Privacy Policy

Effective Date: October 16, 2026
Contact: help@peptade.com

PEPTADE IS NOT A MEDICAL SERVICE. All peptide information and the personalized stack are for informational and educational purposes only. The stack is generated from your self-reported profile and goals — not from medical diagnoses or clinical evaluations — and contains no dose, schedule, or instruction to take anything. Consult a qualified healthcare provider before starting any peptide regimen.

1. Who We Are

Peptade ("we", "our", "us") operates the Peptade mobile application and is the data controller for the personal data described in this policy. For questions about this policy, contact us at help@peptade.com.

This Privacy Policy is incorporated into and forms part of our Terms of Service (https://www.peptade.com/terms). The disclaimers of warranties and limitations of liability in the Terms of Service apply to this policy and to our handling of your data to the maximum extent permitted by law. Our separate Consumer Health Data Privacy Policy (https://www.peptade.com/consumer-health-data) describes the same practices in the terms used by consumer-health-data laws and sets out the rights those laws give you; our Delete Your Data page (https://www.peptade.com/delete-your-data) sets out every deletion path step by step.

2. Information We Collect

We collect the following categories of information:

Account information: Email address and authentication identity from Sign in with Apple or Sign in with Google. We do not collect or store a password.
Profile data: Age / date of birth, gender, height, weight, activity level, physique level, self-reported improvement goals (such as weight management, muscle growth and recovery, cognitive performance, longevity, immune support, hair growth, skin and facial goals, and others), and optional profile details such as a display name, username, avatar photo, daily step goal, and typical bedtime.
Facial photo: A single front-facing selfie you provide to run the personalized stack generator (running the generator is optional; the photo is required to run it), used as one input to tailor the stack (see Section 4 and Section 4A). No facial score or rating is produced for or shown to you.
Biometric data: Facial geometry and characteristics derived from your facial photo by our AI systems, used solely to help tailor the stack (see Section 4A).
Personalized stack and dosing data: The compounds listed in your stack and their rationales, your selected compounds, dosing preferences, dose completion records, schedules, cycles, and stack history.
Manual dosing and inventory data: Compound identity, administration route, total and remaining amount, user-entered fixed doses or titration steps, doses per day, schedules, cycles, dates and notes. These values support your tracking and reminders. Preparation and half-life fields saved in earlier versions may remain in historical records; the current App no longer edits or uses them for calculations.
Injection and dose logs: When you log a dose, we store the compound, amount and unit, time, and — optionally — the injection site, body side, an approximate on-body location you tap on a body map, a pain level, and notes.
Custom (user-defined) compound entries: If you add a compound that is not in the Peptade catalog, the name you enter and the administration method you select (oral, topical, or injectable) are stored alongside your stack data. This is user-generated content; Peptade does not pre-validate or attest to the identity, legality, or safety of any custom name you enter.
Nutrition calculator inputs: Your profile, activity and goal selections are used on your device to estimate calorie and macro targets. The result is saved only if you choose to import it to your nutrition goal.
Nutrition and meal data: Food entries you log — food names, portion estimates, calories, macronutrients, and micronutrients — plus any saved foods and meals. To identify food, you may capture a meal, menu, or barcode photo; these images are sent to our AI provider for identification only and are not retained as stored images by the App.
Sleep data: Logged or imported bedtime, wake time, sleep duration, self-rated sleep quality, your typical (base) bedtime, and the derived Sleep Score and deep-sleep estimate.
Hydration data: Water amounts you log and your hydration goal.
Body weight data: Weight entries you log or import.
Exercise and workout data: Workout sessions, exercises, and sets (reps, weight, unit), plus the derived muscle-recovery map.
Activity data: Steps, active/basal energy, exercise minutes, distance, and heart-rate metrics — imported from Apple Health only if you connect it (see Section 11).
AI assistant data: The messages you send to the in-app AI assistant, together with a snapshot of your own in-app data (such as your profile, stack, recent dose logs, and recent tracking) that is sent to a third-party AI provider to generate a response (see Section 4).
Certificate of Analysis (COA) documents and records: Documents you choose to attach to a compound in the "Verify Your Compounds" feature — a PDF or photo of a lab report — together with the fields recorded against it (the laboratory named on the document, the batch number, the compound named, the purity figure and method, the identity method, the test date, and the laboratory's contact details), how the document reached you, which document you marked as matching the vial you are using, the batch numbers you type off your own vials along with your own answer to whether they match, and — where you scan a QR code or barcode from your packaging — what that code contained, together with the site name if the code held a web address. Documents are stored in a private, access-controlled bucket readable only by your own account, and are never shared with other users or aggregated with other users' documents. Everything recorded here is either a transcription of what your document states, something a code on your own packaging contained, or an answer you gave yourself. Peptade does not test, verify, validate, rate, or form any opinion about any document, laboratory, batch, vendor, or product.
Side-effect and wellness log: Optional self-reported side effects, energy, sleep, mood, and notes. These are stored on your device only and are not uploaded to our servers.
Device and usage data: Device type, operating system, app version, and crash/error diagnostics from the App and our backend services.
Advertising and measurement data: To measure and improve our advertising, we and our advertising partners (Meta Platforms and TikTok) collect app-event data (such as app installs, app opens, completed sign-ups, and subscription purchases) and, only if you allow tracking via the App Tracking Transparency prompt, your device's advertising identifier (Apple's IDFA) and related attribution data. For users who decline tracking, iOS measurement is performed only in aggregate through Apple's SKAdNetwork. On Android there is no App Tracking Transparency prompt: the Meta SDK may collect the Google advertising ID whenever analytics is on, and your controls are the analytics switch in Profile ▸ Privacy Settings ▸ Manage Consents and the advertising-ID setting in Android Settings ▸ Google ▸ Ads (see Section 5A). We also use a product-analytics service (PostHog) to understand in-app usage.

