Privacy

Last updated 22 September 2026

Who this policy is about

Compasyn is operated by an individual, from India. For the purpose of the Digital Personal Data Protection Act, 2023, that individual is the data fiduciary for the personal data described on this page. support@compasyn.com is the grievance officer and the one contact for every request on this page — access, correction, erasure, or a question about anything here. We acknowledge a request within 24 hours and aim to resolve it within 15 days. If you are not satisfied with how a complaint is handled, you can complain to the Data Protection Board of India.

If you are just looking for software

You can browse and search without an account. When you do, Compasyn records:

• What you searched for, and how many results it produced — so we can tell which requirements the market cannot yet answer.
• Which product cards you actually saw, which products you opened, and when you clicked through to a founder’s own site.
• A session identifier — an opaque, rotating, per-visit value in an httpOnly cookie. It is used to avoid counting the same person twice and to spot automated bursts. It is not an advertising identifier and is not shared.
• A salted hash of your IP address and browser string. Not the address itself.

What is never stored

• Raw IP addresses. Only HMAC-SHA256 hashes with a server-side salt. A test asserts no column exists that could hold one.
• Passwords, tokens, session cookies, secrets and personal data are on an explicit never-log list enforced in the logger itself.
• Your searches are not written to the application log.

Why we are allowed to do this

Searching or browsing and letting Compasyn record what happened is how you provide that information for the purpose it is used for — matching you to software and telling a founder someone found their listing. Creating an account and giving an email address is a separate, deliberate step, and giving it is how you consent to it being used to run that account. You can withdraw that consent at any time by asking us to delete the account (see what you can ask for); withdrawing it does not affect anything already done before you asked.

If you list a product

A founder account stores an email address, a display name, and the product information you choose to give. Compasyn’s own code never handles your password — it is set, stored and verified by Supabase, our authentication provider. Your email is never shown publicly and is not part of any public API response.

Submitting a new product, previewing a draft from a URL, and asking for AI writing help all require a confirmed email address. Reading, browsing or editing a listing you already own does not.

Everything you state about your product is public — that is the point of listing it — and is shown attributed to you and dated. See the submission policy.

Compasyn is not directed at children and we do not knowingly collect an account from anyone under 18. If you believe a child has an account, email support@compasyn.com and we will remove it.

Automated assistance

Two optional tools exist for founders drafting a listing. Both are off unless configured on our end, and neither decides what gets published — a moderator still reviews every submission and every material edit before it goes live.

• Writing help. If you ask for a rewritten tagline or description, the text you are currently editing is sent to an external AI provider (Anthropic) to generate one suggestion. It is shown to you to accept or discard; nothing is applied or submitted automatically, and the assistant does not verify facts — it only rephrases what you already wrote.
• Search matching. The words in a listing are converted into a numeric representation used to match it against search queries. By default this runs on our own servers with nothing sent anywhere; where an external provider (OpenAI) is configured instead, the listing’s own text — never your account information — is sent to it for that purpose only.

Who else sees any of this

Nothing is sold. There are no advertising networks, no third-party analytics scripts and no tracking pixels on Compasyn. The services below process data on our instructions, only for the purpose stated, and do not use it for their own purposes:

• Supabase (authentication and database hosting) — handles signing in, confirming your email and resetting your password directly, and receives your email address and password for that purpose. It also hosts the database everything else in this policy lives in.
• Resend (email delivery) — sends only moderation decisions: that your submission was received, approved or rejected.
• Upstash (rate limiting) — receives the hashed IP or account identifier already described above, as a counter key, to slow down abuse. Never a raw IP, email or password.
• Anthropic and, optionally, OpenAI — see automated assistance above.

Every one of these is based outside India. Sending data to them is permitted under the Digital Personal Data Protection Act, 2023, which allows transfers to any country unless the government has specifically restricted it — none of these have been.

Founders see counts about their own product only: how many people saw it, opened it and clicked through. They never see who you are.

How long it is kept

Honestly: at the moment, indefinitely. Conservative retention periods for event and hashed-IP data are documented internally, but no scheduled job yet deletes anything. We would rather say that than imply a deletion process that does not run. This is a known gap and it is recorded as one.

What you can ask for

Under the Digital Personal Data Protection Act, 2023, you can ask us to:

• Give you a copy of the personal data we hold about your account, and a plain description of what it is used for.
• Correct or complete it, if anything is wrong or out of date.
• Erase it, once you no longer want an account with us and there is no other reason we are allowed to keep it (for example, a live dispute).
• Withdraw consent for anything that relies on it, at any time, as easily as you gave it.
• Nominate someone to exercise these rights on your behalf if you die or become unable to.
• Have a grievance heard — and, if you are not satisfied with how we handle it, taken to the Data Protection Board of India.

Email support@compasyn.com for any of these. Account self-deletion is not built into the product yet, so a deletion request is handled by hand today — we still act on it, it just is not a button in your settings.