Privacy Policy

Compound is a personal health-tracking service operated by RH Media (Robin Hunuki), based in Australia. It lets you log your own protocol, recovery and bloodwork. Each account’s data is private to that account. Compound is a tracking tool for your own records and does not provide medical advice or diagnosis.

What this app stores

• Daily protocol logs (compounds taken, doses, free-text notes, morning weight).
• Bloodwork schedule and results links you add yourself.
• Recovery and sleep metrics: recovery %, heart rate variability (HRV), resting heart rate (RHR), sleep duration, and deep/REM sleep minutes. These are either entered manually or pulled from WHOOP (see below).

WHOOP data

If you connect WHOOP, the app uses the WHOOP API (OAuth 2.0) with your explicit authorization to read your recovery, sleep, cycle and profile data (scopes: read:recovery, read:sleep, read:cycles, read:profile). This data is used solely to display your own metrics back to you inside this app and is stored in your private database. It is never sold, shared, or used for any other purpose. WHOOP access tokens are stored server-side only and are never exposed to the browser.

You can revoke WHOOP access at any time from your WHOOP account settings, after which the app stops receiving new WHOOP data.

AI insights (optional, opt-in)

You can turn on AI insights from your Account page. It is off by default. When on, a weekly review of your progress is generated by our AI provider, Anthropic. Only your derived metrics are sent — adherence, recovery, sleep, weight and bloodwork marker trends, and your protocol change dates. Your name, email, free-text notes and uploaded files are never sent. Anthropic processes this to produce the review and does not train on it or retain it. Turn it off any time; nothing is sent while it is off.

Storage and security

Data is stored in a Supabase (PostgreSQL) database hosted in the Sydney, Australia region. Each account can only ever access its own data: isolation is enforced at the database level with per-user row-level security. API secrets and access tokens are held server-side and are never sent to the browser.

Product analytics (first-party only)

Compound records a small number of first-party product-usage events in the same Supabase database as everything else, things like when an account is created, when onboarding finishes, when a dose is first logged, and when the app is opened. These events carry a name and a timestamp, occasionally a coarse count. They never carry a health value: no dose amounts, no notes, no weight, no bloodwork numbers. We use this only to see whether the product is working and where people get stuck. There is no PostHog, Google Analytics, Meta Pixel, Segment, or any other third-party analytics or advertising tool in this app, and this usage data is never sold or sent to a third party.

If you use the in-app feedback form, the message you write is stored the same way and read by Robin (RH Media). It is not shared further.

Sharing

None. Your health data (protocol, doses, recovery, bloodwork, notes) is not shared with, sold to, or disclosed to any third party. The app contains no advertising. The only analytics in this app is the first-party product-usage logging described above.

Your control and rights

You can edit or delete any record at any time, and disconnect WHOOP whenever you like. From your Account page you can export all of your data as a file, or permanently delete your account, which erases all of your data. Data is retained until you delete it or close your account.

Contact

Questions about this policy can be directed to robin@rhmedia.io.