Scanning happens entirely on your device. The camera is used only to decode the code in front of it; no image, video, or frame from the scanner is uploaded, stored, or sent anywhere, and the camera feed is not recorded. Only the decoded text is kept, in your own account's record. If the code contains a web address, Peptade does not retrieve that page — opening it is your own action in your own browser — and the site name is stored solely as a note of where your packaging pointed. It is not shared with that site or with anyone else, is not combined with other users' records, and is not used to build any vendor or seller profile.

Separately, where a compound you track appears in Peptade's library, the App shows you that compound's United States FDA approval status from the public Drugs@FDA record. This is reference information already held in the App's compound library; displaying it involves no lookup against your data, sends nothing anywhere, and reveals nothing about you to anyone.

2A. Information Collected Before You Create an Account

The onboarding questionnaire runs before you have an account. During that stage we associate your answers and app activity on your device with a randomly-generated, device-local anonymous identifier — not your name or email. Onboarding ends by asking you to create a Peptade account or sign in, and the answers held under the anonymous identifier are then linked to that account so nothing you entered is lost.

You cannot subscribe without an account. Subscription offers are shown only after you are signed in, so every purchase is associated with both your app-store account and your Peptade account from the moment it is made. Payment itself is processed by the app store and is governed by its policies (see Section 5).

If you leave during onboarding and never create an account, the device-local data stays on your device, is not associated with an identified user, and is removed when you delete the App or clear its data.

3. How We Use Your Information

Service delivery: Providing the personalized stack, compound and dose tracking, injection-site history, the research library, calculators, Certificate of Analysis record-keeping, and the lifestyle tracking features (sleep, hydration, nutrition, exercise, and body weight).
AI-assisted personalization: Processing your facial photo and profile data through AI models to tailor which emerging-research compounds are listed in your stack and to explain why. This is algorithmic matching based on your self-reported profile — not clinical diagnosis or medical assessment, and it does not produce a score shown to you. The FDA-approved section of your stack is selected by a database rule from your goals alone, without the AI model.
AI assistant: Sending your question and a snapshot of your own in-app data to a third-party AI provider so the assistant can answer in context.
Nutrition identification: Sending meal, menu, or barcode photos to our AI provider, and queries to a public nutrition database, to estimate foods and nutrients.
Personalized stack tracking: Storing the personalization data you enter (cycle, supply amounts, dosing schedules, titration steps, doses per day, notes) so the App can display your configured doses, count down your remaining supply, drive reminders, and show your schedule and cycles.
Custom compound tracking: Storing the names and administration methods of any custom (non-catalog) compounds you add, solely so they appear in your tracker and dose log. Custom entries are never placed in a personalized stack.
Reminders: Scheduling local notifications on your device (dose reminders, and optional meal, water, sleep, and exercise reminders). These are generated on your device, are scheduled only after you grant notification permission, and can be turned off at any time in the App or in your device's notification settings. Peptade does not collect your phone number and does not send SMS or text messages of any kind. We do not send marketing or promotional push notifications; notifications are limited to the reminders you have configured. Any service email we send is transactional (for example, account or subscription matters).
Advertising and measurement: Measuring how our marketing performs — for example, which ads lead to installs, sign-ups, and subscriptions — and improving and optimizing our advertising. This uses app-event data and, only with your permission, your advertising identifier (see Section 5A). We do not use your health, biometric, facial-photo, or dose/tracking data for advertising.
Security: Detecting fraud and abuse, rate-limiting AI services, and ensuring platform integrity.

