Privacy Policy

1. Who we are

Compound is provided by pawprintf ltd, a company registered in England and Wales (company number 16423381), registered office: Office 12595, 182-184 High Street North, East Ham, London E6 2JA, United Kingdom. We are the controller of your personal information under UK and EU data protection law.

Questions about this policy or your data: [email protected].

2. The short version

• We collect what we need to run Compound: your account, your settings, what you've listened to, and your subscription status.
• We never sell your personal information, and we never use it to personalise ads. The free version's audio ads are chosen by us, never based on your interests or who you are.
• We don't track you across other companies' apps or websites.
• Our main database is in the European Union (Ireland).
• You can delete your account and its data at any time, in Settings in the app or by email (see Delete your account). We keep only a minimal record of your agreement to our terms (see section 9).

3. Information we collect

Information you give us

• Account details: your email address, display name and, if you add one, your profile photo. If you sign up with an email address, you also choose a password, which is stored only in encrypted (hashed) form.
• Feedback: if you rate an episode, the rating, any reasons you select and any comment you write.
• Messages to us: anything you send when you contact support.
• Waitlist: if you join the waitlist on our website, your email address.

Information from sign-in providers

• Google: if you continue with Google, Google shares your name, email address and profile picture with us. See section 5.
• Apple: if you continue with Apple, Apple shares your email address (or a private relay address, if you choose to hide yours) and, the first time, your name if you choose to share it. We also keep a token from Apple so that we can disconnect Compound from your Apple ID when you delete your account.

Information from app stores

Where Apple or Google provide it, the app receives an age range for your account when you sign up or sign in. We use it only to confirm that you are 18 or older, and we don't store it.

Information created as you use Compound

• Settings: your daily notification time, time zone, theme, transcript text size and playback speed.
• Listening activity: which episodes you start, how far you get, where you paused, when you finish an episode and the time zone you were in, and which episodes you bookmark.
• Subscription status: whether you have Compound+, your plan, trial and renewal dates, which store you subscribed through, and the store's transaction identifiers. Payments are handled entirely by Apple or Google; we never see your card or bank details.
• Device and technical information: a notification token for your device, device model, operating system, app version, language, IP address, and diagnostic information when the app crashes or an error occurs.
• Usage information: how you use the app (for example, episodes played, screens opened, whether a subscription offer was shown), and your approximate location (country and city) estimated from your IP address. This is linked to a random identifier and, once you sign in, to your account identifier, never to your name or email address. You can turn usage analytics off at any time in the app, under Settings → Privacy.
• Ads: which ads you've heard, whether you heard them to the end and whether you tapped their button.
• Agreement records: when you accept our Terms of Service and this Privacy Policy, the date and time and the versions you accepted.
• Sign-in checks: when you enter your email address to sign in, we check whether an account exists for it and how it signs in. To prevent abuse, we keep short-lived counts of these checks per IP address or device.

On your device

The app stores your settings, cached episodes and, for Compound+ subscribers, downloaded episodes on your device. Signing out removes this data from the device.

Our website

The website does not use cookies or analytics.

4. How we use your information, and our legal bases

• To provide Compound (contract): create and secure your account, sign you in, play episodes and remember your progress across devices, send the daily episode notification at the time you choose, provide Compound+ and downloads, and send account emails such as verification codes and password resets.
• To keep Compound safe and working (legitimate interests): prevent fraud and abuse, fix crashes and errors, and keep our systems secure.
• To improve Compound (legitimate interests): understand which features and episodes are used and enjoyed, using pseudonymous usage data and your feedback.
• To show ads in the free version (legitimate interests): we record which ads you've heard and tapped, so the same ad isn't played too often, new listeners hear none for their first few episodes, and we can count each ad's plays and taps. Ads are never chosen using your interests or any other information about you.
• To keep a record of your agreement (legitimate interests): to show that you accepted our terms and this policy, and to establish or defend legal claims.
• To meet legal obligations (legal obligation): for example, keeping records we are required to keep, or responding to lawful requests.
• Notifications (consent): we send push notifications only if you allow them in your device's settings. You can turn them off there at any time.

We only send marketing emails where the law allows, and you can unsubscribe from them at any time.

5. Google user data

If you choose to continue with Google, we receive your name, email address and profile picture from your Google Account. We use them only to:

• create your Compound account and sign you in;
• show your name and picture in your profile in the app; and
• contact you about your account, for example about security or changes to our terms or this policy.

