Privacy policy

Last updated: October 12, 2026

Thank you for using Compoid. This privacy policy explains what personal data Compoid ("Compoid", "we", "us") collects when you use the Compoid website, platform, APIs, and MCP tools (together, the "Service"), the purposes of that processing, who the data may be shared with, how long we keep it, and the controls we offer you. Please read it before using the Service or submitting any personal information.

By using the Service, you are accepting the practices described in this privacy policy. We may change this policy, but changes will be posted on this page and apply only to activity from the date of publication forward, not retroactively. We encourage you to review this policy from time to time so you understand how any personal information you provide is used.

Note: The privacy practices set forth in this policy are for the Compoid Service only. If you link to other websites, please review the privacy policies posted at those sites.

Personal Data We Collect

We collect the following categories of personal data:

• Identity and account data: the email address you register with (required) and your password, which we store only as a salted hash. Optional profile details (for example, a display name) are collected if you choose to provide them.
• External identity data (optional): if you sign in with a supported third-party provider (currently GitHub or ORCID), that provider shares your account identifier with us (for example, a username or ORCID iD). We never receive or store the provider's password.
• Content data you create: records, communities, collections, and the files, titles, descriptions, and metadata you publish or edit. Your account is attributed as the creator of this content so that provenance (who created it, and when) is visible on each record.
• Technical and access data: session and security cookies (see our cookie policy) and the personal access tokens you create for API or MCP access, which remain valid until you revoke them.
• Payment data (paid memberships only): if you subscribe to a paid plan, the payment transaction is processed by our payment provider, Stripe. Card details are handled by Stripe and are not stored on Compoid servers; we store a Stripe customer/subscription identifier and your plan tier.
• Aggregate analytics data: pseudonymous website usage data collected by our self-hosted analytics (Matomo). It is stored at Compoid, is not linked to your account, and contains no personal information.

Purposes of Use

We use personal data for the following purposes:

• To create and manage your account, authenticate you, and let you access the features of the Service you use.
• To deliver the specific action you request — searching, browsing, downloading, and publishing records and communities — and to show provenance for the content in the repository.
• To process uploaded files: files you publish are analysed by a self-hosted AI model on Compoid's own infrastructure to derive a classification and caption, which makes records searchable. File contents are not sent to external AI providers.
• To send transactional email (registration confirmation, password reset) from support@compoid.com.
• To process payments and manage paid memberships through Stripe (where applicable).
• To protect the Service: detecting and preventing fraud, investigating abuse, and maintaining security.
• To improve the Service using aggregate, pseudonymous analytics that cannot be used to identify you.

Who We Share Information With

Categories of recipients of personal data:

• Stripe — payment processing for paid memberships (only if you subscribe to a paid plan).
• GitHub / ORCID — only as the sign-in provider when you choose to authenticate through them.
• Our email delivery provider — for transactional email (welcome, confirmation, password reset).
• Governmental agencies or companies assisting us — permitted or required by law, to protect against or prevent fraud or unauthorized activity, or to investigate fraud that has already taken place. This information is never provided to these parties for marketing purposes.

We do not sell personal data, and we do not use it for third-party advertising. Please note that content you publish to public communities is publicly visible by design; publishing content is your choice, and restricted communities can be used to keep content non-public.

Data Retention

Timelines for how long we keep personal data:

• Account and profile data: for as long as your account is active. When you delete your account, your account and profile data are deleted.
• Content you create: for as long as it remains in the repository, unless you delete it (records and communities you own) or it is removed by an administrator for policy reasons. Published records remain part of the public repository after account deletion, since they are part of the published collection.
• Personal access tokens: until you revoke them.
• Session cookies: up to 10 days; analytics cookies up to 13 months (see the cookie policy).
• Analytics data: kept in aggregate form; it is pseudonymous and not retained as personal data.
• Transactional email and security logs: retained only as long as needed for support, security, and fraud investigation.

Your Choices and Controls

You can exercise the following controls at any time:

• Review and update your profile information in your account settings.
• Delete records, communities, and collections you own from your account.
• Control visibility: create communities as restricted (or public) and limit who can access them.
• Revoke personal access tokens you have issued for API or MCP access.
• Manage cookie consent (including opting out of analytics cookies) via the cookie consent banner; our cookie choices are stored locally in your browser.
• Delete your account entirely, which also removes your account and profile data.
• Contact us via the support form to request access to, correction of, or deletion of your personal data.

Cookie/Tracking Technology

We use strictly necessary cookies (session management, security) and self-hosted, first-party analytics (Matomo). We set no third-party advertising cookies, and the cookies we set are readable only by Compoid. Details, durations, and how to manage consent are described in our cookie policy.

Commitment to Data Security

Your personal data is protected in transit and at rest: connections are encrypted with TLS, passwords are stored only as salted hashes, access to the platform is controlled by a permission model (public and restricted communities, per-record ownership checks), and only authorized administrators have access to operational data. All emails from this site allow you to opt out of further mailings.

Privacy Contact Information

If you have any questions, concerns, or comments about this privacy policy, or a request about your personal data, please use the support form.