4. How AI Features and Photos Are Handled

Peptade uses third-party AI services to power several features. All AI requests are made from our secure Supabase backend — your device does not contact AI providers directly.

Facial photo analysis: During stack generation, your single front selfie is uploaded to our secure storage and sent (via OpenRouter to OpenAI's vision models) for analysis that helps tailor your stack. No facial score, rating, or aesthetic assessment is generated for you or shown to you — only the listed compounds and their rationales are surfaced. Retention for the photo and the derived facial data is set out in Section 4A.
Stack and rationales: Your profile (age, gender, height, weight, activity level, physique, skin and hair inputs), your selected goals, and the facial-analysis results are sent via OpenRouter to OpenAI's language models to select and order the emerging-research section of your stack and to generate the "why" rationale for each entry. The FDA-approved section is not chosen by the model.
AI assistant ("PepBot"): Your message, recent conversation turns and a structured snapshot — profile information, compound names, dose-logging dates, body weight, sleep, activity and nutrition, plus educational catalog fields — are sent via OpenRouter to OpenAI's language models. The structured snapshot excludes medication amounts, preparation fields, injection sites, schedules and catalog dosing/usage fields. Your messages contain the text you choose to enter. Conversations are not retained by the AI provider.
Meal and menu photos: When you scan a meal, that photo is sent via OpenRouter to OpenAI's vision models to identify foods and estimate portions. When you scan a restaurant menu, the menu photo is sent together with your goals so dishes can be ranked against them. These images are used to produce the result and are not stored as images.
Food text you type: Food names or descriptions you enter are sent via OpenRouter to OpenAI, and are also matched against the USDA FoodData Central database, to look up nutrition values.
Barcode lookups: Scanning a barcode sends only the barcode number to Open Food Facts, a public food database. No photograph is transmitted, and no AI provider is involved.
Certificate of Analysis (COA) documents: If you attach a COA to a compound in "Verify Your Compounds" and AI features are enabled, one page of that document is sent via OpenRouter to OpenAI's vision models so its printed fields can be transcribed for you. The transcription is limited to copying text that appears on the page — the laboratory named, the batch number, the compound named, the purity figure and the method beside it, the test date, and the laboratory's contact details. Peptade does not assess, validate, score, or form any opinion about the document or the product it describes, and no such assessment is generated, stored, or shown to you. Anything the transcription cannot read clearly is left blank rather than guessed. You can disable this in Profile → Privacy Settings → Manage Consents, in which case no COA document leaves your device and you enter the fields yourself.
Real-time processing: AI providers process this data in real time to return the requested result and do not retain it for their own purposes or use it to train their models, per our processing arrangements with them.

All AI requests are routed through OpenRouter to OpenAI's models. We name the routing layer and the model provider rather than specific model versions, which change over time; a current description of what each feature sends is also shown in the app under AI & Third-Party Services.

4A. Biometric Data Collection and Use

Quick reference — face data at a glance

Collected: A single front-facing selfie; facial geometry and characteristics derived from it.
Used for: Tailoring your personalized stack only. No score, rating, or aesthetic assessment is ever shown to you.
Shared with: OpenRouter and OpenAI for real-time analysis only (no retention by them); never sold to third parties.
Stored in: A private Supabase Storage bucket (US region); access restricted by row-level security.
Photo retention: Original photo files are deleted after 90 days.
Biometric retention: Derived data is retained for your active account and permanently deleted within 30 days of account deletion or withdrawal of AI-data consent.

When you provide a facial photo, Peptade's AI systems extract facial geometry and characteristics from that image. Under applicable state laws (including the Illinois Biometric Information Privacy Act and the Texas Capture or Use of Biometric Identifier Act), this extracted facial geometry constitutes biometric data.

Purpose. Biometric data is collected solely to help tailor your personalized stack. It is not used for medical diagnosis, clinical assessment, or any purpose outside of the App's stack-generation feature, and it is never surfaced to you as a score, rating, ranking, symmetry measurement, face-shape result, or "aesthetic dimension."

Face data is not used for facial recognition, identity verification, user authentication, behavioral profiling, advertising, sale to third parties, or training third-party AI models. The App does not match your face against any database of identities.

