Privacy policy

What you write. Entries (title, body, date), moods, tags, habits and their daily logs, check-ins, goals, time capsules, journal templates and prompt bookmarks. This is the product — storing it is the service.

Files you attach. Photos, voice notes and PDFs, in per-user storage buckets. Access is by short-lived signed URL; the buckets are not publicly listable, and a storage policy pins the first path segment to your user id, so one account cannot read another's files.

Your account. Email address, a username, an optional display name, avatar and short bio, and your timezone. Passwords are handled by Supabase Auth and are never visible to Compline. Timezone is worth calling out because it is a coarse location signal — it is stored because every date in the app, from your streak to which day an entry belongs to, is meaningless without it.

How you use the app. Notification preferences and reminder times, ritual settings, your AI credit balance and its per-action ledger, referral relationships if you arrived on a referral link, and billing invoices.

Operational records. Crash reports (a message, a stack trace and the route you were on), scheduled-job outcomes and alerts. URLs in Content-Security-Policy violation reports are reduced to an origin before storage, deliberately: such a report would otherwise quote a signed URL to one of your photos. Rate limiting records a count against your user id and a time window — not what you did.

Weather and daylight, only if you turn it on. With auto-context enabled, the browser asks for your location, rounds it to one decimal place — about 11 km at the equator, a city rather than a street — and sends the rounded coordinates to Open-Meteo. Those rounded coordinates are stored on the entry alongside temperature, precipitation and daylight hours, so that "am I flatter when it rains?" can be asked like any other question. Declining the browser prompt disables the feature and nothing else. Coordinates are never recorded at finer precision and never used to identify you.

Safety events. If a message trips the crisis-detection layer, a row records that it happened — which surface, the severity, and whether the AI response was withheld — with no copy of the text. It exists so the safety layer can be shown to work without building a log of people's worst moments.

Compline's AI features work by sending relevant entry text to a model provider. This is the least obvious thing in this policy and the most important.

What is sent: the entries or excerpts a feature needs, plus your question. Asking "what did I write about my sister?" sends entries mentioning her. What is not sent: your name, email or account identifiers. The providers receive text, not an identity.

Retention and training. Compline does not grant any provider permission to train on your writing, and does not take part in any programme that would allow it. What each provider does with API inputs is governed by their own terms, which are theirs to state and change — so rather than paraphrase them here, where the paraphrase would silently go stale, they are named above and you should read theirs directly. If any provider's terms change in a way that affects this, this policy is updated and the change announced in-app before it takes effect.

Voice notes are sent to Groq for transcription. Embeddings — the numeric vectors that make search work — are computed by Voyage AI from your entry text and stored alongside your entries.

AI features are optional. Not using them means no entry text leaves Compline's own infrastructure at all.

Card details are entered on Paystack's checkout page and never touch Compline's servers or database. Compline stores what a receipt needs: which plan, the amount, the currency, the timestamp and Paystack's reference. Paystack is an independent controller for the payment itself and has its own privacy policy. What each plan costs is on the pricing page.

Your content is kept until you delete it, or until you delete your account.

Deleting your account removes your profile, every row that references it — they cascade — and your uploaded files. Attachments are purged from storage as part of deletion rather than left behind.

Invoices are retained after account deletion where tax or accounting law requires it. Operational records — crash reports, job runs, alerts — are pruned on a schedule and are not tied to your content.

Questions, requests or complaints go to info@usecompline.com.

Material changes are announced in the app before they take effect. The "last updated" date at the top of this page always reflects the current version. For the mechanisms behind these promises — row-level isolation, encryption, what staff can and cannot see — see privacy & security.