Privacy Policy
Compound holds health and fitness data about you. This page says exactly what we collect, why we collect it, who can see it, and how to get it back or have it deleted.
Last updated 16 September 2026
The short version. We collect what the app needs to coach you and nothing else. We do not sell your data. We do not use your health data for advertising. Your coach can see your training; nobody else can. You can export or delete everything at any time by emailing support@buildstackbecome.com.
1. Who is responsible
Brian Touchstone, sole proprietor trading as Compound, 1107 Isabella Rd, Cantonment, FL 32533, United States, is the controller of the personal data described here. Contact us at support@buildstackbecome.com.
2. What we collect
| Data | Examples | Why |
|---|---|---|
| Account | Email address, name, profile photo, time zone | Sign you in, address you correctly, put your day in your own time zone |
| Training | Workouts, exercises, sets, reps, weights, rest, session notes, habits, tasks, streaks | Run your program, score your day, show progress |
| Health (from Apple Health / Health Connect) | Daily step count, sleep duration, body weight | Score steps and recovery without you retyping them |
| Location, during a tracked run | GPS route stored as a simplified line, plus distance, pace, splits and elevation | Measure the run and show you the route |
| Body metrics | Weight you type in, protein, progress photos you choose to upload | Track change over time |
| Messages | Messages between you and your coach | Deliver coaching |
| Device | Push notification token, platform (iOS, Android, web) | Send reminders and message alerts you asked for |
| Billing | Paddle customer ID, plan, subscription status, renewal date | Know what you have access to |
We never see your card details. Payments run through Paddle, which is the merchant of record. Your card number, expiry and security code go to Paddle and are never sent to or stored on our servers.
3. Health and location data — the specifics
Health and fitness data is sensitive, and some of it is subject to Apple’s and Google’s own rules. So, precisely:
- We read step count, sleep analysis and body weight from Apple Health or Health Connect. Nothing else. We only read — we do not write anything back into your health store.
- We ask before reading anything, and you can revoke it in iOS Settings or Health Connect at any time. The app keeps working; those numbers just go back to manual entry.
- We never use health or fitness data for advertising or marketing, we never sell it, and we never share it with data brokers or advertising networks.
- Location is collected only while you have a run actively tracking, and it is stored as a simplified route line plus summary figures — not as raw second-by-second fixes. There is no background location tracking when you are not running.
- Progress photos are stored privately and are visible only to you and your assigned coach.
4. Why we are allowed to hold it
If you are in the UK, EU or somewhere with similar law, our legal bases are:
- Contract — account, training data, billing status: we cannot provide the service without them.
- Explicit consent — health data from Apple Health or Health Connect, location during a run, and push notifications. You grant it in the app and can withdraw it at any time.
- Legitimate interests — keeping the service secure and working, and preventing abuse.
- Legal obligation — tax and accounting records for transactions.
5. Who can see it
Your coach. If you are on a coaching plan, the coach assigned to you sees your training history, your daily scores, the metrics you log, any progress photos you upload, and your messages. Coaches do not see your billing details.
Nobody else using the app. Compound has no public profiles and no social feed. One client cannot see another client’s data.
Service providers that run parts of the product for us, under contract, and only for that purpose:
| Provider | What it does | Data it touches |
|---|---|---|
| Neon | Database hosting | Everything in section 2, except card details |
| Vercel | App and API hosting | Requests in transit, operational logs |
| Paddle | Payments, as merchant of record | Name, email, billing address, card details, transactions |
| Resend | Transactional email | Email address, the message we send you |
| Amazon Web Services | Photo storage | Progress photos you upload |
| Apple / Google | Push notification delivery | Device token, notification text |
We may also disclose data if the law requires it, or to establish or defend a legal claim. If the business is ever sold or merged, your data may transfer with it — we would tell you first, and this policy would continue to apply until replaced.
We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are used in California law.
6. How long we keep it
- While your account is open — training history is the point of the product, so we keep it so you can see years of progress.
- After you delete your account — we erase your personal data within 30 days, apart from records we must keep by law.
- Transaction records — kept as long as tax law requires, typically seven years. Paddle keeps its own copy under its own policy.
- Operational logs — a short retention window, typically 30 days.
7. Your rights
Whatever country you are in, you can ask us to:
- Give you a copy of your data, in a portable format
- Correct anything wrong
- Delete your account and the data in it
- Stop sending you notifications or marketing
- Restrict or object to a particular use
- Withdraw a consent you gave — health, location or notifications
Email support@buildstackbecome.com and we will respond within 30 days. We will not charge you, and we will not treat you differently for asking.
In the UK or EU you may also complain to your data protection authority. In California you have the rights set out above under the CCPA/CPRA, and you may use an authorised agent.
8. Security
Traffic runs over TLS. Sessions use signed, expiring tokens, and sign-in codes are stored hashed rather than in the clear. Access to production data is limited to the people who operate the service. No system is perfectly secure, but if a breach affects you we will tell you and the relevant regulator as the law requires.
9. International transfers
We operate from the United States, and our providers may process data in the US and elsewhere. Where data leaves the UK or EEA we rely on appropriate safeguards, such as the European Commission’s standard contractual clauses.
10. Children
Compound is not for children under 13, and we do not knowingly collect their data. If you believe a child has given us data, email us and we will delete it.
11. Changes
If we change this policy in a way that materially affects you, we will tell you by email or in the app before it takes effect. The date at the top always shows the current version.
12. Contact
Privacy questions, or to exercise any right above: support@buildstackbecome.com, or write to Brian Touchstone, sole proprietor trading as Compound, 1107 Isabella Rd, Cantonment, FL 32533, United States.