Retention. The original facial photo file is automatically deleted from our servers after 90 days. Any biometric data derived from it is retained only for the duration of your active account. Upon account deletion or withdrawal of AI-data consent, all remaining biometric data — including any source photo not yet purged — will be permanently deleted from our systems within 30 days.

Disclosure. We do not sell, lease, trade, or otherwise profit from your biometric data. It is shared only with the AI service providers listed in Section 5 (OpenRouter/OpenAI) for the sole purpose of generating your analysis, processed in real time without permanent storage by those providers, and is not used for model training.

Consent. By agreeing to AI data processing during onboarding and to the biometric notice shown immediately before the camera during stack generation, you provide your informed written consent to the collection, use, and storage of your biometric data as described in this section. Running the stack generator is optional, and you may withdraw your consent at any time through the app's Privacy settings; you may also delete your account or your data at any time (see Sections 7 and 8).

We share data only with service providers necessary to operate the App:

Supabase: Database hosting, authentication, file storage, and server-side functions (US region).
OpenRouter / OpenAI: AI-powered facial-photo analysis, the personalized stack's emerging-research selection and rationales, the in-app AI assistant, COA transcription, and food/menu/barcode identification.
RevenueCat: Subscription and entitlement management. RevenueCat receives your account identifier and app-store purchase information to manage entitlements.
Superwall: Paywall delivery and pricing experiments — the service that renders the subscription screens and decides which version of them you are shown. It receives your account identifier, your subscription status, standard device and app data (such as device model, operating system, app version, locale and country), your interactions with the subscription screen, and a limited set of attributes used to personalise and target that screen: the preferred name you gave, the improvement goals and experience level you selected during onboarding, your sex, an age band (for example "25–34"), how you heard about us and any creator code you entered, and whether you are eligible for a free trial. It does not receive your email address, date of birth, height, weight, facial photo, dose or injection logs, or any of your sleep, nutrition, hydration, exercise or body-weight tracking. Superwall does not process payments and is not an advertising network; it does not use your advertising identifier and does not track you across other companies' apps or websites. See Section 5A.
Sentry: Error and crash monitoring for the App and our backend services. Diagnostic events may be associated with your account identifier; we configure Sentry not to collect additional personal information.
Nutrition and product data providers: A public nutrition database (such as USDA FoodData Central) for food and nutrient lookups, and a product database (Open Food Facts) for barcode lookups.
Apple: For Sign in with Apple, the App Store (billing), and — only if you connect it — Apple Health (see Section 11).
Google: For Sign in with Google, if you choose it, and for Google Play (billing).
Meta Platforms, Inc. (Facebook): We share app-event data (such as app installs, opens, completed sign-ups, and purchases) and, only where you have allowed tracking, your device advertising identifier and related attribution data, so Meta can measure and help optimize our advertising campaigns. See Section 5A.
Appstack: A mobile measurement provider that tells us which marketing campaign or link an install came from. It receives install and app-open events, a completed-sign-up event, and your account identifier. We deliberately do not send it the optional "enhanced matching" identifiers it supports (email, name, phone number, date of birth, gender). Like Meta, it runs only if you have not opted out of analytics (see Section 5A).
TikTok: We use the TikTok Business SDK for advertising measurement. It receives app-event data (install, app open, retention, completed sign-ups, subscription starts and purchases), your account identifier, and — only where you have allowed tracking — your device advertising identifier. We deliberately do not send the optional "advanced matching" identifiers it supports (email, phone number, or username). Like Meta, it runs only if you have not opted out of analytics. See Section 5A.
PostHog: A product-analytics service that helps us understand how the App is used so we can improve it. Usage events may be associated with your account identifier.

We do not sell your personal information for money. The App includes advertising-measurement SDKs (Meta, TikTok, Appstack) and a product-analytics SDK (PostHog); what they collect and how you can opt out is described in Section 5A. Our sharing of advertising-identifier and app-event data with Meta and TikTok for advertising may qualify as a "sale" or "share" under some U.S. state privacy laws — see Section 10 for how to opt out. We never share your health, biometric, facial-photo, or peptide/dose data for advertising.

In addition to the service providers above, we may disclose personal data:

For legal reasons: To comply with applicable law, regulation, legal process, or enforceable governmental request; to enforce our Terms of Service; or to detect, prevent, or address fraud, abuse, security, or technical issues. Where permitted by law, we will attempt to notify you of legal demands for your data.
To protect rights and safety: Where we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Peptade, our users, or the public.
Business transfers: If Peptade is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of some or all of its assets, your data may be transferred as part of that transaction, subject to this policy's commitments (and, for biometric and consumer health data, subject to the consent requirements of applicable law). We will notify you of any such transfer that materially changes how your data is handled.
With your consent: For any other purpose, only with your consent.

