Privacy Policy

Introduction

The Peptide App ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and website (collectively, the "Service").

Information We Collect

Information You Provide

• Account information (email address, name)
• Protocol and dosing data you enter
• Progress tracking information
• Communications with our support team

Automatically Collected Information

• Device information (device type, operating system)
• Usage data (features used, app interactions)
• Log data (access times, pages viewed)

How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our Service
• Send you reminders and notifications you've requested
• Respond to your comments, questions, and support requests
• Monitor and analyze usage trends to improve user experience
• Protect against unauthorized access and ensure security

Optional Whop ad measurement

If you arrive from a Whop-managed Meta ad, you can separately allow us to measure accepted email signups for vial cards, the Android list, and price-drop alerts. We remember only numeric ad, ad set, and campaign identifiers for up to seven days after the click. With this permission, our server sends Whop a generic lead event with those identifiers, its time, and a separate random event identifier to prevent duplicates. This records a stored signup request, before email confirmation. It does not report a confirmed alert, a purchase, or a clinic connection.

We do not send Whop email addresses, contact details, peptide selections, calculator values, page addresses, referrers, or browser fingerprints through this integration. No Whop pixel is loaded on pricing pages. Every email form works without this optional permission. Global Privacy Control and Do Not Track signals keep this measurement off. Your choice is saved for six months. Withdrawal clears the stored ad identifiers and stops attribution on future signups; it cannot recall events already queued or received by Whop. This choice is separate from Google measurement and the existing app campaign pixel.

Optional measurement on the price-alert landing page

On our general /go/price-alerts landing page, a separate, optional choice allows Whop’s browser pixel and the anonymous signup measurement described above. This choice does not reuse an earlier server-only or Google measurement permission. Before you accept, we do not load this pixel. Declining does not affect your ability to request price alerts.

After you accept, Whop receives visits to this general page, numeric ad identifiers, cookie and browser identifiers, browser fingerprinting information, browser details such as language and screen size, and network information. The pixel can also use existing advertising cookie identifiers and link its anonymous browser identifiers across our site’s subdomains. We remove other incoming query values and referrers before the pixel can run. The page address and title are general and do not change when you choose a peptide. Automatic form, link and iframe collection are disabled. We do not send email addresses, peptide or vial-size selections, form answers, or confirmation tokens to the pixel. Successful signups use the existing server-side anonymous lead event; we do not fire a duplicate browser lead event.

This pixel runs only in the general price-alert landing document, not on peptide pricing, clinic, calculator, confirmation or privacy pages through this integration. Global Privacy Control and Do Not Track keep it off. Your choice lasts six months. Turning it off clears this integration’s stored ad context and Whop browser identifiers and reloads the page to stop the loaded pixel. A changed choice in another tab also stops it. Withdrawal cannot recall information Whop already received.

Optional measurement on the COA checker

A separate, optional choice on /coa-grader lets Whop measure visits and completed certificate checks. The pixel stays off until you accept. Declining does not affect checks, grades or report access. After acceptance, Whop receives this general page address, numeric ad identifiers, cookie and browser identifiers, browser fingerprinting information, browser details and network information. Whop can use existing advertising identifiers and link its browser identifiers across our subdomains, and forward conversions to Meta to measure and optimize our ads.

We send one check-completed event with a random identifier after a certificate receives a grade. This is tool use, not a purchase, email signup or a claim that a product is safe. We never attach documents, filenames, report links or tokens, peptide selections, grades, findings or email addresses. Automatic form, link, iframe and page collection are disabled. Incoming query values other than numeric ad identifiers and incoming referrers are removed before the pixel runs. This integration does not run on saved reports or other pages, and other site advertising trackers are excluded from the checker document.

Your choice lasts six months. Global Privacy Control and Do Not Track keep measurement off. Turning it off clears stored Whop identifiers and reloads the checker to stop its pixel; changes in another tab also stop it. Withdrawal cannot recall events already received. Checks completed before permission are not sent later.

Optional Google ad measurement

With your permission, we load the Google Ads tag on our home page, app landing page, general calculator, pricing pages, and clinic connection page. The same optional ad-measurement choice applies to each of these pages. Google receives basic browser and network information, advertising click identifiers, and events when you complete a calculation, request an app download, or successfully submit a calculator email request, price-drop alert, or clinic connection request. These form events report that a request was accepted, not that an email was confirmed or an appointment was booked. A download click does not tell us that you installed the app. Google may use cookies to connect these actions to an ad you clicked.

