Privacy Policy

Draft pending counsel review. Entity (Compendium LLC) and registered mailing address (Albuquerque, NM) are set; the only remaining [FILL] is the EU/UK representative (not required at launch scale). See LAUNCH_PLAN.md §7.

1. About this policy

This Privacy Policy explains what Compendium ("we," "us") collects about you, why we collect it, who else sees it, and what choices you have. Compendium is operated by Compendium LLC, a New Mexico limited liability company; we are the "data controller" under GDPR/UK GDPR for your account data.

2. What we collect

Information you give us:

• Account: email address, password (stored as a bcrypt hash — we never see the plaintext), full name (optional).
• Billing: a Stripe customer ID and subscription ID once you start a trial or subscribe. Your card number, expiry, and CVV never reach our servers — Stripe's hosted Checkout collects them. We see the last four digits and card brand on receipts in the Stripe dashboard; that's it.
• Support correspondence: emails you send us, kept until the issue is resolved plus a short tail for follow-up.

Information collected automatically:

• Listening progress: which book, which chapter, playback position, completion flag — used to resume where you left off and to compute "X% of catalog listened" on your account page.
• Aggregate playback events: daily seconds listened per chapter, used to spot popular books for re-narration and to detect broken audio files (zero plays after release = something's wrong).
• Server logs: request ID, IP address, user agent, URL path, response status, error tracebacks. Used for debugging, security, and abuse prevention.
• Auth events: login success/failure, password change, account deletion — recorded in an audit log so we can investigate suspected account takeover.

What we don't collect: no Social Security numbers, no health or financial data beyond the Stripe billing relationship above, no third-party tracking pixels, no advertising-network profiles, no device fingerprinting. We don't sell, rent, or share any data for advertising purposes — there are no ads on Compendium.

3. How we use what we collect

We use your information to (a) provide the Service (stream the right chapter to the right person), (b) bill you and handle payment failures, (c) send transactional email (account verification, password reset, past-due payment notice), (d) keep the Service secure (detect abuse, fix bugs), and (e) comply with legal obligations (tax records, lawful requests). We do not use your data to train AI models or sell to data brokers.

For EU/UK users, the legal bases under GDPR/UK GDPR are: performance of a contract (account + billing + streaming), legitimate interests (security, fraud prevention, improving the Service), legal obligation (tax records, responding to lawful requests), and consent where we explicitly ask for it (e.g., reading your verify-email click as confirmation).

4. Cookies and similar technologies

Compendium uses one cookie: a server-set, HttpOnly, Secure refresh_token cookie that keeps you signed in across page loads. It's functional — required for the Service to work — not a tracking cookie. We don't use Google Analytics, Facebook Pixel, or any third-party analytics cookies. Your browser stores a small amount of state in sessionStorage/localStorage (current chapter, post-checkout redirect target) which never leaves your device.

5. Who else sees your data (processors)

We share data with the following service providers only as needed for them to perform their service. Each has its own privacy commitments; we link them.

• Stripe, Inc. (US) — payment processing. Receives your email, name, and card data (which you give Stripe directly via their hosted Checkout, not via us). stripe.com/privacy
• Stack Auth — identity provider (signup, sign-in, password reset). Receives your email and password during authentication; we receive a JWT and a stable user ID from them. stack-auth.com/privacy
• Resend, Inc. (US) — transactional email delivery (verify, reset, past-due notice). Receives your email address and the email body. resend.com/legal/privacy-policy
• Cloudflare, Inc. (US) — DNS, edge-network proxying, DDoS protection, R2 audio storage, and Turnstile bot-gate. Sees request metadata (IP, headers) and serves audio bytes. cloudflare.com/privacypolicy
• Neon, Inc. (US) — managed Postgres database. Stores every database row described in §2. neon.tech/privacy-policy
• Railway Corp. (US) — application hosting. Sees server logs and runtime metrics. railway.com/legal/privacy
• Functional Software, Inc. (Sentry) (US) — error reporting. Receives stack traces and request metadata when something breaks. We scrub audio tokens from URLs before sending. sentry.io/privacy

Outside these processors, we share data only when (a) you tell us to, (b) a law or court order requires it, or (c) we're transferring the Service to a new owner (in which case we'll tell active subscribers before the transfer happens).