5A. Advertising, Analytics, and Your Tracking Choices

To run and measure our advertising, Peptade uses the Meta (Facebook) SDK and the TikTok Business SDK. They record standard app events — installs, app opens, completed sign-ups, and subscription purchases — and report them to Meta and TikTok so we can see which ads work and optimize our campaigns.

App Tracking Transparency (your choice). After onboarding, iOS shows an "Allow Peptade to track…" prompt. If you allow it, Meta and TikTok may use your device advertising identifier (IDFA) for person-level measurement. If you decline, no advertising identifier is used, and measurement happens only in aggregate through Apple's SKAdNetwork. You can change your choice anytime in Settings ▸ Privacy & Security ▸ Tracking.
On Android. There is no App Tracking Transparency prompt. The Meta SDK is configured to collect the Google advertising ID whenever analytics is on, which it is unless you turn it off. Your controls are the analytics switch in Profile ▸ Privacy Settings ▸ Manage Consents, which stops Meta, TikTok and Appstack alike, and Android Settings ▸ Google ▸ Ads, where you can delete or reset the advertising ID.
What Meta receives. App-event data and, only with your permission, the IDFA and related attribution data. Meta does not receive your health data, facial photo, biometric data, dose or injection logs, or the contents of your in-app tracking. Meta's handling of the data it receives is governed by the Meta Privacy Policy.
What TikTok receives. The same shape of data: app events, your account identifier, and — only with your permission — the IDFA. TikTok does not receive your health data, facial photo, biometric data, dose or injection logs, or the contents of your in-app tracking, and we do not send it your email, phone number or name. Its handling of what it does receive is governed by the TikTok Privacy Policy.
The same opt-out covers all three. Declining App Tracking Transparency, or turning analytics off in the App's Privacy settings, applies to Meta, TikTok and Appstack alike.
Product analytics. We use PostHog to understand in-app usage (such as screens viewed and features used), associated with your account identifier. Some events reveal that you used a health-related feature — for example, that you logged a dose or viewed a compound's page — but never the values you entered. This is first-party analytics and is not used for cross-app advertising. You can opt out of analytics anytime in the App's Privacy settings.
Session replay. PostHog also records anonymised replays of app sessions so we can see where people get stuck. All images and all text you type are masked before the recording leaves your device — your facial photo, meal photos, COA documents, the name you enter and anything you type to the assistant are never captured. What is recorded is the app's own interface and how you moved through it. Session replay is part of product analytics and stops entirely when you opt out.
Paywall delivery is not analytics, and is not covered by the opt-out. Superwall is the infrastructure that renders the subscription screen itself, so it runs whatever your analytics choice is — switching it off would change which offer you are shown rather than protecting your privacy. It is not an advertising SDK, receives no advertising identifier, and does not track you across other companies' apps or websites. Exactly what it does receive is listed in Section 5.
No sensitive-data advertising. We never use or share your health, biometric, facial-photo, or peptide/dose data for advertising or cross-app tracking of any kind.

6. Data Security

We use commercially reasonable technical and organizational measures to protect your data, including:

All data is transmitted over HTTPS/TLS encryption (in transit).
All data is encrypted at rest on our infrastructure, including the database and the private storage buckets holding photos and documents.
Row-level security (RLS) policies designed so users can only access their own data.
Rate limiting to help prevent abuse of AI services.
Photos and documents stored in private Supabase Storage buckets scoped to your account.
Authentication tokens stored in the device's secure storage (iOS Keychain or Android Keystore).

However, no method of electronic transmission or storage is 100% secure, and we cannot and do not guarantee absolute security. You use the App and transmit data to it at your own risk. If we become aware of a data breach affecting your personal data, we will notify you and/or the relevant authorities as required by applicable law. To the maximum extent permitted by law, Peptade is not liable for unauthorized access, hacking, data loss, or other breaches beyond our reasonable control, as further described in the Limitation of Liability section of our Terms of Service.

7. Data Retention

We retain your data for the duration of your active account, with one exception: facial photo files are automatically deleted from our servers after 90 days to minimize data storage. Your peptide stack history, dosing records, tracking data, and other derived data remain available for the life of your account.

COA documents you attach are kept for as long as you keep them. They are stored in a private, access-controlled bucket that only your own account can read, are never shared with other users, and are deleted from our storage when you delete the document, delete the compound it is filed under, use "Delete Data", or delete your account.

