Privacy Policy
What we collect
Account data. Your email address, an optional display name and company name, and a bcrypt hash of your password (never the password itself). If you sign in via Gridsight single sign-on we store the email and name Gridsight provides instead of a password.
Usage telemetry. For authenticated API and dashboard requests we log which endpoint was called, when, the HTTP method and status, the response time, and which account/API key made the call. This powers per-tenant metering, billing, and abuse prevention.
Security logs. Authentication events (signup, login, logout, SSO, API-key creation/revocation) are recorded with the client IP address, so we can investigate brute-force and credential-stuffing attempts. IP addresses are also used transiently for rate limiting.
Billing data. If you buy a paid subscription, payment details go directly to Stripe — we never see or store card numbers, only Stripe's customer/subscription identifiers and your plan status.
What we don't do
No advertising trackers and no third-party analytics scripts run on this site. Your session token is kept in your browser's localStorage — we do not set tracking cookies. We do not sell or rent personal data to anyone.
Where your data lives (processors)
| Processor | Role |
|---|---|
| Fly.io | Application hosting (servers that run the API and dashboard) |
| Neon | Managed Postgres database (accounts, API keys, usage logs) |
| Stripe | Payment processing for paid subscriptions |
| Sentry | Error tracking, when enabled — configured to exclude personal data from reports |
How long we keep it
Account data is kept while your account exists. Usage and security logs are kept as long as needed for billing records and security investigation. Ask us to delete your account and we will remove your personal data, keeping only what billing/legal records require.
Your rights (including GDPR/UK GDPR)
If you are in the UK or EU you have the right to access, correct, export, or delete your personal data, and to object to or restrict processing. Everyone can exercise these rights regardless of location: email christopher@compoundingenergy.com and we will respond within 30 days. You may also complain to your local data-protection authority.
Changes
If what we collect or which processors we use changes, this page changes with it, with a new "last updated" date.