Privacy policy

Peptide Tracker is made by Flat Six Labs LLC, a company in the United States. We build the iOS and Android apps, the web tools, and the backend that serves them, and we decide what happens to the data in them, which makes us the data controller in the language of UK and European privacy law. We are not owned by, controlled by, or operationally entangled with any peptide manufacturer, reseller, or clinic.

We may, however, link to third-party partners in marketing emails and SMS messages you opt into, and we may earn a commission when you purchase through those links. The marketing section below describes that relationship in detail.

You can reach us at hello@peptidetracker.ai. If you are in the UK or the European Union, you can also reach us through our local representatives, listed in the representative section below. Our backend is hosted in the United States.

We use your data to store your protocols and dose history, to deliver dose reminders, to keep your data in sync across your own devices if you sign in, to diagnose bugs when the app crashes, and to see where people get stuck in product flows so we know what to fix.

We use AppsFlyer, an attribution provider acting on our behalf, to learn which of our ad campaigns led people to install the app, finish signing up, or make a purchase. We use those results to decide where to advertise. The ad platforms themselves learn only whether one of their ads led to an install. The list above says what AppsFlyer receives, and it does not run for accounts in the UK or Europe.

If you have opted in via the marketing consent checkboxes, we also use your marketing email and/or phone number to send the kind of message you ticked the box for. The marketing section covers what those messages are and how to stop receiving them.

If you have opted into marketing and you are outside the UK and Europe, we sync a profile snapshot to our email provider, Klaviyo, so the messages you opted into can be relevant rather than generic. For accounts in the UK and Europe, Klaviyo receives only what it needs to deliver the messages, and nothing about what you track. If you have not opted into marketing, nothing is sent to Klaviyo.

If you join the optional Founding Membership or leave a tip, RevenueCat, our subscription management provider and a sub-processor acting on our behalf, sends us receipt identifiers and purchase or subscription status so we can record your payment and any membership access. For purchases on our website, we also provide RevenueCat with your account identifier and email address, and Stripe processes the payment. Your payment card details are handled by Apple, Google, or Stripe, and we never receive your full card number.

If you use the in-app assistant, your message and a limited slice of context, meaning your active protocols, recent dose logs, and the peptides you track, are sent to our AI provider, Anthropic, so it can generate a reply. That provider may retain it for up to 30 days to monitor for abuse and does not train its models on it. We do not send your notes, your photos, or your contact details, and using the assistant is always your choice.

If you use Connect, we use your active protocols and dose history to decide which compounds to suggest when you ask a question, which questions are relevant to you, and whether to offer an optional help notification. We show other signed-in members the posts and Connect context you deliberately share, including your username, tagged compounds, experience context, and optional active stack. This matching process keeps your private protocol details, dose amounts, dose log entries, and tracking notes out of member posts. Our team may review Connect posts and report notes to enforce the community rules, and a person, never an automated system, makes every removal decision.

We send account emails, such as password resets, sign-in notices, and Connect moderation notices, through Postmark, an email delivery provider acting on our behalf. Postmark keeps a copy of each message for up to 45 days so we can see whether it was delivered.

We do not make decisions about you by automated means that have legal or similarly significant effects, and we do not profile you for anything beyond choosing which marketing message to send, which only happens outside the UK and Europe and only after you opt in.

Pulse shows health readings on the same timeline as your protocols and doses. You can type a reading in yourself, or you can connect Apple Health on iOS or Health Connect on Android and let the app read them for you. Connecting is entirely optional, and nothing is read from either platform until you do it. The app works the same if you never connect one and type your readings in instead.

Once connected, we read your weight, body fat, blood pressure, resting heart rate, heart rate variability, steps, active energy, the calories and macronutrients you have logged, and how long you slept. On Android we also ask for permission to read history older than thirty days, because without it Health Connect would only hand us the last month and the longer views in Pulse would sit empty. We only ever read, which means we never write anything back to Apple Health or Health Connect and never alter a reading you did not change yourself.

We use these readings for exactly one purpose, which is drawing your charts inside the app. They are never used for advertising or marketing, never sold, never shared with a third party, and never mined for any purpose beyond showing you your own data. Apple's App Review Guidelines and Google's Health Connect policy both require this of us, and we would hold to it either way.

Your health readings stay out of our marketing and out of our third-party analytics. They are not sent to our email provider, not used to choose which offers you see, not sent to PostHog, and not included in the context sent to the in-app assistant. The analytics database described in the storage section holds no individual reading for any account, stays under our control, and is never used for advertising.