Upon account deletion, all remaining personal data — including profile information, any remaining photos, biometric data, scan results, peptide stacks, dosing records, injection logs, tracking data, COA documents, and associated records — will be permanently deleted from our primary systems within 30 days. Backup copies may persist in encrypted backups for up to 90 days before automatic purging.

The App also offers a "Delete Data" option (Profile ▸ Privacy Settings) that deletes your tracking data while keeping your account and subscription, and a "Delete Account" option (Profile) that deletes everything. Both are described step by step, together with what each does and does not remove, at https://www.peptade.com/delete-your-data. You may also request deletion — of everything, or only part of your data — by emailing help@peptade.com at any time, no matter how long ago you last used the App and whether or not it is still installed. Any active subscription must be cancelled separately through Apple or Google Play; deleting your data or your account does not cancel it.

8. Your Rights

You have the right to:

Access your personal data stored in the App, and to receive a copy of it.
Correct inaccurate profile information (editable in Profile ▸ Personal Details).
Delete your account and all associated data, or delete your tracking data while keeping your account — in the App, or by emailing help@peptade.com at any time, including long after you last used the App.
Data portability: Request an export of your data in a commonly used, machine-readable format.
Withdraw consent for AI data processing, disconnect Apple Health, and opt out of analytics, at any time in Profile ▸ Privacy Settings ▸ Manage Consents.
Object to or restrict processing where applicable law provides for it, and not be discriminated against for exercising any right.

How to exercise them. Use the in-app controls, or email help@peptade.com from the email address associated with your account. We verify requests by matching the sending address to the account and may ask one follow-up question if that is not enough. You may use an authorized agent; we will require proof of the agent's authority. We respond within 45 days (30 days where the GDPR or UK GDPR applies), and we will tell you within that time if the law allows us an extension and we need it. We do not charge for a request unless it is manifestly unfounded or repetitive.

Appeals. If we decline a request, we explain why in writing, and you may appeal by replying to that decision or emailing help@peptade.com with the subject line "Privacy appeal". We answer appeals in writing within 45 days. If we deny an appeal you may contact your state Attorney General or, in the EEA or UK, your data protection authority (Section 10D).

9. Children's Privacy

Peptade is intended solely for adults. You must be at least 18 years of age to create an account or use the App, and the App is not directed to children. We do not knowingly collect personal information from anyone under 18. If we learn we have collected personal data from a person under 18, we will promptly delete it. A parent or guardian who believes a minor has provided personal information to Peptade may contact us at help@peptade.com to request deletion.

Where the GDPR or UK GDPR applies, we process your personal data on the following legal bases: performance of a contract (providing the App's features you request, managing your account and subscription); your explicit consent (processing of health-related data — such as your profile, dose logs, and tracking data — and biometric data derived from your facial photo, which are special categories of data under Article 9 GDPR; and advertising measurement using your device identifier); legitimate interests (securing the App, preventing fraud and abuse, first-party analytics, and improving the service, balanced against your rights); and legal obligation (where processing is required to comply with law). You may withdraw consent at any time via the App's Privacy settings without affecting the lawfulness of processing before withdrawal.

10B. California and Other U.S. State Rights

If you are a California resident, you have rights under the CCPA/CPRA, including the right to know what personal information we collect, to request its correction or deletion, to limit the use of sensitive personal information, and not to be discriminated against for exercising those rights. Residents of other states with comprehensive privacy laws (such as Colorado, Connecticut, Oregon, Texas, and Virginia) have similar rights of access, correction, deletion, portability, and opt-out. To exercise these rights, contact us at help@peptade.com or use the App's Privacy settings; Section 8 describes how we verify requests, how quickly we respond, and how to appeal.

Opt out of "sale" or "sharing" for advertising. Some U.S. state laws (such as the CCPA/CPRA) treat our sharing of advertising-identifier and app-event data with Meta and TikTok for advertising as a "sale" or "share." You can opt out at any time by declining the App Tracking Transparency prompt, by turning off tracking in Settings ▸ Privacy & Security ▸ Tracking (iOS), by turning analytics off in Profile ▸ Privacy Settings ▸ Manage Consents (iOS and Android), by deleting or resetting your advertising ID in Android Settings ▸ Google ▸ Ads, or by emailing help@peptade.com. Because the App is a native mobile application, browser-based Global Privacy Control (GPC) signals do not reach it; the App Tracking Transparency setting on iOS and the in-app analytics switch on Android are the equivalent opt-out mechanisms. We do not knowingly sell or share the personal information of anyone under 18, and we never sell or share your health, biometric, or facial-photo data for advertising.

