Privacy Policy

COMPASS ONE — last reviewed 20 September 2026 · plain-language draft

Status: this page describes what the software actually does with data today. It is written for operators and invited leaders, not as lawyer-reviewed legal copy. David will review wording later. Treat this as accurate product disclosure first.

Who operates this pilot. COMPASS ONE is a private pilot operated by Szymanski Consulting. It is not an official product of any service-club organization. The operator is responsible for the pilot service.

Who this is for

COMPASS ONE is used by service-club field leaders (Lieutenant Governors / Area Leaders, Governors, trustees, and administrators). Accounts are created by invitation from an administrator. There is no public sign-up. The product is not intended for children.

What is collected

Your account. Email address and the role / geography an administrator assigned (organization, and when applicable district, division, or club). There is no password — sign-in is a 6-digit email code. The sign-in page gives the same answer whether or not an account exists, so it cannot be used to discover who has one.
Your conversations. What you type in chat, and for voice calls the text transcript of what was said. Both are stored in the COMPASS database and are read back so later sessions have continuity (recent chat turns are replayed into the next prompt; saved notes and club context going back about a year are assembled into the briefing). That is saved context, not the model learning from you.
Notes COMPASS records for you. Insights, alerts, action items, projects, and dated commitments saved during a conversation — including member names you mention. Voice can also save an observation mid-call without waiting for the assistant to finish speaking. Saved notes are retrieved later; they do not train the assistant.
Club and organization data. Membership counts, health scores, prescriptions, alerts, and related records imported from your organization’s systems or overlaid live from Heatmap and Lighthouse when those connections are enabled.
Usage accounting (optional). When the operator turns TOKEN_USAGE_TRACKING on: last-active time (throttled), last sign-out, and AI token counts. Voice token totals are reported by the browser and marked as client-reported — they are not a billing-grade meter. Off unless the operator enables it.
Administrator metrics. Even when token tracking is off, administrators can see counts (sessions, messages, knowledge rows, clubs) and recent sign-in emails and times. Transcript content is not shown on the administrator dashboard.

Voice audio is streamed from the browser to the AI provider for speech-to-text and spoken replies. COMPASS does not store the audio file. What COMPASS stores is the resulting text, plus any notes you asked it to keep.

Where it lives

The primary database is Supabase (managed PostgreSQL). The region is chosen by whoever deploys this instance. The reference deployment runs in AWS US West (Oregon). Ask your administrator if you need the region for your instance in writing.

The signed-in session token is stored in the browser (localStorage). A separate tester build can keep a refreshable session for about 30 days; the default product build does not. There is no first-party session cookie on the default path.

Who else processes it

Service	What it receives	Why
Supabase	All stored application data; email address for the 6-digit sign-in code and invitation email	Database, authentication, delivery of the sign-in code and invitation email (templates are configured in the Supabase project, not in this app)
xAI (Grok)	Your messages, live voice audio, and the club context assembled for the conversation. After a voice call is saved, transcript text may be sent again so entities can be extracted into the knowledge graph when the database is configured.	The assistant for text and voice; optional graph extraction
Heatmap	Nothing — COMPASS only reads	Membership snapshots, fetched server-side when `HEATMAP_ENABLED` is on. Secrets never go to the browser.
Lighthouse	Lighthouse’s own integer club IDs (not COMPASS UUIDs, not member names or emails)	Club-health scores, risk, prescriptions, and at-risk resources, fetched server-side when `LIGHTHOUSE_ENABLED` is on
OpenAI-compatible embedder	Text snippets, only if the operator turns embeddings on	Optional vector search. `EMBEDDINGS_ENABLED` defaults off. When off, nothing is sent.
Resend	Your own email address and the text you asked to send to yourself	Only when the operator enables “email it to me”; recipient is locked to the signed-in user. Off by default.
Sentry / GlitchTip	Error reports with transcript, content, and token fields scrubbed	Only when the operator enables error tracking. Off by default. There is no Google Analytics, Mixpanel, or similar product-analytics SDK in the app.

What this is not

COMPASS saves observations you ask it to keep, and it re-reads stored context (transcripts and notes) into later prompts. It does not train or fine-tune the model on your conversations. It does not yet learn from whether a club later lapsed its charter or dissolved. A forecast log can record a risk judgment when that feature is switched on; closing those forecasts still needs a person to label the outcome.

People notes are positive-only

Notes attached to a person are limited to strengths, growth, mentorship, and leadership potential. The software refuses writes that look like complaints, grievances, or character attacks, and it will not inject that kind of text into later briefings or exports. Facts about a club (vacancies, membership decline, process gaps) are allowed — those are club operations, not a personnel file.

Voided notes (soft delete)

When you void an insight or a commitment, COMPASS does not erase the row. It marks the record voided (who, when, why), writes an append-only audit row, and hides the note from briefings, prompts, This week, and exports. There is no in-app screen today for browsing the void audit tables; the data is retained for operators.

Export

Field leaders (LTG, Governor, trustees, and similar jobs) and administrators can download a workbook for their assignment only — CSV or XLSX. It can include clubs, recent insights (about a year, capped, voided rows omitted), projects, future-leader notes, and commitments when present. Conversation transcripts and raw voice/chat messages are not exported. Club presidents without a field job cannot export. There is no user-visible log of who exported when.

How long it is kept

Conversation transcripts and saved knowledge are currently retained indefinitely — there is no automatic deletion job. That is a deliberate setting (TRANSCRIPT_RETENTION_DAYS is unset on purpose), and it is the item on this page most likely to change. Voided rows stay in the database. Graph facts that are superseded are invalidated in time, not hard-deleted. Ask your administrator to delete specific records if you need them removed. There is no self-serve “delete my data” button.

Who can see your conversations

You can read your own conversations. A request for another person’s session, or another organization’s data, is refused. Data is separated by organization in the application and by database row-level security.

Administrators see aggregate usage (counts, last-active times, token totals when tracking is on) and recent sign-in emails. Transcript content is not part of the administrator dashboard. Written policy is that transcript read access is field-leader-only (administrators are not granted a transcript-read API). That access rule is recorded in configuration; a dedicated enforcement job is not yet wired. See “Flagged for legal / ops review” below.

Security

Sign-in is by a 6-digit email code. No passwords are stored, because none are used.
AI provider keys stay on the server. The browser only receives a short-lived voice-session token.
Sign-in and invitation endpoints are rate-limited to limit email abuse.
Database row-level security is enabled on tenant tables as a second line of defence behind the application’s organization scoping.
Optional extra HTTP security headers and broader rate limits exist behind an operator flag.

Flagged for legal / ops review (David)

These are places the code and a typical privacy promise still differ, or where process is required because the product does not do it automatically:

No automatic retention / erasure job. Deletion is an administrator action.
Admin transcript-read policy is documented but not a fully separate API guard.
No click-through acceptance of these pages is recorded at login.
No user-facing audit of who exported a workbook.
Void audit tables exist; there is no admin UI to browse them.
Voice token usage, when tracked, is client-reported.
Invite and sign-in-code email wording lives in the Supabase dashboard, not this repository. Link this Privacy Policy and the welcome page from those templates.
Governing law, subprocessors’ own terms, and data-processing agreements are not set here.

Questions, corrections, deletion

Contact the administrator who invited you, or the operator of this instance (david@szy.com for the reference pilot). They can correct your role, remove your access, and delete records recorded about you or your clubs.