Privacy Policy

Galvyn, LLC("Galvyn", "we", "us") makes consumer apps for households, listed on our apps page. Today that is Compound (compound.galvyn.xyz and its iPhone app). This policy explains what our apps collect, why, how it is protected, and how to remove it. Galvyn apps have no ads and we do not sell your data.

What we collect

• Your account: your name and email address, and, if you sign in with Google, your profile photo. In Compound, also which household you belong to and your role in it.
• Accounts and services you choose to connect, such as Gmail or Google Calendar. Each app lists what it connects to on the apps page.
• Things you add yourself, such as receipts you photograph, documents you upload, notes, and questions you ask the app.

Each app's own privacy page describes its features in more detail. For Compound, see compound.galvyn.xyz/privacy.

Google user data

Some Galvyn apps let you sign in with Google or connect a Google account. This section explains how we access, use, store, share and delete data received from Google APIs ("Google user data").

What we access, and why

• Google sign-in: your name, email address and profile photo, used only to create your account and sign you in.
• Google Calendar, read-only (calendar.readonly, optional, Compound): events from the calendars you choose, used to show your household's schedule in the app.
• Google Calendar, app-created calendars only (calendar.app.created, optional, Compound): lets the app create a separate calendar and add events to it, such as travel time for a health visit. The app can write only to calendars it created. It cannot change or delete events in your other calendars.
• Gmail, read-only (gmail.readonly, optional, Compound): used to find orders, shipping and returns, receipts, travel bookings and loyalty-program statements, and show them as your household's purchases and trips. The app cannot send, delete, label or change any email. You can limit it to a single label you choose. From those messages it keeps the sender, subject, date, a short plain-text copy and the details extracted from them (such as items, sizes, order numbers, flight times and confirmation codes). For other mail it keeps only the sender, subject, date and a short preview, so the message isn't read again; the message body is discarded.

We use Google user data only to provide the features you turned on, for you and your household. We do not use it for any other purpose.

How it is stored and protected

• Google access and refresh tokens are encrypted (AES-256-GCM) before they are stored, with a key held only in server configuration. They are kept and used only on our servers and are never sent to your browser or phone.
• Data is stored in a database in the United States that is encrypted at rest, with access rules enforced by the database itself, so each household sees only its own data. All traffic uses HTTPS.

How it is shared

• We never sell Google user data and never use it for advertising, including personalized, retargeted or interest-based ads.
• We do not transfer it to anyone except the service providers that run our apps for us (hosting, database and AI processing), only as needed to provide the features you use, or when required by law.
• To pull the order or trip details out of an email, text from it is sent to an AI model, through the Vercel AI Gateway, which processes it on our behalf only to provide that feature.
• Google user data is not used to train generalized AI or machine-learning models, by us or by our AI providers.

Revoking access

• Disconnect a Google account at any time in the app's settings (in Compound, Settings → Email). This revokes our access and deletes the stored token. You can also choose to delete the email we imported.
• You can also revoke access from your Google Account: go to Google Account → Security → Third-party access (myaccount.google.com/connections) and remove the app.

Deleting your data

• In the app, disconnecting a Google account deletes its stored token, and in Compound you can choose to delete the email imported through it.
• To delete your account and all of its data, including Google user data, email support@galvyn.xyz. We delete it within 30 days.

Limited Use

Galvyn's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Children

Galvyn apps are not directed to children. In Compound, a child can use the app only when a parent in their household adds them. The child gets a limited account, and the parent can remove the child's account and data at any time.

Changes

If we change this policy, we will post the new version here with a new effective date.

Contact

Questions or privacy requests: support@galvyn.xyz.