Privacy Policy

This policy explains what Hieu Luu ("we" or "Compound"), a sole proprietor based in California, collects when you use the Compound app ("the App") or visit compoundfit.app ("the Site"), and what we do with it. By using the App or the Site, you agree to it. If you live in Washington State, our Consumer Health Data Privacy Policy also applies.

What we collect

All of this is linked to your account:

• Account details: your email address, your name if Apple or Google provides it, your display name and handle, how you sign in, and settings such as reminders, timezone and language. If you use Sign in with Apple, we keep a token so we can revoke Apple's access when you delete your account.
• Health and fitness data: workouts, body weight, goal weight, height, age, sex, activity level, goals, food logs and saved meals, and, if you use GLP-1 support, your medication, dose, schedule, dose log and side effects. This includes what you tell us during setup, which we use to set your targets and build your plan.
• Photos and posts: meal, progress and workout photos, notes and captions, your bio and avatar, posts, comments and reactions, and feedback you send us.
• Phone number and contacts (optional): if you turn on Find friends by phone, we verify your number by SMS and store it with a keyed hash so friends can find you. You can turn it off in Settings. With your permission, the phone numbers in your contacts are checked against Compound accounts in memory and never stored.
• Purchases: your subscription, trial and transaction history, which we receive from Apple and Google Play through Superwall.
• Usage and device data: the screens you view and features you use, crash reports and performance data, device and app details, your IP address and the approximate location it indicates, and identifiers (our user ID, IDs from our providers, push tokens, and your advertising ID, which on iOS we get only if you allow tracking). Health values are removed from analytics events before they leave your device.
• Session replays: outside the EEA, the UK, and Switzerland, PostHog records replays of how you use the App (screens, taps and scrolling), with all text and images hidden on your device before they are sent. Replays are deleted after 30 days.
• Subscription and cancellation screens: Superwall delivers some onboarding and subscription screens and the Manage subscription screen, and records which ones you saw and for how long. If you start to cancel, it records the reason you pick from a fixed list and whether you took a lower-priced offer. Superwall does not receive your setup answers.

We do not collect your precise location or your browsing outside the App.

How we use it

• To run the App: tracking your workouts and meals, setting your targets, showing your progress, and sending the reminders you allow.
• To sign you in, process subscriptions, and send account emails.
• To help you find friends, if you turn that on.
• To fix bugs and improve features.
• To measure which of our ads lead to installs and subscriptions.

We do not show ads in the App or sell your personal information, and we never share your health data with advertising partners. Meta and AppsFlyer receive which events happened, such as an install or a trial start, and AppsFlyer also receives purchase amounts. On iOS, your advertising ID is shared only if you allow tracking, and your IP address can be passed to Superwall to match a purchase to the ad that brought the install.

Meal scanning and food data

When you scan a meal, the photo and any note you add are sent to Google Gemini to identify the foods and estimate portions. Google does not train its models on this content. Food searches, barcodes and the food names from a scan go to FatSecret for nutrition data, without your photo or account details. You can delete any meal and its photo in the App.

Who we share it with

We use these providers to run the App and the Site. Each receives only what it needs for the purpose listed:

• Supabase: database, sign-in and photo storage.
• Superwall: onboarding, subscription and cancellation screens, purchases and subscription status, on our behalf under a data processing agreement.
• Apple: Sign in with Apple, in-app purchases and push notifications.
• Google: meal-scan AI (Gemini), Google Sign-In, Google Play purchases, app analytics (Firebase), Android push notifications, and Google Tag Manager on the Site.
• PostHog: product analytics and session replays.
• Sentry: crash reports and performance monitoring.
• AppsFlyer: install attribution, invite links and ad measurement.
• Meta: ad measurement, with no health data.
• FatSecret: nutrition data (food names and barcodes only).
• Cloudflare: a cache for barcode lookups (the barcode and your IP address, no account details).
• Expo: push-notification routing.
• Twilio: SMS for phone verification.
• Netlify: hosting the Site and our content-report form.
• Tremendous: referral reward payouts.

Referral rewards

If you cash out a referral reward, we send Tremendous your name, email address and the amount, and nothing else, so it can pay you (see Tremendous's privacy policy). For US payouts of $2,000 or more in a year, Tremendous collects tax details such as a Form W-9 for us, and we file a Form 1099.

Reports of illegal content

If you report content on our reporting page, we use what you send (the content, your reason, your name and email) only to handle the report, to tell the poster our decision without naming you unless the law requires it, and to meet our legal duties, including under the EU Digital Services Act. We keep reports for up to two years after closing them.

The Site

The Site does not collect your email address. It uses Google Tag Manager and AppsFlyer's link script, which may set cookies and read campaign details in the link you opened, so we can tell which links lead to installs. The invite page records an anonymous view so the person who invited you can see how their invites perform. We do not respond to browser Do Not Track signals.

The EEA, the UK, and Switzerland

There, product analytics and ad measurement run only if you agree, and you can change that at any time in the App under Settings, Privacy. Session replays are not recorded there; we use your device's region setting to tell. We use your data to run the App because you asked us to (our contract with you), your health data and analytics only with your consent, and bug fixing and security for our legitimate interests. Your data is processed in the United States.

Our GDPR representatives are Prighter EU Rep GmbH, 9 Clare Street, Dublin 2, D02 HH30, Ireland, and Prighter Ltd, 20 Mortlake High Street, London SW14 8JN, United Kingdom. You can also reach them at app.prighter.com/portal/compoundfit (quote ID-11737882082).

Keeping and deleting your data

We keep your data while your account is open. You can delete your account at any time in the App (Settings, Delete account) or by emailing hello@compoundfit.app. We then immediately delete everything in our own systems, ask PostHog to delete your analytics data and replays, and send deletion requests to our other providers, who complete them on their own schedules.

After deletion we keep an anonymised payout ledger for tax purposes (up to 7 years), crash reports (up to 90 days) and backups (up to 30 days). Apple, Google Play and Tremendous keep their own transaction records.

Deleting your account does not cancel a store subscription. Cancel with Apple or Google first.

Your rights

You can see and correct most of your data in the App's Settings, and delete entries or your whole account at any time. On iOS, you can turn off tracking in Settings, Privacy & Security, Tracking.

Wherever you live, you can email hello@compoundfit.app to get a copy of your data or to ask us to correct, delete or stop using it. We reply within 30 days. If we refuse, you can appeal by replying. California and other US state privacy laws give residents these rights, and we do not sell personal information. In the EEA, the UK, and Switzerland you can also complain to your data protection authority.

Children

Compound is not for children under 13 (under 16 in the EEA, the UK, and Switzerland), and we do not knowingly collect their data. If you think a child has given us data, contact us and we will delete it.

Security

We use encrypted connections, encrypted storage and access controls.

Changes

When we change this policy, we update the date at the top, and we tell you about significant changes in the App or by email.

Contact

Questions or requests? Email hello@compoundfit.app.