Privacy Policy

Overview

This Privacy Policy describes how the COMPOUND app ("the app", "we", "us", "our") collects, uses, shares, and protects your information. By using the app, you agree to the practices described below.

COMPOUND is developed and operated by Torben Nils Seidler, an individual developer based in Germany, who is responsible for the processing described here. You can reach him at privacy@usecompound.app.

Your protocol data is yours. We do not sell your personal information, and the app shows no ads. We do share a small set of app events with Meta to measure our own advertising, as described under "Advertising measurement and tracking" below.

Information We Collect

Information you provide

• Profile data: gender, age, weight, height, activity level, and health goals entered during onboarding.
• Protocol data: compounds, dosages, routes of administration, frequency, timing, vials, and cycles you log in the app.
• Side effect and symptom reports: any symptoms or side effects you choose to record.
• Bloodwork data: lab results you optionally enter for tracking purposes, and photos of lab reports you choose to scan so the app can read the values.
• AI chat: the questions you ask in the AI chat.
• Support messages: messages and images you send through the in-app support thread. Each message also carries your app version, iOS version, device model, the names of your protocols, your subscription status, your App Store country, and the date you joined, so the founder can help without asking.
• Account data, if you link Sign in with Apple: the email address Apple shares with us (this may be a private relay address) and your name, if Apple provides it.

Information from Apple Health

If you allow it, the app reads sleep, heart rate variability, resting heart rate, workouts, body weight, and blood glucose from Apple Health. It stores a daily summary of these values in your account, so it can show them next to your protocol and include them in AI insights. The app does not write to Apple Health. Apple Health data is never used for advertising and is never shared with Meta or any other advertising partner.

Information collected automatically

• Device and app information: device model, operating system version, app version, your anonymous account ID, and a push notification token. The advertising identifier is read only if you allow tracking (see below).
• Usage data: screens viewed, features used, onboarding steps, paywall views, and purchase events, recorded with Google Analytics for Firebase and linked to your anonymous account ID. Google Analytics advertising features are turned off.
• Crash and performance data: error logs and performance metrics from Firebase Crashlytics, linked to your anonymous account ID.
• Purchase data: your subscription plan, price, trial status, and renewal status, from Apple through RevenueCat.

How We Use Your Information

• Provide the service: store and display your protocol data, generate AI-powered insights, and personalize your experience.
• Improve the app: analyze usage events and crash reports to find and fix problems and to decide what to build next.
• Send notifications: deliver dose reminders, protocol insights, replies to your support messages, and service updates. You can turn notifications off at any time in iOS Settings.
• Process subscriptions: manage your subscription status and entitlements.
• Measure our advertising: learn which of our ads on Meta and Apple Search Ads lead to installs, trials, and purchases.

AI features & data transmission

AI features ask for your consent before first use. When AI Processing is on, the text or images you submit in the AI chat, the daily brief, weekly correlation insights, and bloodwork scanning, together with a summary of your protocol, dose, symptom, bloodwork, and Apple Health data, are sent to Google's Gemini models through Google Cloud Vertex AI and Firebase AI Logic to generate responses. You can turn AI Processing off at any time in Settings. Do not include information you are not comfortable sharing with a third-party AI provider.

Advertising Measurement and Tracking

COMPOUND shows no ads inside the app. We advertise COMPOUND on Meta's platforms (Facebook and Instagram) and in Apple Search Ads, and we measure which ads work in the following ways.

