Security

• What Context Window stores, who else processes it, and how to report a vulnerability.

Reporting a vulnerability

• Email hello@thecompound.tech. Include the URL, what you did, and what you saw. There is no bounty and no NDA to sign. We will confirm receipt, and we will tell you what we changed.

• The same address, with a machine-readable expiry, is published at /.well-known/security.txt under RFC 9116.

Accounts

• Context Window has no user accounts. There is nothing to sign in to, no password to reset and no session to steal, and a build gate fails the deploy if an authentication route ever appears in this repository while this page still says otherwise.

What is stored

• Anonymous usage analytics: page views, the page you arrived from, your browser and operating system, an approximate location derived from your IP address, and errors. Nothing you type is stored, because there is nothing to type.

Who else processes data

• Vercel — hosts the site and keeps its own request logs

• PostHog — anonymous product analytics

Also true

• There is no sign-in, no membership, no payment and no email list on this site, so there is no account, no card and no session anywhere in it.

• Nothing here is sold, traded or shared for advertising. There is no ad network on the site, no retargeting pixel and no data broker in the path.

• Corrections and removals go to hello@thecompound.tech, which reaches a person.

• Context Window is built and run by Compound Labs. The declarations on this page are part of this product's own configuration and are re-checked at every deploy against the repository they describe: a product that claims to have no accounts and ships an authentication route fails the build, and so does one that takes payment without naming its payment processor here.