10C. Consumer Health Data (Washington, Nevada, Connecticut, and Similar Laws)

Much of the data described in this policy — including your profile, personalized stack, dose and injection logs, nutrition, sleep, hydration, exercise, body weight, side-effect log, COA records, and biometric data — is "consumer health data" under laws such as the Washington My Health My Data Act, Nevada SB 370, and the Connecticut Data Privacy Act. Our standalone Consumer Health Data Privacy Policy (https://www.peptade.com/consumer-health-data) is the full statement required by those laws. In summary:

What we collect and why: The categories listed in Section 2, for the purposes listed in Section 3 — providing the App's tracking, education, and personalization features, keeping it secure, and meeting legal obligations. Nothing else.
Sources and sharing: We collect this data from you (and from Apple Health, only if you connect it). It is shared only with the processors listed in Section 5 that need it to deliver a feature you used. We do not sell consumer health data, we do not use or share it for advertising, and we do not use geofencing anywhere.
Your rights: To confirm whether we collect consumer health data about you, to access it, to receive the list of third parties it has been shared with, to withdraw consent, and to have it deleted — including from our processors and from backups. Exercise these rights in the App's Privacy settings or by emailing help@peptade.com. If we deny a request, you may appeal as described in Section 8; if your appeal is denied, you may contact your state Attorney General.

10D. EEA/UK Complaints and International Data Transfers

If you are in the European Economic Area, United Kingdom, or Switzerland, you also have the right to lodge a complaint with your local data protection supervisory authority (or the UK Information Commissioner's Office), though we would appreciate the chance to address your concerns first at help@peptade.com.

Data Transfers: Peptade's infrastructure is hosted on Supabase (powered by Amazon Web Services) in the United States. If you are located in the European Economic Area, United Kingdom, or Switzerland, your data is transferred to the United States for processing. These transfers are conducted under Standard Contractual Clauses (SCCs) as approved by the European Commission (and the UK Addendum/IDTA where applicable), which provide appropriate safeguards for your data.

11. Apple Health

Connecting Apple Health is optional and available on iOS only; there is no Health Connect or other health-platform integration in the Android App. If you connect Apple Health, the App may:

Read metrics such as steps, active and basal energy, exercise minutes, distance, body weight, hydration, dietary energy, heart rate, and sleep, to display alongside your tracking.
Write values you log in the App — such as body weight, hydration, and nutrition (calories and macronutrients) — back to Apple Health so your data stays in one place.

Apple Health data is processed to power the App's own tracking features. Data read from Apple Health is handled on your device and, where it feeds features that sync to your account (such as daily activity, imported weight, sleep, and nutrition), is stored with your other tracking data under the same protections described above. We do not store Apple Health data in iCloud, we never write false or inaccurate data into Apple Health, and we do not share Apple Health data with advertisers, insurers, employers, data brokers, or any third party beyond the service providers listed in Section 5 — and never for advertising, marketing, or data-mining. We never sell it. You can disconnect Apple Health at any time in the app's settings; because iOS does not allow apps to revoke Health permissions programmatically, disconnecting stops further reading/writing from within the App, and you can also manage permissions in the iOS Health app.

12. Peptide Information and Health Data Disclaimer

IMPORTANT: PLEASE READ THIS SECTION CAREFULLY. IT DESCRIBES HOW PEPTADE HANDLES HEALTH-RELATED DATA AND THE LIMITATIONS OF THE INFORMATION PROVIDED BY THE APP.

12A. Nature of the Service

Peptade is a peptide-tracking, record-keeping, and education application that lets you track compounds, doses, and lifestyle habits, look up compounds in a research library, and — if you run the generator — lists compounds matched to your self-reported goals from your profile and a single facial photo. It is not a medical service, diagnostic tool, or clinical platform, is not a "covered entity" or "business associate" under HIPAA, and does not produce a health or facial score.

12B. The Personalized Stack Is Not Medical Advice

The personalized stack is a reading list, not a protocol: it names compounds whose regulatory status or published research relates to your selected goals and contains no dose, schedule, cycle, or instruction to take anything. It is NOT medical advice, a clinical directive, a prescription, or pharmaceutical guidance. It is not based on medical diagnoses, laboratory results, physical examinations, or clinical evaluations of any kind. The App does not diagnose, treat, cure, or prevent any disease or medical condition.

