Privacy Policy

At Compose, your privacy isn't just a feature — it's a principle. This Privacy Policy explains what data we collect, why we collect it, how we protect it, and what rights you have. We've written it to be clear and honest, because we believe you deserve to know exactly what's happening with your data.

Compose is operated by Samir Thapa, a sole trader based in the United Kingdom. Compose is available worldwide, and this policy applies to all users regardless of location. We comply with applicable data protection laws including the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and the US Children's Online Privacy Protection Act (COPPA).

If you have any questions about this policy, you can reach us at contact@trycompose.app.

1. What Data We Collect

Data You Provide

• Account information: Your name and email address when you sign up (via Apple Sign In, Google Sign In, or email).
• Journal entries: The text you write in your journal, including any thoughts, reflections, or responses to prompts.
• App preferences: Your settings, colour theme, blocklist/allowlist configuration, and schedule preferences.

Data We Collect Automatically

• Product analytics: Firebase Analytics and PostHog collect installation identifiers, device and app information, onboarding progress, feature interactions, coarse preferences, subscription or account state, and success or failure categories. Analytics is enabled by default and can be disabled at any time with Share usage analytics in the App's profile settings.
• Pseudonymous account analytics: Analytics is associated with a pseudonymous account identifier — a random string created when your account is set up. It does not contain your name or email address, and it lets us understand journeys across sessions and devices without identifying you personally.
• Crash reports: Firebase Crashlytics collects technical crash and performance information, such as device state, app version, stack traces, and diagnostics, so we can identify and fix bugs.

Data We Do Not Collect

• We do not collect advertising identifiers.
• We do not use cookies, tracking pixels, or marketing tools.
• We do not collect data from other apps on your device. The Screen Time API is used solely to block and unblock apps you've selected — we do not access or store your usage data from other apps.
• Analytics and crash reports do not include journal text, prompt text, your name or email address, app or website names selected through Screen Time, or detailed Screen Time activity.

Sale of Personal Information

We do not sell your personal information, and we have never sold personal information. We do not share your personal information with third parties for cross-context behavioural advertising. This applies to all users, including California residents under the CCPA/CPRA.

Do Not Track

Some browsers send "Do Not Track" (DNT) signals. Since Compose is a mobile app and does not track users across websites, DNT signals are not applicable. However, for clarity: we do not track you across third-party websites or services.

2. How We Use Your Data

We only use your data to provide and improve Compose. Here's a clear breakdown:

We will never use your data to:

• Train any AI or machine learning models.
• Sell to third parties.
• Serve you advertisements.
• Build a profile of you for marketing purposes.

3. AI-Powered Features

Compose uses AI to provide smart search and intuitive tagging (for example, identifying emotions, people, and topics in your entries). To power these features, your journal entries are processed by a third-party AI service.

Here's how we protect your data during this process:

• Anonymisation: Data is anonymised before being sent to our AI provider for processing.
• Stateless processing: Our AI provider does not retain any of your data after processing is complete. There is no logging, no storage, and no persistence of your content.
• No AI training: Our AI provider does not use your data to train or improve any AI models. This is a contractual requirement of our agreement with them.

If you'd prefer not to use AI-powered features, you can restrict the App's internet access through your device settings, which keeps all your data entirely on your device.

4. How We Store and Protect Your Data

• Encryption at rest: Your journal entries are encrypted when stored on our servers.
• Secure infrastructure: We use Firebase for authentication and cloud storage, which provides enterprise-grade security including encryption in transit (TLS) and at rest.
• Face ID: You can enable Face ID to add a biometric lock to your journal within the App.
• Access controls: Only essential infrastructure has access to stored data. We do not manually access your journal entries.

5. Where Your Data Is Stored

Our primary Firebase infrastructure and PostHog analytics are hosted in the United States. Some service providers may therefore process data in the United States.

If you are in the United Kingdom or European Economic Area (EEA), these international transfers are protected by appropriate safeguards, including Google's data processing terms which incorporate Standard Contractual Clauses (SCCs) approved for international data transfers under both UK GDPR and EU GDPR.

If you are located outside the US, UK, or EEA, by using Compose you acknowledge that your data will be transferred to and processed in the United States, where data protection laws may differ from those in your country.

6. How Long We Keep Your Data

When an in-App account deletion completes, Compose removes your primary account record and journal data and submits deletion requests for account-linked Firebase Analytics and PostHog data. Processor deletion is asynchronous and may take additional time. Google states that individual reports are updated within approximately 72 hours and complete Analytics server deletion occurs during its periodic deletion cycle. Aggregated reports that can no longer identify you may remain.

7. Third-Party Services

We use the following third-party services to operate Compose:

Firebase, PostHog, and our other service providers process data on our instructions to operate and improve Compose. We do not sell this data, disclose it to advertising networks or data brokers, use it for cross-app tracking, or permit these providers to use it for their independent advertising purposes. We do not use third-party cookies, tracking pixels, or attribution tools.