6. How long we keep your data

• Account, subscription, progress, audit log entries: for as long as your account is open, then deleted within 30 days of account deletion (audit-log rows referring to your account survive in a hashed/anonymized form for security forensics).
• Server logs: 30 days.
• Refresh tokens: 30 days from creation, then expired. Revoked tokens are swept opportunistically.
• Tax / billing records: up to 7 years where required by US tax law.
• Cancelled subscriptions: Stripe retains its own records of past transactions under its own retention schedule.

7. International transfers

Compendium operates in the United States. If you use the Service from outside the US, your data is transferred to and processed in the US (and in whatever countries our processors operate). We rely on Standard Contractual Clauses (or the EU-US Data Privacy Framework where the processor participates) to provide GDPR-compliant safeguards for those transfers.

8. Your rights

You can:

• Access the data we hold about you — email [email protected] and we'll send a portable JSON export within 30 days.
• Correct your name or email from your account page.
• Delete your account at any time — also from your account page (uses DELETE /api/auth/me under the hood; cascades user, subscription, refresh tokens, and listening progress; instructs Stripe to delete the customer record best-effort).
• Object to a particular use, or restrict processing — email us as above.
• Withdraw consent where we relied on it; doing so doesn't affect prior processing.
• Lodge a complaint with your local data-protection authority. For EU users, that's your member-state DPA. For UK users, the ICO. We'd love a chance to fix it first, though.

9. US state privacy rights (California and other states)

If you live in California, you have the rights described in §8 plus the right to know what categories of personal information we've collected, used, and disclosed in the past 12 months — which is everything listed in §2 and §5. We do not "sell" or "share" personal information for cross-context behavioral advertising under California law, and we do not process "sensitive personal information" for purposes that would trigger a right to limit. We will not discriminate against you for exercising any privacy right.

If you live in another US state with a comprehensive privacy law (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others as they take effect), you have substantially the same rights — to access, correct, delete, and obtain a portable copy of your personal data, and to opt out of sale or targeted advertising (which we do not do). Exercise any of these by emailing [email protected]; we verify requests against your account before acting. If we decline a request, you may appeal by replying to our decision, and we will respond with our reasoning within the timeframe your state's law requires.

10. Children's privacy

Compendium is not intended for children under 13 (under 16 in the EU/UK). We do not knowingly collect data from anyone in that age range. If you believe a child has created an account, email [email protected] and we'll delete it.

11. How we secure your data

• Passwords are hashed with bcrypt (cost 12).
• All traffic is HTTPS-only with HSTS preload.
• Audio URLs are signed with HMAC-SHA256 tokens, user-bound and time-limited.
• Database access is restricted to the application service; backups are encrypted at rest.
• We run dependency vulnerability scans (pip-audit) and weekly container image scans (Trivy) in CI.
• Sentry receives error traces with audio tokens scrubbed before send.

No system is perfectly secure. If a personal-data breach occurs, we will notify the relevant supervisory authority where required (within 72 hours under GDPR Article 33) and will notify affected users without undue delay where the breach is likely to result in a high risk to their rights, in line with GDPR Article 34 and applicable US state breach-notification laws.

12. Do Not Track

Compendium has no behavioral-advertising tracking to disable. We don't change our behavior based on Do Not Track signals because there's nothing we'd turn off.

13. Changes to this policy

We may update this policy from time to time; the latest version is always at /privacy.html. For material changes affecting how we use your data, we'll email active subscribers at least 30 days before the change applies. Minor edits (typos, processor list additions for new vendors) are reflected with the "last updated" date below.

14. Contact

Data protection inquiries: [email protected]
Mailing address: Compendium LLC, 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110
EU/UK representative: [FILL: appointed GDPR Art. 27 / UK representative, if required — assess with counsel before offering the Service to EU/UK residents; Art. 27 can apply regardless of size and is not purely threshold-based]

Last updated: 2026-06-27. Back to library.