Your stack is shown in two separate sections: FDA-approved prescription medicines whose approved indication has been matched to a goal you selected — chosen by a database rule, not by an AI model — and, hidden behind a disclosure you must reveal deliberately, compounds that are not approved by any regulatory authority, which an AI model selects from the catalog's research-eligible entries. See the Medical & Health Information Disclaimer, Section 3, for what distinguishes them.

12C. Peptide Catalog and Evidence

The Peptade catalog contains peptides — naturally occurring amino acid chains or synthetic analogs — together with a number of related non-peptide compounds. Each entry carries its FDA regulatory status and, where not approved, an evidence label: "Established Research", "Emerging Research", or "Experimental" (reference only). These labels describe the research, not the compound's safety or effectiveness. The regulatory status of individual compounds varies by jurisdiction, and it is your responsibility to verify legality in your location.

12D. Educational Information and Manual Tracking

The research library and PepBot do not provide dose amounts, ranges, application frequencies, titration schedules, cycle lengths, preparation instructions, concentration conversions, injection volumes, syringe-unit calculations or half-life estimates for any compound, including FDA-approved medicines. Regulatory status and educational research information remain available. Medication decisions belong with a licensed healthcare professional.

Peptade has no medication preparation calculator or estimated drug-level chart. The remaining nutrition calculator estimates calorie and macro targets from your profile.

You can manually record your existing plan: compound identity and administration route, total and remaining supply, fixed dose or user-entered titration steps, doses per day, schedules, cycles, dates and notes. Peptade does not choose or adjust these values. Reminders and inventory displays are bookkeeping aids derived from your entries, not medical instructions.

12E. Injectable Peptides and Injection-Site Tracking

Injectable peptides carry additional risks compared to topical or oral peptides. If you are considering using any injectable peptide, you must consult with a licensed physician before purchasing, reconstituting, or administering any injectable product, regardless of whether a prescription is required in your jurisdiction. The App's injection-site (body-map) tracker is a self-tracking log for your own reference only and is not injection instruction.

12F. Health Profile and Tracking Data Usage

Health-related data collected by Peptade (including your profile, sleep, hydration, nutrition, exercise, body weight, dose logs, side-effect log, and any Apple Health metrics) is used exclusively to power the App's tracking features and to personalize the stack. This data is not used for medical diagnosis, clinical assessment, health-risk evaluation, or any purpose that would constitute the practice of medicine. Peptade does not share health data with insurers, employers, or any third parties beyond the service providers listed in Section 5.

12G. AI Assistant

The in-app AI assistant sends your messages and the structured snapshot described in Section 4 through OpenRouter to OpenAI. Its responses may be inaccurate and are not medical or dietary advice. PepBot provides educational research information, app navigation and summaries of supported records. It does not calculate or recommend medication amounts or provide preparation, administration or half-life guidance, including for FDA-approved medicines. It does not recommend starting, stopping, obtaining or adjusting a compound, assess COA documents, or identify sellers. Questions outside this scope are directed to a licensed healthcare professional.

12H. Custom (User-Defined) Compound Entries

The App allows you to add custom compounds that are not present in the Peptade catalog. When you do so, the compound name and administration method you enter are stored as user-generated content. Peptade does not pre-validate, attest to, recommend, or evaluate the safety, identity, legality, or accuracy of any custom entry. Custom entries are never placed in a personalized stack. You are solely responsible for the legality, identity, and clinical appropriateness of any custom entry, and you must not enter content that is illegal in your jurisdiction, that misrepresents a controlled substance, or that violates these terms or the Medical Disclaimer. Peptade reserves the right to remove custom entries that violate these terms.

12I. User Responsibility

You assume full responsibility for any health decisions made based on information provided by the App. You agree to consult a qualified healthcare provider before beginning, modifying, or discontinuing any peptide regimen, and to consult a licensed physician before using any injectable peptide. Reminders are local notifications that can be delayed or missed and must not be relied on as a safeguard against a missed or duplicated dose. See the full Medical & Health Information Disclaimer (available within the App and at https://www.peptade.com/medical-disclaimer) for complete terms.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy within the App or on our website and updating the Effective Date above. Where applicable law requires your consent before a change applies to data we already hold, we will obtain it first. Your continued use of Peptade after changes constitutes acceptance of the updated policy.

14. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us at help@peptade.com.

Related documents: Consumer Health Data Privacy Policy (https://www.peptade.com/consumer-health-data) · Delete Your Data (https://www.peptade.com/delete-your-data) · Terms of Service (https://www.peptade.com/terms) · Medical & Health Information Disclaimer (https://www.peptade.com/medical-disclaimer) · Refund Policy (https://www.peptade.com/refund-policy)