We do not request access to any other Google data. We do not sell Google user data, use it for advertising, or share it with anyone except the service providers in section 7 that help us run Compound. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can delete this information by deleting your Compound account in Settings (we keep only your email address as part of the record of your agreement to our terms; see section 9). You can remove Compound's access at any time from your Google Account's security settings.

6. What we don't do

• We don't sell or rent personal information.
• We don't share personal information for cross-context behavioural advertising, and we don't use advertising networks.
• We don't track you across other companies' apps or websites, so the app never asks for tracking permission.

7. Who we share information with

We use the following service providers to run Compound. They process personal information on our behalf and only as we instruct.

• Supabase: database, authentication, file storage (profile photos) and server functions (European Union, Ireland).
• Cloudflare: delivery of episode audio and images, and hosting of our website (global network).
• Google Firebase: push notifications and crash reports (United States).
• RevenueCat: subscription management and purchase validation (United States).
• PostHog: product analytics (European Union, Germany).
• Resend: account emails such as verification codes and password resets (United States).

Apple and Google run the app stores, process subscription payments and, if you use them, provide sign-in. Their own privacy policies apply to that processing.

We may also disclose information if required by law, to protect the rights, safety and security of our users or others, or as part of a sale, merger or restructuring of our business, in which case this policy will continue to apply to your information.

8. International transfers

We are based in the United Kingdom, and our main database is in the European Union. Some of our service providers process information in the United States. Where they do, we rely on appropriate safeguards, such as the UK International Data Transfer Agreement or Addendum, the EU Standard Contractual Clauses, or the EU-US Data Privacy Framework and its UK Extension where the provider is certified.

9. How long we keep information

• Your account and everything linked to it (settings, profile photo, listening activity, ads you've heard, bookmarks, feedback and subscription status) are kept while your account exists.
• When you delete your account, this information is deleted from our database straight away, and from our backups within 30 days.
• Record of your agreement: after your account is deleted, we keep your email address and the dates and versions of the Terms of Service and Privacy Policy you accepted for six years. This is based on our legitimate interest in establishing or defending legal claims and showing that we met our legal obligations (six years is the usual time limit for claims in England and Wales). We keep this record separately and don't use it for anything else, including marketing.
• Crash reports are kept for up to 90 days, and usage analytics for up to one year. Both are linked only to pseudonymous identifiers.
• Purchase records are kept by Apple or Google, and by our subscription provider, for as long as needed for accounting, tax and fraud prevention.
• Waitlist email addresses are kept until we no longer need them to tell you about the launch, or until you ask us to remove yours.
• Support messages are kept for up to two years after the conversation ends.

10. Your rights

Under UK and EU data protection law, you have the right to:

• access the personal information we hold about you;
• correct information that is inaccurate;
• delete your information (you can delete your account yourself in Settings);
• restrict or object to how we use your information, including where we rely on legitimate interests;
• receive your information in a portable format; and
• withdraw consent where we rely on it, such as for notifications.

To exercise these rights, email [email protected] from the address linked to your account. We will reply within one month. If you are unhappy with how we handle your information, you can complain to the UK Information Commissioner's Office (ico.org.uk) or the data protection authority where you live.

11. US state privacy rights

If you live in a US state with a consumer privacy law (such as California, Colorado, Connecticut, Virginia or Utah), you may have the right to know what personal information we collect, and to access, correct or delete it. We collect identifiers (such as email address and IP address), commercial information (subscription records), internet or app activity (usage and listening activity) and approximate location. We do not sell personal information or share it for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics about you. To make a request, email [email protected]. We will not treat you differently for exercising your rights.

12. Age requirement

Compound is for adults: you must be 18 or older to create an account. It is not directed at anyone under 18, and we do not knowingly collect personal information from them. If we learn that an account belongs to someone under 18, we will delete it. If you believe this is the case, please contact us.

13. Security

We protect your information with industry-standard measures, including encryption in transit and at rest, and access controls that limit each account to its own data. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

14. Do Not Track

There is no agreed standard for Do Not Track browser signals, so we do not respond to them. We do not track you across other websites in any case.

15. Changes to this policy

We may update this policy from time to time. If we make significant changes, we will tell you in the app or by email before they take effect. The date at the top shows when it was last updated.

16. Contact us

Email [email protected], or write to pawprintf ltd, Office 12595, 182-184 High Street North, East Ham, London E6 2JA, United Kingdom.