which our security checks use to recognize a repeat address.
• Rate-limiting counters: after 30 days, these counters no longer contain an IP address, text entered into the sign-in field or an account number.
• Records of visits made without signing in: these records contain no name, email address or IP address. No time limit is currently set for them.
• Error reports and security records: no time limit is set for them at present. IP addresses within them are shortened after 30 days, as described above.
• Google Analytics: Google keeps the records of individual visits in our Google Analytics account for no more than 14 months. The two Google Analytics cookies are retained in your browser for up to two years, unless you select Reject all or clear them.
• Payment history: retained after your account is deleted, for tax and legal recordkeeping purposes (Section 8). Stripe maintains its own records of your payments.
• Record of your acceptance of the Terms of Service: for as long as your account exists and after it is deleted (Section 8). No time limit is currently set for the retained record.

Our service providers also maintain short-term technical logs of the requests they process on our behalf, which include IP addresses.

8. Account Deletion

You may delete your account in Settings. If you have a paid plan, you must first cancel it in Your plan & billing; the account may be deleted once the plan has ended. To request earlier deletion, contact us by email.

Deletion removes your sign-in credentials, your profile, your practice portfolio, trades and orders, watchlists, notes, alerts, saved items, leagues you created, your inbox, the activity recorded with your account, your error reports and problem reports, and our records of the emails we sent you. Your trader name is removed from Rankings immediately. We retain the following:

• a brief deletion record (your trader name, email address, the date, your plan status, Stripe's identifiers and a count of your trades), and your entry on our tester list, if any, so that we can respond to billing inquiries and prevent abuse. You may request removal of the deletion record by email, except for information we must retain for tax and legal purposes;
• your payment history (plan, amounts, dates, Stripe's identifiers, and your acceptance of the billing terms together with the email address used), for tax and legal recordkeeping purposes;
• a record of the version of the Terms of Service you accepted and when: your account number, the version, how and when you accepted it, and whether you confirmed that you were at least 13 years of age. It contains no email address and no name. We retain it after deletion as evidence of the agreement;
• your unsubscribe preference, or the fact that email to your address was returned undeliverable, so that we do not send email to it again;
• security records: your sign-in history (date, country, device type, browser, device name and the shortened network address), and any record of a security incident or of an action we took on your account;
• email you sent to our support mailbox, the copies of problem reports in that mailbox, and screenshots attached to a problem report; and
• an entry in our log of automated emails for each welcome email sent to you, which contains your account number and the date, and no email address.

If we delete an account at your request, its error reports are also retained, without the link to the account. For up to 30 days, rate-limiting counters may still contain your account number or the text you entered to sign in. Deleted information may also remain for a period in our database provider's routine backups.

9. Your Rights and Choices

In Settings, you may change your email address, trader name and password, disable product emails and delete your account. You may request a copy of your information, or request that we correct or delete it, by emailing [email protected] from the email address associated with your account. We will verify that the request is yours and respond within the time required by law. We will not discriminate against you for making a request, and an agent you authorize may make a request on your behalf.

European Union and United Kingdom. We process your information on the following legal bases: performance of our agreement with you (your account, the Services and billing); our legitimate interests in operating, securing, measuring and improving the Services and in informing members about them, to which you may object at any time by contacting us by email or, for emails, by unsubscribing; your consent, for measurement storage in your browser and for Google Analytics, which you may withdraw at any time using Cookie choices; and compliance with our legal obligations. You also have the right to lodge a complaint with your data protection authority.

10. California Privacy Rights

JagSim does not sell your personal information and does not share it for cross-context behavioral advertising, and has not done so in the preceding 12 months. We do not knowingly sell or share the personal information of consumers under 16 years of age. We honor Global Privacy Control: when your browser sends the signal, measurement, including Google Analytics, remains off on our pages unless you select Accept all on the Services (Section 4).

In the preceding 12 months, we collected the following categories of personal information: identifiers (your email address, trader name, account number, IP address and the random identifiers stored in your browser for measurement); account log-in information (your email address and password, used only to authenticate you); commercial information (the plan you purchased); internet or other electronic network activity on the Services (the pages, buttons and searches described in Section 1); and approximate location (your country only). We collect this information from you, from your browser and, for payments, from Stripe. We use it for the purposes described in Section 3, disclose it only to the service providers listed in Section 5 for those purposes, and retain it as described in Section 7.

If you are a California resident, you have the right to know what personal information we collect, use and disclose; to obtain a copy of it; to have it corrected; to have it deleted; and not to receive discriminatory treatment for exercising these rights. To submit a request, email [email protected] from the email address associated with your account, or have an authorized agent submit the request on your behalf. We will confirm receipt of your request within 10 business days and respond to it within 45 days. If we require additional time, up to a further 45 days, we will notify you of the reason within the initial 45-day period.

11. Children

JagSim accounts are available only to individuals 13 years of age or older. The sign-up form asks you to confirm that you are at least 13; it does not ask for your date of birth. We do not knowingly collect personal information from children under 13. If you believe that a child under 13 has created an account, please contact us and we will delete it.

Members under 18. As with every member, your trader name and practice results are public on Rankings and on your trader profile once you trade (Section 2). If you are under 18, you may request that we remove your trader name and results from Rankings and your profile, and any other content you have posted on the Services, by emailing [email protected] from the email address associated with your account. We will remove that content from public view. Removal may not ensure complete removal of all copies, because the content may have been copied or saved by others before it was removed. Purchase of a paid plan by a member under 18 requires the permission of a parent or guardian (Terms of Service, Section 3).

12. Security

All connections to the Services use encrypted HTTPS. Passwords are stored only in hashed form by our authentication provider, access to member records in our database is controlled by row-level security rules, and stored IP addresses are shortened after 30 days as described in Section 7. No method of transmission or storage is completely secure, and we cannot guarantee the absolute security of your information.

13. Changes to This Policy

When we change this Privacy Policy, we will post the revised version on this page and update the date at the top.

14. Contact Us

If you have questions about this Privacy Policy or your information, please email [email protected] or write to us at:

JagInsights LLC
8401 Mayland Dr, Ste A
Richmond, VA 23294
United States