Privacy Policy

Who we are and how to contact us

Compndr is operated by Alain Codino as a sole trader, ABN 97 259 119 147. You can reach us at hello@compndr.io. We do not publish a postal or registered office address.

What this policy covers

This policy covers the Compndr web application at compndr.io and the push notifications and service-worker functionality it uses. It does not cover third-party websites, market-data providers or AI providers, which have their own privacy policies.

Information you provide

• Account details. Your email address and, if you sign in with Google, the basic account identifiers Google returns. Passwords are handled by our authentication provider and are never stored by us in readable form.
• Profile settings. An optional display name, your reporting currency, your timezone and, only if you choose to enter it, your date of birth (used to set projection horizons).
• Portfolio information. The portfolios, transactions, holdings, opening balances and reconciliation adjustments you enter — asset symbols, quantities, dates, prices, fees and notes. This is financial information about you, and you choose what to record.
• Imports. CSV files and screenshots you upload. We store the resulting transactions plus import records (file name, row count, column mapping, status and any error). We also retain the original raw row content from CSV imports in the resulting transaction record so you can review what was imported.
• Wallets you add. The public wallet addresses, labels and network identifiers you enter for read-only wallet tracking. We do not ask for and cannot access private keys, seed phrases or signing authority.
• Goals. Wealth goals, target amounts and target dates you create.
• Questions you ask. The text you type into Ask Compndr, which is processed to produce an answer (see AI processing below).

Information collected automatically

• Product analytics and sessions. We record events such as which screens you open and which features you use, together with a session identifier, an anonymous device identifier, the route, timing and whether the action succeeded or failed. Event details are limited to a fixed internal list of fields — free text is not captured. Analytics events and sessions are retained for approximately 180 days and then deleted by an automated routine.
• Device and technical information. Broad device category, operating system, browser and a coarse viewport size band, plus the app version.
• Coarse location. Where our hosting platform supplies it, we store a country and region code with analytics events. We do not store your IP address and we do not perform IP geolocation ourselves.
• Referral information. A referrer category or domain and any campaign parameters in the link you arrived through.
• Diagnostics. Error codes and operational records (for example failed imports, AI request outcomes, notification delivery results) used to keep the service working.

Records we keep about your account

We also keep account-level records that are not portfolio data:

• Seeds ledger. Your Seeds balance and a ledger of how Seeds were earned, spent, refunded or adjusted.
• Entitlements and account status. Records of your Free or Premium entitlement, including how it was granted and when it expires, plus any account status flags such as suspension.
• Notifications. If you enable push notifications we store the browser push subscription your device generates (endpoint and keys) and a delivery history.
• Admin actions. If an administrator acts on your account (for example a support adjustment or account status change), that action is recorded in an internal audit log.

Why we use your information

We use your information to run Compndr: to authenticate you, to calculate and display your portfolio value, performance, allocation, replay, projections and journey, to generate your Daily Briefing and Ask Compndr answers, to operate Seeds and entitlements, to send notifications you have enabled, to prevent abuse and rate-limit expensive operations, and to understand and improve how the product is used. We do not use your portfolio data for advertising.

AI processing

Compndr uses AI features that send data to an AI provider through the Lovable AI Gateway, which currently routes those requests to a Google Gemini model:

• Ask Compndr. Your question, the recent messages in that conversation, and a factual summary of your portfolio (such as holdings, symbols, quantities, values, cost bases, allocation and profit and loss) are transmitted so the model can answer using your own numbers. Your email address and account identifiers are not included.
• Daily Briefing. A factual summary of your portfolio movements and related market context is transmitted to generate the written briefing.
• Screenshot import. The image you upload is transmitted so the transactions in it can be read.

Ask Compndr conversations are not stored on our servers. We keep only a usage record of each attempt — its status, error code and the Seeds charged or refunded — and your conversation stays in your browser until you leave or reload the page. Generated Daily Briefings are stored against your account so the same day's briefing can be shown again, and expire automatically. The retention of prompts and outputs by the AI provider is governed by the applicable provider's terms; we do not set or guarantee a retention period for them.

Market and blockchain data requests

To price your holdings and show market context, we send asset symbols and date ranges to market-data providers. To refresh read-only wallets, we send your public wallet addresses and network identifiers to public blockchain data services, currently including Blockstream (Bitcoin), Solana public RPC, publicnode and Alchemy (Ethereum/ERC-20 token discovery). We do not send your identity, private keys, balances in a way that identifies you, or any other portfolio data to these providers.