• Meta SDK: the app includes Meta's Facebook SDK for iOS, limited to app events. Automatic event logging is turned off. The app sends Meta only these events: a paywall was viewed, consent to AI processing was given, a free trial started, a subscription was purchased or a trial converted, with the plan, price, and currency. The free trial event also says whether you told the app in onboarding that you are planning a protocol or already running one. Each event carries an identifier that Meta's SDK creates for this installation of the app, and the basic device information the SDK attaches to every event, such as device model and operating system version.
• Meta Conversions API: when a free trial or purchase has stayed active for a short period, our servers send Meta a server-side event with the plan, price, currency, and the same installation identifier. RevenueCat, our subscription provider, receives that identifier so that subscription events can be matched to the installation, and it may also report subscription events to Meta on our behalf.
• The iOS tracking prompt: iOS asks whether you allow COMPOUND to track your activity across other companies' apps and websites. If you allow it, the app, our servers, and RevenueCat also include your device's advertising identifier (IDFA) with the events above. If you do not allow it, the advertising identifier is never read or sent, but the events above are still sent with the installation identifier. You can change your choice at any time in iOS Settings, under Privacy & Security, then Tracking.
• Apple Search Ads attribution: when the app launches, it requests an attribution token from Apple (the AdServices framework) and passes it to RevenueCat, which asks Apple whether the install came from an Apple Search Ads campaign. This does not use the advertising identifier. RevenueCat also records the device's vendor identifier (IDFV) and IP address for attribution.

We never send your doses, compound names, symptoms, bloodwork values, AI chat content, or Apple Health data to Meta or to any other advertising service.

Third-Party Services

The app uses the following third-party services, each governed by their own privacy policies:

• Firebase (Google): Authentication (anonymous accounts and Sign in with Apple), Cloud Firestore (your data), Cloud Storage (images you attach), Cloud Functions, Cloud Messaging (push notifications), Remote Config (feature settings), App Check (confirms requests come from the genuine app), Google Analytics for Firebase (usage events, advertising features off), and Crashlytics (crash reports). Data is stored on Google Cloud infrastructure.
  Firebase Privacy Policy
• Google Gemini (Google Cloud Vertex AI and Firebase AI Logic): powers the app's AI insights, chat, bloodwork scanning, and protocol analysis. User-entered data, including protocol details, symptoms, chat prompts, bloodwork values, and Apple Health summaries, is transmitted to Google for processing when AI Processing is on. Google's data processing terms apply: Google Cloud DPA.
• RevenueCat: subscription management, in-app purchase processing, and ad attribution, as described above.
  RevenueCat Privacy Policy
• Meta Platforms (Facebook SDK and Conversions API): measurement of our advertising, as described above.
  Meta Privacy Policy
• Apple: App Store purchases, Sign in with Apple, Apple Health, and Apple Search Ads attribution.
  Apple Privacy Policy
• Resend: delivers the email that forwards your support messages and attached images to the founder.
  Resend Privacy Policy

Data Storage and Security

Your data is stored using Firebase Cloud Firestore with encryption at rest and in transit. Access is controlled through Firebase Authentication and Firestore Security Rules that restrict data access to authenticated account owners.

While we implement industry-standard security measures, no method of electronic storage is 100% secure. We cannot guarantee absolute security of your data.

Data Retention

Your data is retained as long as your account is active. Anonymized, aggregated data may be retained for analytical purposes.

When you tap "Delete all data" in Settings, your profile, protocols, dose logs, symptom logs, bloodwork values, cycle records, Apple Health summaries, support messages and their images, and AI chat context are immediately and permanently removed from our active Firestore database and Cloud Storage. Backup snapshots retained by our infrastructure provider for disaster recovery may persist up to 30 days before being overwritten. Events already sent to Meta, Google Analytics, or RevenueCat are kept under those providers' own retention rules.

If you want to exercise your right to deletion without access to the app (e.g., you've uninstalled), contact privacy@usecompound.app with your account email or Firebase user ID and we will process the request within 30 days (GDPR) or 45 days (CCPA).

Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Opt out of marketing communications
• Withdraw consent for data processing

In the app you can also turn AI Processing off in Settings, delete all your data in Settings, and withdraw tracking permission in iOS Settings, under Privacy & Security, then Tracking.

To exercise any of these rights, contact support@usecompound.app.

Children's Privacy

The app is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have collected data from a user under 18, we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. Continued use of the app after changes constitutes acceptance of the revised policy.

Contact

Questions about this Privacy Policy? Contact us at support@usecompound.app.