Privacy Policy

Compose is a journal; we know how personal it can be.

What you write is yours, always.

Compose is made by Samir Thapa, an independent developer in the United Kingdom. This policy explains how we handle your journal and applies to everyone who uses Compose, wherever they live.

If anything is unclear, email contact@trycompose.app.

1. What We Collect

What you give us

• We keep the entries you write and the prompts you answer.
• Compose creates an account on your device with no name or email attached, so you can start writing without signing up. If you later sign in with Apple, Google, or an email address, we keep your email and the name the sign-in service shares with us.
• During setup, you can give us the name you'd like us to use, your birthday, the goals you choose, and how you heard about Compose.
• We keep your color theme, notification, and app-lock settings, along with the model of phone you write on. Your blocked-app choices are saved as coded Apple tokens that only your own device can turn back into app names.

How Compose organizes your writing

Compose uses each entry to organize your journal. It creates a title and short summary, identifies the emotions, activities, topics, and places you wrote about, and notes the people you mention. It also saves life events, keeps a small profile of facts about your life, writes follow-up questions, and makes your entries searchable.

These details stay in your account, and you can edit or delete any of them. Deleting an entry also removes the details created from it. Insights are calculated on your device from your own entries.

What we measure to improve the app

We record simple usage events such as "onboarding finished", "insights opened", and "entry saved". Firebase Analytics and PostHog tie these events to your account ID and include broad details about your device, app version, and age range. They never include anything you write, the names of people or apps, or your email. You can turn them off at any time with the Share usage analytics toggle in your profile. Crash reports help us fix bugs and aren't linked to your account.

What we never collect

We don't collect your location, contacts, health records, or advertising identifiers. Compose has no cookies or trackers.

2. How an Entry Is Processed

When you save an entry, Compose's servers send its text to our language-model provider, which returns the organizing details described above. The request also includes the prompt you answered, your time zone, and details already saved in your account. It never includes your name, email, account ID, device, or blocked apps. The provider sees that the request came from Compose, not from you.

We only work with providers whose contracts forbid using your entries to train or improve their models. It is a binding term, not just our promise. An entry may be held for up to 55 days solely to check for misuse, then deleted. Our current provider is listed in section 6. We explain this during setup.

3. How We Protect Your Data

Your entries are encrypted while traveling to our servers and while stored on Google Cloud. Only the Compose app can reach those servers, and only your own account can reach your journal. Nobody at Compose reads your entries.

On your phone, iOS protects your journal along with the rest of your data and includes it in Apple's encrypted backups. You can also lock the app with Face ID, Touch ID, or your passcode.

4. Where Your Data Lives

Compose stores and processes data on Google Cloud in the United States, and our analytics provider PostHog is also based there. For people in the UK or Europe, the EU–US Data Privacy Framework and its UK Extension cover these transfers. Google and PostHog are certified under both, and their data processing agreements use standard contractual clauses as a backstop. These protections apply to everyone who uses Compose, wherever they live. We'll update this page if the arrangements change.

5. How Long We Keep It

When you delete your account in the app, we remove your journal and account record right away, and send deletion requests to our analytics providers at the same time. Routine service logs contain nothing you wrote and clear within three months. If you use Compose without signing in, sign in first to delete the account itself.

6. Who We Work With

We use a small number of providers to run Compose. They act on our instructions and aren't allowed to use your data for their own purposes or for advertising.

This website has no cookies or trackers.

7. Your Rights and Controls

You can use the app to export your journal as Markdown or JSON, delete entries or memories, correct your profile, turn off analytics, add an app lock, and delete your account. If you need anything else, email us. We'll answer within 30 days and won't charge you.

If you're in the UK or Europe

You have the right to access, correct, export, and erase your personal data. You can also restrict or object to how it's processed and withdraw your consent. We store and show you your journal because that's the service you've asked us to provide, which the law calls performance of a contract. We organize your entries with a language model based on your consent, since an entry may touch on health, beliefs, or relationships; you can withdraw that consent by deleting entries or your account. We use analytics because we have a legitimate interest in improving Compose, and the toggle lets you opt out. If you're unhappy with how we've handled something, you can complain to the Information Commissioner's Office in the UK or your local data protection authority in the EEA.

If you're in California

You have the right to know what personal information we hold, ask us to delete or correct it, and make those requests without being treated differently. We don't sell or share personal information and never have. We hold identifiers such as your email, account ID, and device identifiers, along with your journal, the emotions and topics Compose draws from it, and data about how you use the app. California law treats emotional detail in your entries as sensitive personal information. We use it only for the features you've asked for, never for advertising or profiling outside Compose, and we answer verified requests within 45 days.

Other US states

Compose isn't a health service and doesn't keep medical records. Washington, Nevada, Connecticut, and some other states give extra protection to information about wellbeing, which can include the moods and emotions Compose notices in your writing. We derive that information only from what you write and use it only to organize your journal. It goes only to the providers named above and is never sold. You can see, export, or delete it at any time, and you can withdraw by deleting entries or your account.

Everywhere else

These controls are available wherever you live, and we'll honor any additional rights given to you by local law. Email us if you want to use them.

8. Children

You must be at least 16 to use Compose. We don't knowingly collect data from anyone younger, and we'll delete it if we discover that we have. If you're a parent or guardian who thinks your child is using Compose, email us.

9. If Something Goes Wrong

If a breach affects your personal data, we'll notify the relevant authority within 72 hours where the law requires it. We'll email you without delay if it puts you at real risk, and we'll act at once to contain it.

10. Changes to This Policy

When this policy changes in a way that affects you, we'll tell you in the app or by email before it takes effect. You'll always find the latest version at trycompose.app/privacy.

11. Contact

You can contact us with questions, concerns, or anything that doesn't seem right:

Samir Thapa makes Compose as an independent developer in the United Kingdom.

This Privacy Policy is effective as of 11 March 2026.