The preview Markets & News page embeds general market news directly from TradingView. Compndr sends only a fixed choice of public news category in the widget settings — not your portfolio identifiers, holdings, names, wallet addresses or balances. Because the widget is loaded from TradingView, TradingView receives the technical information ordinarily sent when your browser requests third-party content, such as your IP address, browser information and the page making the request. TradingView handles that information under its own privacy policy.

Service providers we use

• Hosting, database and authentication. Lovable Cloud (built on Supabase) stores your account, portfolio, analytics and Seeds records and handles sign-in.
• AI. Lovable AI Gateway, routing to Google Gemini models, as described above.
• Market and reference data. CoinGecko, Yahoo Finance, Binance, OKX, CoinPaprika, Marketaux, TradingView and an open exchange-rate service. We send asset symbols and date ranges to these services — never your identity, balances or quantities. The TradingView Markets & News widget uses a fixed public news category and is not personalised to your portfolio.
• Blockchain data.Blockstream, Solana public RPC, publicnode and Alchemy, as described above, for read-only wallet refresh.
• Email. Authentication and account emails are sent from our verified sending domain, notify.compndr.io, using our email infrastructure provider.
• Google Sign-In. Used only if you choose "Continue with Google".

These providers process information so that Compndr can operate. We do not sell your personal information, and we do not disclose it to third parties for their own marketing.

Overseas processing

Our hosting, AI, email and market-data providers operate internationally, so your information may be stored or processed outside Australia, including in the United States and other countries where those providers run infrastructure. We do not control the exact region for every provider.

Cookies, local storage and the service worker

Compndr stores your sign-in session and some preferences in your browser's local storage and sessionStorage, and uses first-party identifiers for analytics sessions. Embedded third-party content, such as TradingView market widgets, may use cookies or similar browser technologies under the provider's own policy. A service worker is installed to support push notifications and the add-to-home-screen prompt. Clearing your browser storage signs you out and removes Compndr's local records.

Advertising

Compndr does not currently display advertising inside the app. Premium accounts would remain ad-free if that changes, and we would not use your portfolio contents, holdings, transactions, goals or Ask Compndr questions to target advertising.

Meta Pixel (ad measurement). To measure whether our Facebook and Instagram ads lead people to Compndr, we use the Meta Pixel, provided by Meta Platforms Ireland Ltd / Meta Platforms, Inc. When enabled, your browser sends Meta: page views (the page address), that a sign-up was started or completed, and that a first portfolio was established, together with standard browser data Meta collects (such as your IP address, device and browser details and Meta cookies). Meta may link this to your Facebook or Instagram account and use it to measure and optimise our ads. We send no portfolio values, holdings, assets, transactions, Seed balances, Ask Compndr text, email addresses or names, and we do not use advanced matching.

In the EU/EEA, the UK and Switzerland (or where we cannot determine your region) the Meta Pixel only loads after you click Accept on our cookie banner. Elsewhere it runs by default. Wherever you are, you can refuse or withdraw at any time using "Cookie settings" in the site footer; your choice, when you made it and the notice version are stored in your browser and apply immediately. You can also manage ad preferences in your Meta account settings.

Security

Your data is held in a managed database with row-level security rules so that a request can only read or change records belonging to the authenticated account. Traffic to Compndr is served over HTTPS. Administrative access is limited to accounts holding an admin role, and administrative actions are logged. No online service can be perfectly secure, and we cannot guarantee absolute security.

Retention and deletion

We keep your information for as long as your account exists and as needed to provide the service. Retention periods vary by data type:

• Portfolio data. Kept while your account exists; removed when you delete your account.
• Analytics events and sessions. Retained for approximately 180 days, then deleted by a scheduled routine.
• Daily Briefings and cached market data. Expire automatically after a short period.
• Operational records.Some records required for security, audit or legal purposes may be retained for longer than your account lifetime in a limited form.

You can edit or remove individual transactions, holdings and goals at any time inside the app. You can permanently delete your account from Settings, which removes your portfolio data, transactions, goals, Seeds and profile information. Some limited records may persist briefly in routine backups or in aggregated, non-identifying statistics. Because some operational records are required for security, fraud prevention and legal compliance, a user identifier may be retained in those records for a limited period after account deletion.

Access, correction, export and complaints

Most of your information is visible and editable directly in the app. You can also ask us for access to the personal information we hold about you, ask us to correct it, or request an export of your data — reach us at hello@compndr.io. We will respond within 30 days. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

Children

Compndr is not intended for children. You should not create an account unless you are at least 18 years old. If we become aware that we hold personal information about a child, we will delete it.

Changes to this policy

If we make material changes we will update this page and the date below. Continuing to use Compndr after a change takes effect means you accept the revised policy.