Privacy Policy

Compound (compound.galvyn.xyz and its iPhone app) is a private household app: one family uses it to keep track of its finances, shopping and travel. It is not a public service, it has no ads, and it does not sell anything to anyone. This page explains what it reads, what it keeps, and how to remove it.

What we collect

• Your account: your email address and name, which household you belong to, and your role in it (owner, adult or child).
• Financial accounts you choose to link (through Plaid or SnapTrade): balances, holdings, transactions, statements, loan details and the account-holder details your bank provides (such as name and address). Only adults in a household can see these, never children.
• Email you choose to connect (Gmail or Outlook), described below.
• Things you add yourself: receipts you photograph, documents you upload, purchases, clothing sizes, trips, check-ins, notes, and questions you ask Compound.
• Location, only if your household turns on Family Locator in the iPhone app: for adults, only the most recent location; for children, up to 7 days of location history, which is deleted automatically. Turning Family Locator off deletes it.
• On our public website:first-party analytics (pages viewed, scrolling and clicks, the referring site, device type, and approximate city/region/country from our host) using a random visitor id cookie. We don't store your raw IP address, and there are no ad trackers.

Connected email (Gmail and Outlook)

• Access is read-only (Gmail gmail.readonly, Microsoft Mail.Read). Compound cannot send, delete, label or change any email.
• We only look at messages that are orders, shipping and returns, receipts, travel bookings (flights, hotels, cars, reservations) and loyalty-program statements. You can restrict it further to a single label or folder you choose. For other mail we keep only the sender, subject, date and a short preview (so it isn't re-read on the next sync); the message body is discarded.
• From those messages we keep what is needed to show your purchases and trips: sender, subject, date, a short plain-text copy of the message, and the details extracted from it (items, sizes, order numbers, flight times, confirmation codes).
• Compound's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Email content is used only to provide these features to your household. It is never used for advertising, never sold, and never used to train general-purpose AI models.
• To read those messages, text from them is sent to an AI model (through the Vercel AI Gateway) purely to extract the order or trip details; the same gateway handles receipts, documents and questions you ask. The providers process it on our behalf. Vercel states that the gateway does not use prompts to train models and lists the providers we use as not training on prompts sent through it.

How it's stored and who can see it

• Data is stored in our database (Supabase, United States) with access rules enforced by the database itself: you only see your own household's data.
• Email and bank connection tokens are encrypted before they are stored and are only ever used on our servers, never sent to your browser or phone.
• Inside a household, adults can see the household's money, purchases and trips. A child can see only her own purchases and the trips she is on, and never sees household money.
• We never sell or share your data with third parties, other than the service providers that run the app for us (hosting, database, bank-data aggregators, email delivery and AI processing), which process it only to provide Compound.

Disconnecting and deleting

• Disconnect an email account any time in Settings → Email. This revokes our access and deletes the stored token. You can also choose to delete the mail we imported. You can revoke access from your Google account (myaccount.google.com/permissions) or Microsoft account at any time too.
• To delete your account and all of its data, email yatharth@mlv.io. We'll delete it within 30 days.

Children

A child can use Compound only when a parent in her household adds her. She gets her own sign-in, sees only her own shopping and the trips she is on, and never sees household money. Her parent can remove her account and data at any time.

Contact

Questions or requests: yatharth@mlv.io.