Privacy Policy
This covers two separate things: this website, and the Compound Cabinet iOS app. They collect different data, so they are described separately.
Part one: this website
The website exists to describe the app and to collect email addresses from people who want to hear when it launches. That is the entire purpose, and the data collection matches it.
- What is collected
- Your email address, only if you type it into a form and submit it. Each submission also records which of the two signup forms on the page it came from, and when it was made.
- Who processes it
- Supabase, our database and backend provider, stores the address. Only the operator can read the list; the signup form can add an address but cannot read one back. Supabase's privacy policy governs their handling of it and is available at supabase.com/privacy.
- Analytics
- None. There is no Google Analytics, no Plausible, no Fathom, no page-view counter, and no product analytics of any kind on this site.
- Cookies
- None set by us. The site sets no cookies, uses no local storage for tracking, and there is no consent banner because there is nothing to consent to.
- Advertising
- None. No advertising pixels, no conversion tags, no remarketing, no data sold or shared with advertisers or data brokers, ever.
- Third-party requests
- None. Every asset on this site, including the typefaces, is served from our own domain. Your browser makes no request to Google, Fontshare, or any other third party while loading these pages, so no outside company learns your IP address from visiting. The one exception is the signup form: when you submit it, your browser sends the address directly to Supabase, which sees your IP address as part of that request.
- Hosting
- The site is served as static files by our hosting provider, which keeps standard server logs including IP addresses for security and abuse prevention. We do not analyze those logs for behavioral purposes.
Unsubscribing and deletion
Any email we send will include an unsubscribe link. To have your address deleted outright, at any time, email support@compoundcabinet.com and it will be removed from the list. No reason required and nothing to argue about.
Part two: the iOS app
This section describes how the app handles data.
- Your stack data
- Stored on your device. Held locally using Apple's SwiftData: your stack (including any prescription medications you add), dose logs with times, amounts, injection sites and notes, daily check-ins, journal entries with mood ratings, lab and biomarker values, body weight, vial and reconstitution records, and reminder schedules. None of it is transmitted to or stored on our servers. The app makes no database calls at all. If cloud sync is ever added, this policy changes before that feature is switched on.
- Account
- Not offered to new users in this version. The app works fully without one. If you signed in on an earlier version, it was Sign in with Apple, handled by Supabase, our backend provider. For those accounts we hold an account identifier and an email address, which is a private relay address if you chose to hide yours. We never receive your Apple password. Supabase also sees your IP address on sign-in and keeps its own auth logs. Google sign-in is not offered.
- Subscriptions
- Billed by Apple through in-app purchase. Apple is the merchant of record and we never see your card details. Subscription status is verified on your device against Apple's own signed transaction records, and is also processed by RevenueCat, our subscription management provider. RevenueCat receives an account identifier and your subscription and purchase state. It never receives your health information, your stack, your dose history, or anything else you record in the app. Their privacy policy is available at revenuecat.com/privacy.
- Health data
- With your permission the app reads body weight, sleep, step count, resting heart rate, and heart rate variability from Apple Health so you can see them beside what you are tracking. It writes one thing back: a weigh-in you type into the app, and only if you turn that setting on. Apple Health data never leaves your device.
- Tracking
- None. No advertising identifiers, no ad networks, no precise location, and no App Tracking Transparency prompt, because there is nothing to ask permission for.
- What is never collected
- Your physical address, phone number, payment card details, precise location, contacts, photos, camera, or microphone. No analytics or crash-reporting service of any kind. If you signed in with Apple and chose to share your name, it is stored in your device's keychain for the account row in Settings and is not sent to us.
Getting your data out, and deleting it
Settings has a CSV export covering your dose logs, journal, weigh-ins, biomarkers, and stack. It hands the files to the iOS share sheet, so you choose where they go. That is the fastest way to exercise an access or portability request.
If you are signed in, Settings also has Delete Account, which immediately deletes the account record on our side. It deliberately does not touch the data on your device, because that data is yours and we never had a copy. To erase the on-device records, delete the app. Note that we do not currently revoke the Sign in with Apple token, so the app stays listed under your Apple ID settings after deletion until you remove it there.
Your rights
California residents have rights under the CCPA and CPRA, and residents of the EEA, UK, and Switzerland have rights under the GDPR, including access, correction, deletion, and portability. The health information described above is sensitive personal information under the CPRA; it is stored only on your device, and it is still covered by those rights. We do not sell or share personal information as those laws define it. To exercise any of this, email support@compoundcabinet.com.
Children
Compound Cabinet is not directed at children under 13 and we do not knowingly collect their information.
Changes
If this policy changes in a way that affects what is collected, the effective date at the top changes and the change happens before the collection does, not after.
Contact
Kieran Glasser, operator and data controller. support@compoundcabinet.com.