The privacy policy for a thing nobody else reads.

What we hold

Your account details, which are an email address and a password. What you write: your reflection for each stretch, the moments you set down, the insights you mark as worth keeping, and the letters you seal to a future self. That is the list. A name is optional (onboarding asks what this should call you). Compass does not require a date of birth, a phone number, an address or payment details.

Compass does not record audio, does not transcribe anything, and does not send what you write to any AI service. Nothing you write is used to train a model, ours or anyone else’s.

Who can see it

You. That is the whole list. Compass has no group mode, no cohort, no facilitator, no sharing and no invitations, so there is no other account anywhere that could be given sight of your writing. Every row is scoped to your user id and protected by database row-level security. There are no public profiles, no discovery, no feed and nothing to publish.

We do not read your writing. Our staff can reach the database, as anybody who runs a database can, but we do not look at what people write and we will not, other than at your explicit written request about a specific problem. It is never sold, never shared with a third party for their own purposes, and never used for advertising — we have no advertising.

Where it is stored

In a Postgres database hosted by Supabase, in the EU region, which also provides the email-and-password sign-in. Supabase processes this data on our instructions under contract and may not use it for anything else. The site itself is hosted by Vercel.

The printable private document is not stored anywhere. When you ask for it, it is assembled in your browser, on your own machine, from what is already on your screen, and opened in a new tab so you can print it or save it as a PDF. It never touches our servers as a document.

Analytics and error reports

We count visits to these public marketing and legal pages with Vercel Web Analytics, which is anonymous and does not set cookies or follow you between sites. There is no Google Analytics, no Meta pixel, no session recording and no cross-site tracking of any kind.

We also use Sentry for error monitoring, so that when something breaks we find out. An error report contains technical detail — the page, the browser, the stack trace — and not the content of what you were writing.

Email

The only email Compass sends is the email your account needs: confirming your address when you sign up, a sign-in link if you ask for one, and resetting your password when you ask. There is no newsletter, no reminder, no nudge about a stretch you have not finished, and no marketing email. There is nothing to unsubscribe from.

How long we keep it

For as long as you have an account. Nothing is deleted for inactivity — leaving a stretch untouched for a year does not cost you it. If you ask us to delete your account, your writing is removed from our systems within 30 days, usually much sooner. Anything you have already printed or saved as a PDF is yours and stays with you.

Your rights, under UK GDPR

• You can open everything you have written as one printable document at any time, free.
• You can edit or delete anything you have written.
• You can ask us to delete your account. There is no self-serve delete button yet; write to us and we comply within 30 days.
• You can ask us in writing what we hold about you, and we will tell you within 28 days.
• You can complain to the Information Commissioner’s Office if you think we have got this wrong. We would rather you told us first.

If you need us

Write to hello@rarestform.com or to Rarest Form Limited (registered in England and Wales, company number 17433459), 26 Cromwell Road, Ascot, SL5 9DG, United Kingdom. A real person answers.