Legal

Privacy Policy

Effective September 15, 2026

Nodestacker is a private network for people who know investors (“nodes”), operated by MatCap (“MatCap,” “we,” “us”). This policy covers nodestacker.com and the Nodestacker node app at nodestacker.com/app (together, the “Service”). It explains what we collect, how we use it — including the Google calendar and email data you can choose to connect — and the choices you have.

1. Information we collect

Information you give us

• Invite requests — the email address you enter to ask for access.
• Account details — your name and email address, and optionally your company, role, location, and phone number.
• Your network — the investors you add: their name, firm, and, where you provide it or choose it from a scan, their email address, along with how strong you say the relationship is.
• Messages — emails you send us.
• Founder investor preview — if you're a founder using the preview at nodestacker.com: your name, company, one-liner, LinkedIn and website, city, the sectors you pick, and your email. We use it to show you investors who fit and to follow up about MatCap.

Information from a Google account you connect

Only if you choose to connect one. Section 2 describes exactly what we access and what we keep.

Information collected automatically

Our servers record standard technical information when you use the Service, such as your IP address, browser type, pages requested, and timestamps. The node app keeps you signed in with a session identifier stored in your browser, and sets a short-lived cookie while you connect a Google account so that only the browser that started the connection can finish it. Our public pages on nodestacker.com use Google Analytics to count visits and see which pages people read; it sets its own cookies in your browser. The node app itself carries no analytics. We do not use advertising cookies anywhere, we do not sell what any of this collects, and none of it is ever joined to the Google account data described in Section 2.

2. Google user data

You can use the Service without connecting Google — add investors by searching, typing them in, or uploading a file. If you choose to connect a Google account to find the investors you already know, this section applies.

What we request access to

• Google Calendar, read-only (calendar.readonly) — to see who attended your calendar events.
• Gmail message metadata (gmail.metadata) — to see the sender, recipients, date, and subject line of emails in threads you took part in. This permission does not allow us to read the body or attachments of any email, and we do not request any permission that would.
• Your email address (userinfo.email) — to know which Google account you connected.

On Google's consent screen you can untick calendar or email, and we will only scan what you allow.

How we use it

We use Google user data for one purpose: to show you a list of the investors you know, so you can choose which ones to add to your network. When you connect, we run a single scan that:

• reads calendar events from roughly the last two years, and the headers of email threads you wrote in over a similar period;
• works out who you meet and correspond with, how often, how recently, and whether they were one-on-one conversations or conversations where both of you wrote;
• identifies which of those people are investors, using their email domain and, for people you have met or exchanged replies with more than once, an automated check described below;
• suggests how strong each relationship is.

We do not use Google user data for any other purpose, including advertising, selling, building profiles for anyone else, or deciding anything about you other than which investors to suggest.

What we store, and what we don't

• We don't store your Google access. The access Google gives us is used for the scan and then revoked. We do not keep a refresh token and have no ongoing access to your calendar or email.
• We don't store event titles, subject lines, or content. Meeting titles and email subject lines are used in memory during the scan to help identify investors, then discarded. Email bodies and attachments are never accessed.
• We don't keep everyone else. People the scan does not identify as investors are discarded when the scan finishes.
• What we do keep, for each investor the scan finds: their email address, name, and firm; counts of meetings, one-on-one meetings, and email threads with replies; the dates you first and last met or corresponded; the suggested relationship strength; and whether you added or skipped them. We also keep the email address of the Google account you connected. Investors you add become part of your network.

Sharing and transfer

Google user data is not shared with founders, other nodes, or anyone outside the providers below.

• Anthropic (AI processing). To identify investors, we send Anthropic's Claude API the email address, display name, meeting and email counts, and a few meeting titles and subject lines for people you have met or exchanged replies with more than once, and the email domains of firms we need to name. Anthropic processes this on our behalf to return a result, and is not permitted to use it to train its models.
• Fly.io (hosting). Our servers and database run on Fly.io.

We do not transfer Google user data to advertising platforms, data brokers, or information resellers, and we do not use it — or allow anyone to use it — to create, train, or improve generalized artificial intelligence or machine learning models.

Human access

No person at MatCap reads your Google user data unless you ask us to (for example, to help with a problem), it is necessary for security purposes such as investigating abuse, it is required to comply with applicable law, or the data has been aggregated and anonymized for internal operations.

Revoking access and deleting Google data

Our access ends when each scan finishes. You can also review and remove Nodestacker's access at any time at myaccount.google.com/permissions. To delete the investors a scan found, and anything else you have given us, email mat@matsherman.com (see Section 5).

3. How we use information

• To review invite requests, create your account, and sign you in.
• To keep your network and match the investors you know with founders we work with who are raising, and to tell you when there is a fit.
• To show you the introductions that ran through you and how they turned out.
• To communicate with you by email about your account and the Service.
• To operate, secure, troubleshoot, and improve the Service, including using AI tools to identify investors and draft notes. Google user data is used only as described in Section 2.
• To comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information, and we do not use it for third-party advertising.

4. How information is shared

Your network is private. We do not show your list of investors to founders, to other nodes, or to the investors on it. We share information only in these limited ways:

• With service providers that run the Service on our behalf and under our instructions: hosting (Fly.io), email delivery (Postmark), AI processing (Anthropic), and Google, for sign-in to the APIs you choose to connect.
• For legal reasons — if required by law, subpoena, or legal process, or to protect the rights, safety, or property of MatCap, our users, or others.
• In a business transfer — if MatCap is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to this policy and, for Google user data, with your consent where the Google API Services User Data Policy requires it.
• With your consent — in any other case where you ask us to or agree to it.

5. Retention and deletion

• We keep your account and network for as long as your account is open.
• Sign-in links expire after 15 minutes and sessions after 28 days of inactivity.
• Google access is revoked when each scan finishes; the scan results described in Section 2 are kept until you delete them or close your account.

You can remove individual investors from your network in the app at any time. To delete your account and everything associated with it — including your network and all scan results — email mat@matsherman.com from the address on your account. We will delete it within 30 days, except for anything we are legally required to keep.

6. Security

We protect information with reasonable administrative, technical, and physical safeguards, including encrypted connections, access controls, single-use sign-in links, and not storing Google access tokens. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

7. Your choices and rights

• Don't connect Google. Every part of the Service works without it.
• Revoke Google access at myaccount.google.com/permissions.
• Access, correction, deletion. Email us to get a copy of your information, correct it, or delete it.
• Email. Contact us to stop non-essential emails.

Depending on where you live, you may have additional rights under local law. We will honor them as the law requires, and we will not discriminate against you for exercising them.

8. Children

The Service is intended for people 18 and older. We do not knowingly collect information from children under 13. If you believe a child has given us information, contact us and we will delete it.

9. Changes and contact

We may update this policy from time to time. When we do, we will change the effective date above, and for material changes we will give notice through the Service or by email. We will not use Google user data in a new way without first asking for your consent.

Questions or requests? Email mat@matsherman.com.