Privacy Policy

Important: Special Category Health Data

Compass processes data about your health — including mood, physical symptoms, medications, substances, sleep, mental health crisis moments, and journal entries. Under UK/EU GDPR and the Data Protection Act 2018, this is classified as special category data. Under US state privacy laws such as the CCPA/CPRA, this is similarly classified as sensitive personal information. Processing is based on your explicit consent, given when you create an account. You may withdraw consent at any time by deleting your account and data from Settings. Compass is not a medical device and is not regulated as Software as a Medical Device (SaMD) by the MHRA.

Who We Are

For the purposes of the UK GDPR, the data controller is Kingsley Tracey, trading as Compass Wellbeing Companion, based in the United Kingdom. The controller can be reached at Unit 172900, PO Box 7169, Poole, BH15 9EL, United Kingdom, or Kingz_business@outlook.com. The ICO Registration Number is not currently available. This service is hosted on Render (application) and Neon (database), and uses Clerk for authentication, all acting as data processors under appropriate data processing agreements.

What Data We Collect and Why

• Account data (name, email) managed by Clerk
• Special category health data: moods, symptoms, medications, substances, crisis and self-harm logs, journal entries, sleep, food, water, activity, habits, and gratitude entries
• Technical and usage data limited to standard server logs, retained for no more than 30 days
• Font delivery requests (IP address only) sent to Google Fonts to load our typefaces
• Optional push notification subscriptions and reminder times, relayed via your browser vendor's push service (Google, Mozilla, or Apple)
• Optional location data (rounded coordinates), sent directly from your browser to Open-Meteo for the Dashboard weather widget, only if you grant location permission — never through our servers; Open-Meteo receives your IP address for the duration of the HTTP request
• Companion and virtual coin data; coin purchases are not currently enabled, and future payment processing will be documented before launch

Your safety plan and emergency/trusted contacts are never sent to or stored on our servers — they exist only in your browser's local storage.

How We Protect Your Data

All traffic is encrypted in transit (HTTPS/TLS). Authentication uses secure, HTTP-only session cookies via Clerk. Every database record is scoped to your authenticated account. A sensitive-content PIN, if set, is stored only as a salted one-way hash at rest; verifying it does require sending the PIN itself to our server over encrypted HTTPS each time you unlock protected content, where it is checked against the hash and discarded — it is never written to storage or logs.

Your Rights

Under UK/EU GDPR you have rights to access, rectification, erasure, data portability, restriction, withdrawal of consent, objection, and complaint to a supervisory authority. Under US state privacy laws such as CCPA/CPRA you have rights to know, delete, correct, opt out of sale/sharing (not applicable — we never sell data), limit use of sensitive information, and non-discrimination. Exercise these from Settings or by emailing us.

Who We Share Your Data With

We never sell, rent, or trade your personal data. We share data only with sub-processors bound by data processing agreements: Clerk Inc. (authentication), Render Services, Inc. (application hosting), Neon, Inc. (database hosting), Ko-fi (voluntary donations to support hosting), Stripe, Inc. (not currently active; future payment processing for optional coin purchases will be documented before launch), Google LLC (Google Fonts, web font delivery only), Open-Meteo GmbH (weather data, only if you grant location permission; coordinates go directly from your browser to Open-Meteo), and your browser vendor's push relay service if you enable optional push notifications.

International Users

Compass is available to users in the UK, EU, US, Canada, Australia, and other countries. Residents of Canada and Australia have equivalent access, correction, and complaint rights (via the OPC and OAIC respectively) as described in the full policy. Compass is not a HIPAA-covered entity: it is a self-tracking wellness tool, not a healthcare provider, health plan, or clearinghouse.

Children

Compass is not directed at children under 13. Users aged 13–17 should have parental or guardian agreement before using Compass.

Contact

Questions about this policy or your rights can be sent to Kingz_business@outlook.com or Unit 172900, PO Box 7169, Poole, BH15 9EL, United Kingdom. UK users may also contact the Information Commissioner's Office (ico.org.uk).