Last updated: 22 September 2026 · Operated by CogniStruct AI Company Limited 睿構智能有限公司 (Business Registration No. 80186145), Rm C, 3/F, Belvedere Garden Phase 3, Block 7, 625 Castle Peak Road, Tsuen Wan, Hong Kong.
The short version.
We collect the minimum needed to run the service: your email address, a display name, your language, and the stock tickers you choose to follow. We use it to show you your dashboard and to send the alerts you signed up for.
We do not sell your data, we do not run advertising, and we do not use analytics or tracking cookies. You can delete your account and everything in it at any time, from the link in any email we send you.
Cognistruct (formerly National Invest 24; "we", "us") is a stock research service operated by CogniStruct AI Company Limited. This policy explains what personal data we collect when you use our website and mobile application (together, the "Service"), why we collect it, who else processes it, and what rights you have over it.
If you have any question about this policy or wish to exercise a right described below, contact us at [email protected].
| Data | Why we hold it |
|---|---|
| Email address | Identifies your account, and is the address your alerts and briefings are sent to. |
| Password | Handled entirely by our authentication provider (Supabase) and stored only as a cryptographic hash. We never see or store your password. |
| Display name | The name your emails are signed with. Yours to choose; it need not be your real name. |
| Preferred language | English, Traditional Chinese or Simplified Chinese, applied to the interface, emails and AI-generated analysis. |
| Your watchlist | The stock tickers you follow, whether you have marked each as held, and a short list of tickers you recently removed (so you can restore them). |
We do not use cookies for advertising, analytics or cross-site tracking. We store the following locally on your own device, where it stays:
Clearing your browser data removes all of these. In the mobile application, the equivalent values are held in the app's own storage and are removed when you sign out or uninstall the app.
We do not collect your name (beyond the display name you choose), address, date of birth, government identifiers, or any financial account details. We have no connection to any brokerage and cannot see your actual holdings, balances or trades. The tickers on your watchlist are only what you have typed in, and marking one as "held" records nothing beyond that flag.
We do not take payment through the Service at present, so we hold no card or payment data. Should that change, payment details would be handled by a specialist payment provider and never stored by us, and this policy would be updated before any such feature launched.
| Purpose | Basis |
|---|---|
| Creating and maintaining your account; showing your dashboard | Performance of our contract with you |
| Sending the weekly briefing and price alerts you signed up for | Performance of our contract with you |
| Sending push notifications, if you enable them in the app | Your consent, given through your device's notification permission, and withdrawable at any time in your device settings |
| Rate limiting, abuse prevention, security and diagnostics | Our legitimate interest in keeping the Service available and secure |
| Responding to your support requests | Performance of our contract with you |
We do not use your personal data to train any machine learning model. Our stock-scoring model is calibrated exclusively on historical public market data and contains no user information of any kind.
We use the following service providers. Each processes data only on our instructions and for the purpose shown.
| Provider | Purpose | What it receives |
|---|---|---|
| Supabase | Database and authentication | Your account record and all data in section 2.1 and 2.2 |
| Railway | Application hosting | Data in transit; infrastructure logs including IP address |
| Resend | Email delivery | Your email address and the content of emails sent to you |
| Expo Push Service, Apple (APNs) and Google (FCM) — once push notifications launch | Push notification delivery | A device token and the notification text |
| EODHD | Market prices, news and fundamentals | Ticker symbols only. No personal data. |
| Financial Modeling Prep | Company financial statements | Ticker symbols only. No personal data. |
| Google (Gemini) | Writing the plain-language analysis in briefings and alerts | Ticker symbols, prices, public news articles and a language code only. Your email address, name and account are never sent. |
Our web pages also load two public code libraries from third-party content delivery networks
(cdn.tailwindcss.com and cdn.jsdelivr.net). Loading a file from any web server
necessarily discloses your IP address to it. These networks receive no other information from us, and the
mobile application does not use them.
We do not sell your personal data, and we do not share it with advertisers, data brokers or analytics companies. We would disclose data to a public authority only where legally required, and to a successor entity in the event of a merger or acquisition, in which case this policy would continue to apply until you were notified otherwise.
The providers listed above operate infrastructure outside Hong Kong SAR, including in the United States and the European Union. Where personal data is transferred internationally, we rely on the contractual protections offered by each provider, including standard contractual clauses where applicable.
When you delete your account, your account record, watchlist, briefing archives and score snapshots are deleted, and your authentication record is removed so you can no longer sign in. Backups held by our database provider are overwritten on that provider's own cycle.
Subject to the law of Hong Kong SAR, you have the right to:
To delete your account: use the unsubscribe link at the bottom of any email we send you. This removes your subscriber record and your sign-in credentials in one step, and is immediate. You may also write to [email protected] and we will action it for you.
Traffic to the Service is encrypted in transit. Passwords are hashed by our authentication provider and are never visible to us. Database access is restricted by row-level security policies so that one account cannot read another's data. No system is perfectly secure, and we cannot guarantee absolute security, but we will notify you and the relevant authority of any breach affecting your personal data where we are required to do so.
The Service is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
We may update this policy as the Service changes. The date at the top always reflects the current version. Where a change materially affects how we use your personal data, we will notify you by email before it takes effect.
CogniStruct AI Company Limited 睿構智能有限公司
Rm C, 3/F, Belvedere Garden Phase 3, Block 7, 625 Castle Peak Road, Tsuen Wan, Hong Kong
[email protected]
This policy is published in English. Translations into Traditional and Simplified Chinese are provided for convenience; in the event of any inconsistency, the English version prevails.