Privacy Policy

This Privacy Policy explains how Hieu Luu ("we," "us," or "Compound"), a sole proprietor based in California, collects and uses information when you use the Compound mobile app ("the App") and visit compoundfit.app ("the Site"). By using the App or the Site, you agree to the practices described here.

Information we collect

When you use the App, we collect the following categories of information, all of which are linked to your account:

• Contact info — your email address and display name, used for sign-in and account communication.
• Phone number (optional) — if you turn on "Find friends by phone," we verify your phone number by SMS and store it with your account so friends who already have your number can find you. You can turn off discoverability at any time in Settings.
• Device contacts (optional, never stored) — with your permission, find-friends checks the phone numbers in your device contacts against Compound accounts. Contact numbers are sent securely, used only in memory to perform the match, and are never stored on our servers.
• Health and fitness data — workouts, sets, weights, body weight, height, calorie and protein logs, and GLP-1 medication status (only if you choose to share it).
• User content — meal photos you take or upload, workout notes, profile bio, and any posts or comments you publish in social features.
• Onboarding answers — goals, training experience, training-day preferences, and similar inputs you provide during setup.
• Identifiers — a user ID assigned by our backend (Supabase) and by our subscription provider (RevenueCat).
• Purchase history — subscription state, trial history, and transaction records, received from Apple via RevenueCat.
• Diagnostics — crash reports, performance traces, and breadcrumbs (recent in-app actions), collected by Sentry to help us fix bugs. Your user ID is attached so we can correlate crashes to specific accounts.
• Usage analytics — in-app events (screens viewed, features used) and masked session replays, collected by PostHog to understand how the App is used; text you type and images are masked in replays. Install-attribution events are collected by AppsFlyer to measure which marketing channel led to an install, subject to your iOS tracking-permission choice.
• Social data — friend connections and avatar image, if you opt into social features.
• Referral and reward data — if you use the referral program: your referral code, referral connections (who referred whom), and your reward and payout history.

We do not collect your precise location, browsing history outside the App, or sensitive identifiers like government IDs. We never store your device contacts.

On the Site, we do not collect your email address. The waitlist form was removed when the App became available on the App Store and Google Play. The personal invite page records an anonymous view event (which invite link was opened, and any campaign parameters present in the URL) so the person who invited you can see how their invites performed. That event does not identify you.

How we use information

• To provide the App's core features — tracking workouts, logging meals, generating daily targets, and showing you your progress.
• To process subscriptions and verify access to paid features.
• To send transactional communications (sign-in codes, account changes).
• To detect and fix bugs through crash and performance monitoring.
• To help you find friends — matching your verified phone number and, with your permission, phone numbers from your device contacts against other Compound accounts.
• To improve and develop new features based on aggregated, non-identifying usage patterns.

We do not use your data to show you ads, and we do not sell or rent your personal information to third parties.

AI-powered meal scanning

When you scan a meal, the photo is sent to a third-party AI provider (currently Google Gemini) to identify the food and estimate calories and protein. The photo and resulting estimates are stored in your account so you can review and edit them. Google does not use this content to train its models when accessed via the paid Gemini API. You can delete any meal entry — and its photo — at any time from inside the App.

Referral rewards and payouts

If you refer a friend and earn a cash reward, cashing that reward out shares limited information with our payout partner, Tremendous, so they can deliver it. When you request a cash-out, we send Tremendous your email address, display name, and the reward amount — nothing else. Tremendous then lets you choose how to receive it (for example, PayPal, Venmo, or a gift card) on their own secure page. We do not share your health, fitness, or activity data for payouts.

Tremendous processes this information as our service provider, under a data processing agreement, and only to deliver your reward. See Tremendous's privacy policy for how they handle it.

If you earn $600 or more in referral rewards in a calendar year (US referrers), Tremendous may collect tax information from you (such as a W-9) and issue a 1099 form, as required by law.

Service providers

We use the following service providers to operate the App. They process your data on our behalf, under contracts that limit how they may use it:

• Supabase — database, authentication, and file storage for meal photos and avatars.
• RevenueCat — subscription management and entitlement validation.
• Apple — payment processing for in-app purchases and subscriptions.
• Google (Gemini API) — AI image analysis for meal scanning.
• Sentry — crash reporting and performance monitoring.
• PostHog — product analytics and masked session replay.
• AppsFlyer — install attribution and marketing measurement.
• Twilio — SMS delivery for phone-number verification.
• Netlify — hosting and form handling for the Site.
• Tremendous — payout processing for referral rewards (delivering your reward via PayPal, Venmo, gift cards, or similar options).

Data retention

We retain your account data for as long as your account is active. If you delete your account, we delete your personal data within 30 days, except where we are required to retain certain records (for example, transaction records for tax and accounting purposes). Crash reports and aggregated, non-identifying analytics may be retained longer.

Your rights

You can:

• Access and correct your data from within the App's profile and onboarding screens.
• Delete individual entries (workouts, meals, posts) at any time.
• Request a copy of your data, or full deletion of your account, by emailing hello@compoundfit.app. We respond within 30 days.

California residents. Under the California Consumer Privacy Act (CCPA/CPRA), you have the right to know what personal information we collect, the right to delete it, the right to correct it, and the right not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioral advertising. To exercise these rights, email us at the address above.

Children's privacy

Compound is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child has provided us personal information, please contact us and we will delete it.

Security

We use industry-standard practices to protect your data — encrypted connections (HTTPS), encrypted storage at rest with our service providers, and access controls on our backend. No system is perfectly secure, but we work to keep your information safe.

Changes

We may update this policy from time to time. When we do, we'll revise the date at the top. Material changes will be communicated through the App or by email.

Contact

Questions or requests? Email hello@compoundfit.app.