Privacy Policy

Last updated: April 2026

Compound ("we", "our", or "us") is a personal wellness tracking application. We take your privacy seriously. This policy explains what data we collect, how we use it, and your rights over it.

1. What we collect

Account information — your email address and password (hashed, never stored in plain text), and optional profile details such as birth year, biological sex, and timezone.
Wellness check-in responses — your daily answers to questions about skin, energy, mood, digestion, and sleep quality.
Supplement logs — the supplements you track, including dose and timing.
Confound events — optional lifestyle factors you log such as poor sleep, alcohol, or stress.
Product data — supplement products you search for or add to your stack.
Device information — basic technical data required to operate the app (iOS version, device type). We do not collect advertising identifiers.

2. How we use your data

To compute your personalised domain scores (skin, cognitive, recovery, metabolic) based on your check-in responses.
To identify correlations between your supplement intake and your wellness scores over time.
To generate insights that help you understand how your supplements affect your wellbeing.
To authenticate your account and keep your data secure.
To improve the app and fix issues (using anonymised, aggregated analytics only).

We do not use your data for advertising. We do not sell your data to third parties. We do not share your individual data with any third party without your explicit consent.

3. AI and third-party services

Compound uses Anthropic's Claude API to power certain AI features such as supplement label scanning. When you use these features, relevant data (such as a photo of a supplement label) is sent to Anthropic for processing. Anthropic's privacy policy applies to this data. We do not send your personal wellness data or check-in history to Anthropic.

Our infrastructure runs on Google Cloud Platform (GCP), including Cloud Run, Cloud SQL, and Firestore. Your data is stored in the EU (europe-west1 region) and is subject to Google's data processing terms.

4. Data retention

We retain your data for as long as your account is active. If you delete your account, all your personal data — including check-in history, supplement logs, domain scores, and correlations — is permanently deleted within 30 days.

5. Your rights (GDPR)

If you are located in the European Economic Area, you have the following rights:

Access — you can export a full copy of your data at any time from the app (Profile → Privacy & Data → Export my data).
Deletion — you can permanently delete your account and all associated data from the app (Profile → Privacy & Data → Delete my account).
Rectification — you can update your profile information at any time from the app.
Portability — your data export is provided in JSON format.
Objection — you can contact us at any time to object to how we process your data.

6. Security

Your data is encrypted in transit (TLS) and at rest. Passwords are hashed using PBKDF2-SHA256 and never stored in plain text. Your wellness data is stored in a private database not accessible from the public internet. Access is controlled via JWT authentication.

7. Children

Compound is not directed at children under 16. We do not knowingly collect data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

8. Changes to this policy

We may update this policy from time to time. We will notify you of significant changes via the app or by email. The date at the top of this page reflects when the policy was last updated.

9. Contact

If you have any questions about this privacy policy or how we handle your data, please contact us at: privacy@compound.app

Compound is operated by Compound Ltd, rue juge 75015 Paris, France. Registered in France.