If you are in the UK or Europe, everything you track here counts as health data under your privacy law, including your compounds, doses, and protocols, and we ask for your explicit consent before we handle any of it. The app and the website show you the consent when you start, it names what is collected and why, and you have to agree on purpose. If you decline, the app stays locked until you agree, and a locked account can still read this policy, email us for a copy of its data, delete itself, and sign out. You can withdraw your consent at any time in Settings, on the app or on the website, and withdrawing locks the app the same way. An account that has declined or withdrawn and has not agreed again within 90 days is deleted, along with everything in it, because without your consent we have no basis to keep it.

You can remove readings at any time. Delete an individual reading from the Pulse screens, disconnect the health source to stop any further syncing, or disconnect and delete every reading that was synced in one action. Deleting your account removes them along with everything else on the schedule in the retention section.

We send marketing email and SMS only after you have opted in via the corresponding checkbox during onboarding or in Settings. The exact wording of the consent you agreed to, the version number of that wording, and the timestamp are stored in our audit log so we can prove what you consented to.

Marketing emails and SMS messages from us may include offers from health-product partners, including peptide suppliers, lab and diagnostic test providers, at-home test kits, and related services. Outside the UK and Europe we personalize which offers you see based on your activity and what you track in the app, including the peptides and protocols in your account and your supply levels, so the offers are relevant to you rather than generic. Your health readings are excluded from this entirely, meaning nothing from Apple Health or Health Connect and no reading you entered in Pulse is ever used to choose an offer. Peptide Tracker may earn a commission when you purchase through a link in one of those messages. We disclose this relationship in the message itself, not just here. Receiving these offers is not a condition of using the app, opt-in is entirely optional, and opt-out is one tap.

If you are in the UK or Europe, nothing you track in the app is used to choose what we send you. You receive our general messages, such as the welcome series, and the only things our email provider holds about you are the contact details you gave us and the basics it needs to send, such as your timezone and whether you are a member.

We choose which offers to show you on our own systems, so we don't share your tracked data with those partners. They receive a normal web visit from a tagged URL when you click, but they do not receive your contact details or anything you track in the app.

Our email and SMS messages are delivered through Klaviyo, our email service provider and a sub-processor acting on our behalf. For users who have opted into marketing, Klaviyo receives the profile snapshot described in the collection list so it can send and, outside the UK and Europe, personalize those messages. Klaviyo is contractually our processor. It does not buy your data and may not use it for its own purposes. This is separate from the affiliate vendors above, who receive none of it.

To unsubscribe, reply STOP to any SMS message, click the unsubscribe link in any email, or go to Settings › Marketing in the app. Unsubscribes are honored immediately, and we keep a revocation record in the same audit log so the next time we send to the channel we know to skip you.

California residents: under the CCPA and CPRA, you have the right to opt out of any "sale" or "sharing" of personal information for cross-context behavioral advertising. We do not sell or share personal data for those purposes. The affiliate links described above pass no personal data to the vendor and do not constitute a sale or share under the CCPA. You may still exercise your access, correction, and deletion rights as described in the rights section.

Your data is stored in a managed database hosted in the United States by Render, and any photos you upload are kept with Amazon Web Services, also in the United States. Cloudflare sits in front of our servers to carry the traffic and block attacks, and it sees your IP address on every request. All traffic between the app and our servers is encrypted in transit over HTTPS, and data at rest is encrypted by our hosting providers.

We also keep a separate analytics database, hosted in the United States by Render and rebuilt from the main database at least once a day. We use it to understand how the product is used across everyone rather than one account at a time. It holds a reduced version of what the main database holds. Each account appears under a one-way hash in place of its identifier, with no name, username, email address, phone number, password, or sign-in token. It leaves out dose amounts, health readings, notes, photos and their captions, the words of your assistant chats and Connect posts, the raw billing payloads from our subscription provider, and the store transaction identifiers that could tie a purchase back to a payment account.

For accounts in the UK and Europe the analytics database keeps only that something happened and when, such as a dose being logged on a day, and leaves out the compounds you track and the health answers from the survey. The exceptions are a compound you tag on a Connect question, which you chose to show other members, and the compounds on your protocols and doses if you said yes when the app asked "Can we learn from what you log?", an answer you can change in Settings at any time. Deleting your account removes it from the analytics database within 48 hours, apart from the purchase records the retention section describes, which stay with no account attached.

