Privacy
StackSignal by Compound 30™ · not affiliated with Substack · Last updated 1 October 2026
Who is responsible
A Roll Media (FZE), Sharjah, United Arab Emirates, is the controller of your personal data for StackSignal. Contact: hello@compound30.com.
What we collect
- Account: your email address, sign-in times, and the consent you gave to join the Compound 30 Substack. If you sign in with Google, Google tells us only your verified email address and an account ID that links your Google sign-in to your StackSignal account. We don't receive your name, photo, contacts or Gmail.
- Billing: your Stripe customer and subscription status. Card details go straight to Stripe and never touch our servers.
- Handles you add: your Substack, LinkedIn and Instagram handles and up to 5 competitor handles per platform.
- Public data: public profile counts, posts, Notes and engagement for those handles.
- Stats you enter: numbers you choose to add from your own Substack stats (revenue, views, open rate, new subscribers, podcast downloads).
- Subscriber CSV (optional): if you upload your Substack subscriber export, your browser reads it on your device. Raw email addresses never reach us. We keep totals, monthly join counts, the display names of your top 20 most engaged readers and of up to 50 recent joiners, each with their paid status and activity stars (or a masked email like “q•••@gmail.com” when there's no name), and a fingerprint of each email scrambled with a key unique to your account so your next upload can count who left. We keep only your two latest uploads, and you can remove them any time in Settings. You decide whether to upload; you're responsible for having your readers' data lawfully.
- Security logs: IP address and browser details for sign-in protection and rate limiting.
How we use it
Only to run StackSignal: sign you in, bill you, show your dashboard and keep the service secure. We don't sell your data or use it for advertising. Your private stats are only ever shown to you. Competitors are shown only as public counts and public posts, never as subscriber lists.
Why we're allowed to
To provide the service you signed up for (contract); to keep it secure and working (our legitimate interests); and, for joining the Compound 30 Substack, your consent, which you can withdraw by unsubscribing.
Who processes it
- Vercel (hosting) · Supabase (database, Mumbai region) · Stripe (payments) · Resend (sign-in emails)
- Google (only if you choose “Continue with Google”, to confirm your email)
- Apify (fetching public LinkedIn and Instagram data)
- Substack (your newsletter subscription)
Where it's stored
Our processors work in several countries, including the United States, India (database, Mumbai) and the European Union. Where data moves between countries, it's covered by the processor's standard data-protection terms.
How long we keep it
For as long as your account is open. Sign-in codes expire after 10 minutes and sessions after 90 days of inactivity. Ask us to close your account and within 30 days we'll remove your email, handles, uploads and private stats, keeping only the billing records the law requires. Handles stop refreshing automatically as soon as an account is closed or its plan ends.
Your rights
You can ask for a copy of your data, a correction, objection or deletion at any time, and complain to your local data-protection authority. StackSignal is for adults only (18+).
Contact
Email hello@compound30.com or reply to any StackSignal email.