Privacy Policy

Last updated: August 28, 2026

This Privacy Policy explains what information Compass collects, how we use it, who we share it with, and the choices you have. Compass is built for A-Level and IB students, and we've tried to keep this policy concrete about exactly what we do with your data rather than generic boilerplate.

1. Information we collect

• Account data: your name, email address, and password. Authentication and password storage are handled by our provider, Supabase — we never see or store your raw password.
• Student profile: background details you tell us directly — country of residence, region/city, nationality, current grade, curriculum, expected graduation year, and (optionally) school name/type. This is separate from your assessment answers and is used only to personalise your report.
• Assessment answers: your answers to all 100 assessment questions, including any free-text responses you write, saved to your account as you progress so you can resume later.
• Derived results: your RIASEC scores and Holland code, computed from your answers, and your AI-generated report.
• Payment records: when you pay for a report, Stripe processes your card details directly — we never see or store your full card number. We keep a record of the transaction (amount, currency, status, and Stripe's reference ID) for receipts and accounting.
• Technical data: basic request metadata (such as IP address and browser type) generated automatically as part of running the service securely.
• Page view counts: we keep a count of which pages are visited, so we can see how many people use Compass. Each visit records the page path, the time, and a one-way scrambled code derived from your IP address and browser — that code is regenerated every day, so it can tell two visitors apart within a single day but cannot recognise you tomorrow or link your visits over time. We do not store your IP address, your browser details, or your account ID against these page views, and we cannot work backwards from the code to you. Page addresses are stored without their query strings, so nothing identifying (such as a report link) is kept.

We use no third-party analytics service, no advertising trackers, and no cross-site tracking of any kind. The page view counting described above is our own, runs entirely on our servers, and sets no cookie.

2. How we use your information

• To create, secure, and let you log back into your account, and to verify your email address.
• To save your assessment progress and let you resume it.
• To generate your AI career report (see below) once you request it.
• To process your one-time $3.49 report payment via Stripe.
• To email you when your report is ready, and to resend it if you ask us to (via Resend, our email provider). The report email includes your report content so it's easy for you to read and share — it does not include your raw assessment answers.
• To respond to support requests you send us, including refund requests you file from your profile's Billing tab.
• To count how many people visit each page, so we know which parts of Compass are actually used and where people give up.

3. How your report is generated (AI processing)

When you unlock your report, we send your RIASEC scores, Holland code, selected multiple-choice context answers, your written free-text answers, and your student profile (country, region, nationality, grade, curriculum, and graduation year) to our AI provider, Anthropic, to generate the report content. We do notsend your name or email address as part of that request — the AI only sees your assessment responses and profile details, not who you are. Anthropic processes this data to generate a response and does not become a joint controller of your account data. Before your profile is used this way, we ask you to confirm it's accurate and to consent to this sharing on the profile form itself.

If you build a Future Pathway (the optional university-planning tool available after your report), we also send Anthropic the answers you give in that short intake: the career you chose, where and how you want to study, your realistic budget and how much you depend on financial aid, and any grades or test scores you enter. As with the report, we do notsend your name or email — only these planning answers and the profile details above.

4. Who we share information with

We share information only with the service providers who help us run Compass, each acting on our behalf and only for the purposes below:

• Supabase — authentication and database hosting for your account, assessment answers, and reports.
• Stripe — payment processing for the paid report.
• Resend — delivery of your report and account emails.
• Anthropic — AI inference to generate your report content, as described above.

We do not sell your personal information, and we don't share it with advertisers.

5. Cookies

We use one essential cookie set by Supabase to keep you signed in and to protect pages like your assessment and report from being accessed while logged out. We don't use advertising or third-party tracking cookies, and our page view counting (section 1) sets no cookie at all — it is deliberately built so that it doesn't need one.

6. International data transfers

Our service providers (Supabase, Stripe, Resend, and Anthropic) may process data on servers located outside your home country. Where required, we rely on those providers' contractual safeguards for cross-border data transfers.

7. Data retention

We keep your account, assessment answers, and generated reports for as long as your account is active, so you can revisit your results. We retain payment records for as long as required for accounting and tax purposes. If you ask us to delete your account (see below), we delete your assessment answers, reports, and profile data, except where we're required to keep payment records by law.

Page view records (section 1) are not covered by account deletion, because they are not linked to your account and there is no way for us to find yours — that is the point of the daily-regenerated code. They are aggregate counts of pages, not a record of a person. We keep them for 90 days and delete them automatically after that.

8. Your rights & choices

Depending on where you live, you may have the right to access, correct, export, or delete your personal information. You can download a copy of everything we hold about you — profile, assessment answers, reports, and payment history — at any time from your profile page, and delete your account, student profile, assessment answers, and reports yourself from the same page's "Danger zone" — deletion is immediate and can't be undone. For correction requests, or anything the profile page doesn't cover, email us at the address below.

If a free-text assessment answer appears to describe a self-harm or crisis situation, we pause report generation and show you crisis support resources instead of sending that answer to our AI provider for a report. This is a simple keyword check, not a clinical assessment, and you can choose to continue to your report afterward.

9. Children's privacy

Compass is intended for users aged 16 and over. We don't knowingly collect personal information from children under the minimum age required by applicable law in their location. If you believe a child has created an account without appropriate consent, contact us and we'll remove it.

10. Security

We use industry-standard measures, including encryption in transit and provider-managed encryption at rest, to protect your information. No method of transmission or storage is perfectly secure.

11. Changes to this policy

We may update this Privacy Policy from time to time. We'll post the updated version here with a new "Last updated" date.

12. Contact

Questions about this policy, or want to access, export, or delete your data? Contact us at support@compass.app.

This document is a template reflecting how Compass currently works and has not been reviewed by a lawyer. Replace the placeholder contact email with a real one, and have counsel review this before relying on it in production.