These events do not include entered amounts, peptide selections, names, email addresses, phone numbers, clinic intake answers, account details, or saved vial data. Pricing events use a general pricing page address rather than the selected peptide's address. We do not enable personalized ads or enhanced conversions through this integration. The Google tag stays off until you opt in, and browser Global Privacy Control or Do Not Track signals keep it off. You can change your choice below. Withdrawal stops future measurement; it does not erase data already received by Google. This choice controls Google Ads measurement, not the Service's other analytics. Learn more about Google's use of information from partner sites.

Email Updates

If you ask us to email you a vial card from the reconstitution calculator, we collect your email address and the calculator values on the card: the peptide name if you chose one, your target amount, the peptide in the vial, and the water added. If you ask for a reminder, we also store the beyond-use date you enter. If you set a price-drop alert, we store the peptide and vial size you chose and the price when you set it. If you join the Android list, we collect only your email address. We record when you gave permission, the version of the notice you accepted, and which page you used. A hashed network identifier helps prevent abuse.

We send the email you asked for right away through our email provider, Resend. Nothing else is sent until you confirm with the link in that email: one reminder before your beyond-use date, one email if the price you are watching drops (alerts end after six months), or one email when the Android app launches. We keep a record of each email we send you: which email, when, and whether our provider accepted it. We delete the calculator values as soon as no pending email needs them. Your email address and calculator values are never sent to analytics or advertising services. Every email has an unsubscribe link, which stops all further emails and cancels any pending reminder. You can also ask us to delete your address through the support contact below.

COA uploads and reports

When you use the COA checker, we process your upload with OpenAI and Typesafe to read and assess the report. We may contact the issuing lab's verification service using the report identifiers. Upload only documents you have permission to share, and remove personal information you do not want processed. Before an upload is accepted, Vercel’s bot protection checks technical signals from your browser to confirm the request comes from a person. The file itself is not part of that check.

The original file and grade report are stored privately for 30 days, then removed by our cleanup job. Report links are unlisted and are not included in search engines or public testing records. Anyone with a report link can view the grade and certificate. A hashed network identifier limits abuse without storing your raw IP address.

If you ask to see a graded certificate's full report, or for a link to try again when the checker is busy, we store your address and permission in our email request system and send that one email through Resend. This request does not subscribe you to marketing. A separate, unticked box lets you also ask for occasional emails about COA checks, lab testing and peptide prices; if you tick it, we record when you did and the exact words you agreed to. Every email has an unsubscribe link, which stops all further emails. Upload contents, report findings and your address are not sent to advertising or analytics services. We record anonymous tool usage and whether a report was saved.

Clinic Connection Requests

If you request a clinic connection, we collect your first name, email, state, visit preferences, your selected main care goal, and consultation timing. For in-person preferences, we also collect your ZIP code and travel distance. You may also give a US phone number and choose whether we follow up by email, call or text. We use these details to review your request and contact you about relevant clinic options and next steps, with your permission. We use your phone number only for this request; standard message and data rates may apply to texts. We record when you gave that permission and the version of the notice you accepted. A hashed network identifier helps prevent abuse. We also note which type of page on our site linked you to the clinic page, such as a calculator or guide, and keep anonymous daily totals of clinic page visits and form steps. Those totals use no cookies or identifiers and are not tied to your request.

Your request is available to our authorized operations team. It is not a booking or a medical assessment, and we do not share it with a clinic without your permission. If you separately accept optional Google ad measurement, Google receives a successful-submission event under the same policy described above. Declining does not affect your request or our follow-up. Clinic form answers are never sent to Google, and session recordings remain excluded from the clinic page. Please do not submit medical records or prescription details. You can ask us to remove your request or stop clinic follow-up emails through the support contact below.

Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. Your health and protocol data is encrypted both in transit and at rest. However, no method of transmission over the Internet or electronic storage is 100% secure.

Data Sharing

We do not sell your personal information. We may share your information only in the following circumstances:

• With service providers who assist in operating our Service
• To comply with legal obligations or respond to lawful requests
• To protect our rights, privacy, safety, or property
• With your consent or at your direction

Your Rights

Depending on your location, you may have certain rights regarding your personal information:

• Access and receive a copy of your data
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict processing of your data
• Data portability

To exercise these rights, please contact us at support@thepeptide.app.

Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with our Service. You may request deletion of your account and associated data at any time by contacting us.

Children's Privacy

Our Service is not intended for children under 18 years of age. We do not knowingly collect personal information from children under 18. If you believe we have collected information from a child under 18, please contact us immediately.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Your continued use of the Service after any changes indicates your acceptance of the updated policy.

Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Email: support@thepeptide.app