Privacy Policy

Last updated: 27 July 2026

This policy explains how Jack Richardson Wilczynski, ABN 21 684 101 139 (“Compound Brain”, “we”, “us”) collects, holds, uses and discloses personal information when you use compoundbrain.app and the Compound Brain iOS and Android apps (the “Service”). We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. What we collect

• Account details: name, email address, password (stored hashed), and optionally your city/town for local time and weather.
• Content you add: journal entries, habits and habit logs, goals and milestones, to-dos, life rules, calendar events, and financial information you record (accounts, transactions, budgets, bills, net-worth assets). Some of this — for example journal entries, nutrition logs and financial details — can be sensitive, so we treat all content with the protections described below.
• Connected services (only if you link them): calendar events from Google Calendar or Microsoft Outlook, and nutrition data (calories logged) from Fitbit. We store the OAuth tokens needed to keep these connections alive; you can disconnect them at any time in Settings.
• Device and technical data: push-notification tokens (if you enable notifications), approximate location (only if you use the location picker or grant location permission), and standard server logs (IP address, browser type, timestamps) used for security and debugging.

2. How we collect and hold it

We collect information directly from you when you type it into the Service, and from connected services you authorise. Your data is stored in our database hosted by Supabase in the [REGION — confirm Supabase project region] region, encrypted at rest and in transit, with row-level security so each account can only read its own records. Our application servers are hosted by Fly.io in Sydney, Australia.

3. Why we collect it

We collect personal information only to: provide the Service (show your data back to you and power features such as the dashboard, calendar and AI assistant); send service emails (account verification, password resets, important notices) via our email provider; send push notifications you have enabled; secure the Service and prevent abuse; and comply with our legal obligations. We do not sell personal information, and we do not use your content for advertising.

4. The AI assistant

When you use the AI assistant, the relevant parts of your data (for example your goals, habits, finances or journal context) are sent to our AI provider, Anthropic (a US company), to generate a response. Under Anthropic’s commercial API terms your data is not used to train Anthropic’s models, and API inputs and outputs are retained by Anthropic for a limited period (currently up to 30 days) for safety and abuse-prevention purposes before deletion. The assistant is optional — no data is sent to Anthropic unless you use it.

5. Google user data — Limited Use

If you connect Google Calendar, we access your calendar events solely to display and manage your calendar inside the Service. Compound Brain’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer Google user data to third parties except to provide or improve the Service as you direct, do not use it for advertising, and do not allow humans to read it except with your consent, for security, or as required by law.

6. Who we disclose it to

We disclose personal information only to the service providers that run the Service: Supabase (database and authentication), Fly.io (hosting, Australia), Anthropic (AI assistant, United States), Resend (transactional email, United States), Google Firebase (push notifications, United States), and — only if you connect them — Google, Microsoft and Fitbit. Some of these providers are located overseas, principally in the United States. We take reasonable steps to ensure overseas recipients handle your information consistently with the APPs. We may also disclose information where required by law.

7. Retention and deletion

We keep your information while your account is active. You can delete individual records at any time, and you can delete your entire account from Settings (or by emailing us) — this permanently removes your content from our database, after which only transient backups persist until they expire. If you delete the mobile app without deleting your account, your data remains in your account.

8. Access, correction and complaints

You can access and correct almost everything we hold about you directly in the Service. For anything else, email compoundbrain@proton.me and we will respond within 30 days. If you believe we have breached the APPs, contact us first; if you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au). If a data breach is likely to cause serious harm, we will notify affected users and the OAIC in accordance with the Notifiable Data Breaches scheme.

9. Changes

We may update this policy from time to time. Material changes will be notified by email or in-app before they take effect, and the latest version will always be available at this page.