Authentication tokens live in your device's secure store (iOS Keychain or Android Keystore). We do not store your password in plain text. Password-based accounts use a one-way hash (bcrypt), so even we can't see the original.

If we ever discover a breach that puts your data at risk, we will tell the people affected and, where the law requires it, the relevant authority within 72 hours of learning about it.

We are a United States company and every service provider that handles your data for us runs in the United States. If you are in the UK or Europe, that means your data leaves your region. Each of those providers has signed a data processing agreement with us that includes the European Commission's standard contractual clauses and the UK addendum to them, which are the legal mechanisms UK and European law accepts for sending data abroad. Postmark and Expo are also certified under the EU-US Data Privacy Framework.

These are the providers and what each one does for us. Each acts on our instructions, and none may use your data for its own purposes.

• Render hosts our servers and databases.
• Amazon Web Services stores your photos.
• Cloudflare carries our traffic and tells us the country you connected from.
• Postmark delivers account and Connect moderation emails.
• Expo delivers push notifications.
• Sentry receives crash reports.
• PostHog receives product analytics events, outside the UK and Europe only.
• AppsFlyer measures our ad campaigns, outside the UK and Europe only.
• Klaviyo sends marketing email and SMS to people who opted in.
• Anthropic generates the in-app assistant's replies.
• RevenueCat manages memberships and tips, and Stripe processes website payments.

Apple and Google act on their own behalf when you sign in with them or buy through their stores, under their own privacy policies.

We retain your data for as long as you keep the account. If you delete your account, we remove it from the active database within 24 hours, from the analytics database within 48 hours, and from backups within 30 days, and the deletion reaches every provider that held something about you: your marketing profile at Klaviyo, your analytics person and events at PostHog, your ad measurement records at AppsFlyer, and the email on your RevenueCat customer record.

A few things outlive the account. Purchase records stay for seven years after deletion, because tax and accounting law requires it, and they hold the product, price, date, and receipt identifiers rather than your name. Crash reports at Sentry expire on their own 90 days after they were sent. Account emails at Postmark expire 45 days after they were sent. The consents you gave are deleted with the account, except where a purchase record depends on them.

An account in the UK or Europe that declined the health data consent or withdrew it, and did not agree again within 90 days, is deleted on the same schedule as a deletion you asked for.

The website uses a few cookies, all of them for the site to work rather than to track you, which is why we show no cookie banner.

• A session cookie that keeps you signed in and protects forms from forgery. It ends when you close the browser.
• A remember-me cookie, only if you tick that box when signing in, which keeps you signed in for up to twelve weeks.
• A short-lived cookie, lasting twenty minutes, that ties a Sign in with Google or Apple attempt to your browser while that company sends you back to us.
• A creator attribution cookie, lasting 30 days, set only when you arrive through a link from a creator we work with and only when you are outside the UK and Europe. It tells us which creator to credit if you sign up.
• Stripe sets its own fraud-prevention cookies during checkout, under Stripe's privacy policy.

The website also keeps a few things in your browser's local storage rather than on our servers: your theme choice, the numbers you last typed into the calculators, and a checkout you have started but not finished. They never leave your browser.

The mobile apps use no cookies.

You can export your data, correct it, or delete it. You don't need to justify a deletion request and we won't try to talk you out of one.

To delete your account, open the app and go to Settings › Danger zone › Delete account, or use the same button in Settings on the website. To request an export, email us at hello@peptidetracker.ai from the address associated with your account and we'll send a JSON archive within seven days.

If you are in the UK or the European Union, you also have the right to see the data we hold about you, to have it corrected, to have it deleted, to receive a copy in a portable format, to restrict or object to how we use it, and to withdraw any consent you gave without it affecting what happened before. Withdrawing the health data consent locks the app, as the health section explains, and withdrawing marketing consent stops the messages. We answer within one month. If you think we have handled your data unlawfully, you can complain to your local data protection authority, which in the UK is the Information Commissioner's Office, and you can contact us or our representatives first so we can put it right.

If you are in California, you have the rights to know, delete, and correct described above, the right to opt out of sale or sharing, which we do not do, and the right not to be treated differently for exercising them.

We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:

• United Kingdom (UK)
• European Union (EU)

Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter or make use of your data subject rights, please visit the following website: https://app.prighter.com/portal/15483262690

This policy does not create a contractual relationship between us. Nothing here is medical advice. Always consult a qualified clinician before starting, pausing, or changing a peptide protocol.