Privacy Policy

Compound (compound.galvyn.xyz and its iPhone app) is a private household app: one family uses it to keep track of its finances, shopping and travel. It is not a public service, it has no ads, and it does not sell anything to anyone. This page explains what it reads, what it keeps, and how to remove it.

What we collect

• Your account: your email address and name, which household you belong to, and your role in it (owner, adult or child).
• Financial accounts you choose to link (through Plaid or SnapTrade): balances, holdings and transactions. Only adults in a household can see these, never children.
• Email you choose to connect (Gmail or Outlook), described below.
• Things you add yourself: receipts you photograph, purchases, clothing sizes, trips, check-ins and notes.

Connected email (Gmail and Outlook)

• Access is read-only (Gmail gmail.readonly, Microsoft Mail.Read). Compound cannot send, delete, label or change any email.
• We only look at messages that are orders, shipping and returns, receipts, travel bookings (flights, hotels, cars, reservations) and loyalty-program statements. You can restrict it further to a single label or folder you choose. For other mail we keep only the sender, subject, date and a short preview (so it isn't re-read on the next sync); the message body is discarded.
• From those messages we keep what is needed to show your purchases and trips: sender, subject, date, a short plain-text copy of the message, and the details extracted from it (items, sizes, order numbers, flight times, confirmation codes).
• Compound's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Email content is used only to provide these features to your household. It is never used for advertising, never sold, and never used to train general-purpose AI models.
• To read those messages, text from them is sent to an AI model (through the Vercel AI Gateway) purely to extract the order or trip details. The providers process it on our behalf and do not keep it for their own use.

How it's stored and who can see it

• Data is stored in our database (Supabase, United States) with access rules enforced by the database itself: you only see your own household's data.
• Email and bank connection tokens are encrypted before they are stored and never leave our servers.
• Inside a household, adults can see the household's money, purchases and trips. A child can see only her own purchases and the trips she is on, and never sees household money.
• We never sell or share your data with third parties, other than the service providers that run the app for us (hosting, database, bank-data aggregators, email delivery and AI processing), which process it only to provide Compound.

Disconnecting and deleting

• Disconnect an email account any time in Settings → Email. This revokes our access and deletes the stored token. You can also choose to delete the mail we imported. You can revoke access from your Google account (myaccount.google.com/permissions) or Microsoft account at any time too.
• To delete your account and all of its data, email yatharth@mlv.io. We'll delete it within 30 days.

Children

A child can use Compound only when a parent in her household adds her. She gets her own sign-in, sees only her own shopping and the trips she is on, and never sees household money. Her parent can remove her account and data at any time.

Contact

Questions or requests: yatharth@mlv.io.