Privacy Policy

Compound ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, and your rights in relation to it. By using Compound, you agree to the practices described in this policy.

1. Information We Collect

Information you provide:

• Email address (used for authentication and transactional emails)
• Payment provider API keys (encrypted, used solely for data sync)
• Product names, labels, and website URLs you enter in the dashboard

Information collected automatically:

• Log data including IP address, browser type, and pages visited
• Session tokens stored in cookies to keep you signed in
• Aggregate usage patterns (feature interactions, page views) — never tied to individual revenue figures

Revenue data synced from your providers:

• MRR, ARR, transaction totals, subscriber counts, and related metrics
• This data belongs to you. We process it only to power your dashboard.

2. How We Use Your Information

• To authenticate your account and maintain your session
• To sync revenue data from connected payment providers
• To generate AI briefings and portfolio analytics
• To send transactional emails (magic links, billing receipts)
• To improve the reliability and features of the service
• To comply with legal obligations

We do not sell your data, use your revenue figures for advertising, or share personal information with third parties for their own marketing purposes.

3. Data Sharing

We share data only with:

• Infrastructure providers — cloud hosting, database, and email services necessary to operate Compound (e.g. Neon, Resend). These providers are contractually bound to protect your data.
• AI processing — revenue summaries are sent to an AI model (Anthropic Claude) to generate briefings. No data is retained by the AI provider beyond the immediate request.
• Legal requirements — if required by law, court order, or to protect the safety of our users or the public.

4. Data Retention

We retain your account data for as long as your account is active. When you delete your account, we permanently delete your personal data and stored API keys within 30 days. Anonymized, aggregated analytics data may be retained longer as it cannot be linked back to you.

5. Security

API keys are encrypted at rest using industry-standard encryption. Sessions are managed via secure, HttpOnly cookies. We use HTTPS for all data in transit. We perform regular security reviews, but no system is perfectly secure — if you discover a vulnerability, please disclose it responsibly to [email protected].

6. Cookies

Compound uses cookies strictly necessary for operation — primarily to maintain your authenticated session. We do not use third-party tracking cookies or advertising pixels. You can configure your browser to refuse cookies, but this will prevent you from staying signed in.

7. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Object to or restrict certain processing
• Data portability (receive your data in a machine-readable format)

To exercise any of these rights, email [email protected]. We will respond within 30 days.

8. Children's Privacy

Compound is not directed at children under 16. We do not knowingly collect personal information from anyone under 16. If we become aware that we have done so, we will delete that information promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you by email or in-app notice before material changes take effect. The updated policy will always be available at this URL with the new effective date.

10. Contact

Questions or concerns about your privacy? Contact us at [email protected].