Privacy Policy
Who this policy covers, and who's accountable
This policy covers compoundfork.com ("Compoundfork," "we," "us"), operated by [your legal name or business name]. Under Canadian privacy law (PIPEDA), every organization handling personal information needs someone accountable for it. That's [your name], reachable at [your contact email] for any privacy question, concern, or request.
What we collect
Compoundfork is built around one idea: your numbers should be yours. Here's exactly what we collect and what we don't.
Financial information you type in — assets, debts, income, expenses, and the details of any decisions you model (buying a home, having a child, a career move, and similar). This is the core of what the tool does, and it never leaves your control: it lives in your browser, and — only if you choose to sign in — in your account.
Your email address — only if you choose to sign in to sync across devices. We use this solely to send you a sign-in link and to identify your saved data. We do not use it for marketing, and we do not sell or share it.
What we do not collect:
- Your name, address, phone number, date of birth, or government ID — nothing on Compoundfork asks for these
- Real account numbers, institution names, or anything that identifies a specific bank or financial institution
- Advertising or tracking cookies — Compoundfork carries none as of this writing
Why we collect it
Solely to run the calculations you ask for — your projection, your comparisons, your saved scenarios — and, if you sign in, to make that data available to you again on another device. We don't use your data for any other purpose, and we don't build advertising profiles from it.
How it's stored, and who can access it
If you don't sign in, your data lives only in your browser's local storage on your device. It never reaches our servers at all.
If you sign in, your data is stored with Supabase, a database provider that encrypts data at rest and in transit. Access is restricted at the database level using Row Level Security — meaning the database itself enforces that your data can only be read or changed by your own signed-in account, not just a permission check in our application code.
Being honest about the limits of that: as the operator of this service, it is technically possible to access stored data directly through Supabase's administrative tools, the same way any database administrator can access any database they run. We don't do this except to investigate a reported problem or a legal obligation, and we're stating that plainly rather than implying an absolute technical impossibility that wouldn't be accurate.
Your rights — access, correction, deletion
You can, at any time and without asking us:
- See and export everything — the "Export my data" button downloads a complete copy as a file you keep
- Correct anything — every field in the tool is directly editable by you at any time
- Delete everything — the "Delete all my data" button permanently removes your financial data and scenarios from our systems and this browser. This is irreversible.
One current technical limitation, stated honestly: deleting your data removes all your financial information, but your bare login email may remain in our authentication system's records until manually removed on request. If you want that fully purged too, contact us at [your contact email] and we'll remove it.
Third parties involved in running this site
Running a website necessarily involves some infrastructure providers. Here's who's involved and why:
- Vercel — hosts the website itself. Standard web request data (like your IP address) passes through it, as with any website you visit.
- Supabase — stores your account data if you sign in, as described above.
- Google Fonts — loads the typefaces used on this site. This involves a request to Google's font servers.
None of these providers are given your financial figures for any purpose beyond delivering the service back to you.
If something goes wrong
If a security incident occurs that creates a real risk of significant harm, we will notify Canada's Office of the Privacy Commissioner and any affected individuals as soon as feasible, consistent with PIPEDA's breach notification requirements. We keep a record of any security incident, regardless of severity, for at least two years.
Children
Compoundfork isn't directed at children and isn't designed for use by anyone under 18. If you believe a minor has used the service and provided personal information, contact us and we'll remove it.
Changes to this policy
If this policy changes in a way that matters — what we collect, why, or who it's shared with — the date at the top of this page will update, and where practical, we'll flag the change directly in the product.
Contact
Questions, concerns, or requests about your data: [your contact email]. If you're not satisfied with our response, you have the right to contact the Office of the Privacy Commissioner of Canada.