Privacy
Draft: pending legal/business review
This page describes what's actually true about this app today. It is not final policy language and has not been reviewed by counsel. Nothing here should be relied on as a binding privacy, legal, or business commitment yet.
Draft version 2026-09-28
Who we are
COMPOUND is a personalized performance-nutrition brand that hasn't launched yet. Nothing is for sale. This site lets you build a formula, save it, and choose whether we contact you at launch. It is operated by [To confirm: legal business name and mailing address].
What we collect, and when
- While you build. Your goal, ingredient, dose and flavor choices stay in your browser until you save. We record which options you pick (for example "creatine, 5 g") as anonymous usage events.
- When you save. Your first and last name, email address and formula, plus any “coming later” ingredients you asked for. If you arrived from an event QR code, which event and campaign tag you came from.
- At events only: a short survey. Whether you'd buy, up to three product types you'd want next, what might stop you, and optionally a price range and up to 200 characters of feedback. You can skip it. Please don't put health information in the feedback box. If you save and verify, your answers are linked to your account.
- Your communication choices. Each choice you make, the exact wording you saw, when and where you made it, and if you later turned it off.
- A mobile number, if you give one (it's optional). We only text you if you separately choose text messages.
- Event timing. A random ID stored on your phone and the time you reached each step, so we can measure how long the event flow takes. It contains no name or contact details.
We don't ask for medical diagnoses, medications, pregnancy status or health history, and there's no password to store: you sign in with a link sent to your email.
How we use it
- To save your formula and show it to you in My Compound.
- To send account emails you need, like sign-in and verification links. These are sent whatever you choose about marketing.
- To send the messages you chose, and only those: a one-time launch reminder, marketing emails, or marketing texts. Each is a separate choice. The launch reminder and marketing emails are pre-selected on the save form and you can untick them; texts are never pre-selected.
- To understand, in aggregate, what people build, what they'd want next, and what gets in the way.
- To keep the site secure and stop automated abuse.
We don't sell personal information, and this site has no advertising pixels. [To confirm: counsel to review "sale"/"share" language for applicable state laws]
Services that process it for us
- Supabase: database, sign-in, and sign-in/verification emails.
- Vercel: hosts the site; keeps standard request logs.
- PostHog: product analytics. It receives named events (such as "formula saved") with non-identifying details. It never receives your name, email, phone number, survey text or anything you type. Session recording, heatmaps and automatic click capture are turned off.
- Shopify: set up for checkout after launch. Checkout is turned off, so nothing is sent to Shopify today.
- Marketing email and text providers: not chosen yet, and no marketing messages are sent today. This page will name them before any are.
How long we keep it
| Data | Kept |
|---|---|
| A save you never verified (name, email, formula, choices) | Deleted when the verification link expires, 14 days after saving |
| A verified save's temporary copy | Deleted 30 days after verification. Your formula stays in your account |
| Event visit timing and survey answers | 24 months, then deleted |
| Your account, formula versions, profile | Until you delete your account |
| Communication choices (what you agreed to, when, the exact wording) | Until you delete your account |
| Unsubscribe / STOP list (a one-way hash of the address, never the address itself) | Kept after deletion so you're never re-added by mistake |
| Abuse-prevention keys (hashed, never your raw IP address) | About 1 day |
[To confirm: retention periods above are proposed; confirm with counsel before the cleanup job is enabled]
Your choices and rights
- Change any communication choice at My Compound → Preferences.
- Every marketing email has an unsubscribe link. Reply STOP to any text to stop texts.
- Delete your account at My Compound. This deletes your account, every saved formula version, your communication choices and your linked survey answers. It can't be undone.
- Saved something but never verified? It deletes itself after 14 days. To remove it sooner, or for any other request, contact [To confirm: privacy contact email].
[To confirm: counsel to add state-specific rights (for example California, Colorado, Virginia) if they apply]
Age
COMPOUND is meant for adults. The site isn't directed to children under 13, and we don't knowingly collect their information. [To confirm: minimum age for saving a formula, for example 18+]
Security
Each account can only read its own data. The code that links an unverified save to your browser is random, and we store only a one-way hash of it. Server keys never reach your browser.
Changes and contact
If this policy changes, the version date above changes with it. Questions: [To confirm: privacy contact email].