Each third-party provider has their own privacy policies, and we encourage you to review them. We select providers who meet our standards for data protection and security.

8. Your Rights

For All Users

Regardless of where you live, you can always:

• Export your data in JSON format directly from the App, at any time and without restriction. You are never locked in — your words are yours and you are free to take them with you.
• Delete your account and all associated data at any time through the App.
• Disable product analytics at any time using Share usage analytics in the App's profile settings.
• Use Compose offline to opt out of AI processing.

UK and EEA Residents (UK GDPR & EU GDPR)

If you are in the United Kingdom or European Economic Area, you have the following additional rights:

Right of access — You can request a copy of all personal data we hold about you. To make a Subject Access Request, email us at contact@trycompose.app. We will respond within 30 days.

Right to rectification — You can ask us to correct any inaccurate personal data we hold about you.

Right to erasure — You can delete your account and all associated data at any time through the App. You can also email us to request deletion.

Right to data portability — You can export your journal entries in JSON format directly from the App at any time.

Right to restrict processing — You can ask us to restrict how we process your data in certain circumstances.

Right to object — You can object to processing based on legitimate interest. If you object to AI processing of your entries, you can restrict the App's internet access through your device settings.

Right to withdraw consent — Where we process data based on your consent (such as location data), you can withdraw that consent at any time through your device settings.

If you'd like to exercise any of these rights, email us at contact@trycompose.app. We won't charge you a fee for exercising your rights, and we aim to respond to all requests within 30 days.

If you're not satisfied with how we handle your request, you have the right to lodge a complaint with:

• UK residents: The Information Commissioner's Office (ICO) at ico.org.uk
• EEA residents: Your local Data Protection Authority (DPA). A list of EEA DPAs is available at edpb.europa.eu

California Residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act gives you specific rights regarding your personal information:

Right to know — You have the right to request that we disclose what personal information we collect, use, and share about you. The categories of personal information we collect are detailed in Section 1 of this policy.

Right to delete — You can request deletion of your personal information. You can do this directly by deleting your account in the App, or by emailing us at contact@trycompose.app.

Right to correct — You can request that we correct inaccurate personal information we hold about you.

Right to opt out of the sale or sharing of personal information — We do not sell or share your personal information as defined under the CCPA/CPRA. We have never sold personal information and have no plans to do so.

Right to non-discrimination — We will not discriminate against you for exercising any of your CCPA/CPRA rights.

Categories under CCPA: For transparency, the categories of personal information we collect (as defined by the CCPA) include identifiers (such as name, email address, installation identifiers, and pseudonymous account identifiers) and internet or electronic network activity information (product analytics and diagnostics), as described in this policy.

To exercise your rights, email us at contact@trycompose.app. We will verify your identity and respond within 45 days as required by law.

Other Regions

If you live outside the UK, EEA, or California, you may have additional rights under your local data protection laws. We are committed to honouring your rights under applicable law. If you'd like to exercise any data protection rights available to you, please email us at contact@trycompose.app and we will do our best to assist you.

9. Children's Privacy

Compose is available to users aged 13 and over, as indicated on our App Store listing. We do not knowingly collect personal data from children under 13, in compliance with the US Children's Online Privacy Protection Act (COPPA) and equivalent protections under UK and EU law.

We do not collect any additional data from users aged 13–17 beyond what is described in this policy, and all the same protections apply equally. We do not sell the personal information of users under 16.

In some jurisdictions, the minimum age for data processing consent may be higher than 13 (for example, 16 in some EU member states). If you are below the age of digital consent in your country, you should review these terms with your parent or guardian before using Compose.

If you are a parent or guardian and believe your child under 13 is using Compose, please contact us at contact@trycompose.app and we will delete their account and data promptly.

We are committed to complying with the UK Age Appropriate Design Code (Children's Code) and ensuring that our App is designed with the best interests of young users in mind.

10. Data Breaches

In the unlikely event of a data breach that affects your personal data, we will:

• Notify the relevant supervisory authority (the ICO in the UK, or the relevant Data Protection Authority for EU users) within 72 hours of becoming aware of the breach, where required by law.
• Notify affected users by email without undue delay if the breach is likely to result in a high risk to your rights and freedoms.
• Take immediate steps to contain the breach and prevent further unauthorised access.
• Comply with any additional breach notification requirements under applicable law, including US state breach notification laws where relevant.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the App, our practices, or legal requirements. When we make changes, we'll notify you by email before they take effect.

The latest version of this Privacy Policy will always be available at trycompose.app/privacy.

12. Contact Us

If you have any questions or concerns about this Privacy Policy, your data, or how we handle privacy at Compose, please get in touch:

We're a small team and we genuinely care about getting this right. If something doesn't seem right, please tell us.

This Privacy Policy is effective as of 11 March 2026.