PEPTADE

Privacy Policy

Effective Date: July 10, 2026

Contact: help@peptade.com

1. Who We Are

Peptade ("we", "our", "us") operates the Peptade mobile application. For questions about this policy, contact us at help@peptade.com.

2. Information We Collect

We collect the following categories of information:

• Account information: Email address and authentication identity from Sign in with Apple or Sign in with Google. We do not collect or store a password.
• Profile data: Age / date of birth, gender, height, weight, activity level, physique level, self-reported improvement goals (such as weight management, muscle growth and recovery, cognitive performance, longevity, immune support, hair growth, skin and facial goals, and others), and optional profile details such as a display name, username, avatar photo, daily step goal, and typical bedtime.
• Facial photo: A single front-facing selfie you optionally provide during peptide stack generation, used to tailor your peptide suggestions (see Section 4 and Section 4A). No facial score or rating is produced for or shown to you.
• Biometric data: Facial geometry and characteristics derived from your facial photo by our AI systems, used solely to help tailor peptide suggestions (see Section 4A).
• Peptide stack and dosing data: Your selected compounds, dosing preferences, dose completion records, schedules, cycles, and stack history.
• Personalized dosing and inventory data: User-supplied values you choose to enter when personalizing a compound, including total amount in your vial/bottle/tube, remaining amount, bacteriostatic water (BAC water) volume, reconstitution date, dosing mode (fixed or titration), fixed dose amount and unit, multi-step titration schedules, doses per day, cycle start/end dates and on/off patterns, half-life and peak-time values, and free-text notes. All personalization fields are optional.
• Injection and dose logs: When you log a dose, we store the compound, amount and unit, time, and — optionally — the injection site, body side, an approximate on-body location you tap on a body map, a pain level, and notes.
• Custom (user-defined) compound entries: If you add a compound that is not in the Peptade catalog, the name you enter and the administration method you select (oral, topical, or injectable) are stored alongside your stack data. This is user-generated content; Peptade does not pre-validate or attest to the identity, legality, or safety of any custom name you enter.
• Nutrition and meal data: Food entries you log — food names, portion estimates, calories, macronutrients, and micronutrients — plus any saved foods and meals. To identify food, you may capture a meal, menu, or barcode photo; these images are sent to our AI provider for identification only and are not retained as stored images by the App.
• Sleep data: Logged or imported bedtime, wake time, sleep duration, self-rated sleep quality, your typical (base) bedtime, and the derived Sleep Score and deep-sleep estimate.
• Hydration data: Water amounts you log and your hydration goal.
• Body weight data: Weight entries you log or import.
• Exercise and workout data: Workout sessions, exercises, and sets (reps, weight, unit), plus the derived muscle-recovery map.
• Activity data: Steps, active/basal energy, exercise minutes, distance, and heart-rate metrics — imported from Apple Health only if you connect it (see Section 11).
• AI assistant data: The messages you send to the in-app AI assistant, together with a snapshot of your own in-app data (such as your profile, stack, recent dose logs, and recent tracking) that is sent to a third-party AI provider to generate a response (see Section 4).
• Wellness check-ins: Optional self-reported energy, sleep, mood, and side-effect notes. These are stored on your device only and are not uploaded to our servers.
• Device and usage data: Device type, operating system, app version, and crash/error diagnostics from our backend services.
• Advertising and measurement data: To measure and improve our advertising, we and our advertising partner Meta Platforms (Facebook) collect app-event data (such as app installs, app opens, completed sign-ups, and subscription purchases) and, only if you allow tracking via the App Tracking Transparency prompt, your device's advertising identifier (Apple's IDFA) and related attribution data. For users who decline tracking, iOS measurement is performed only in aggregate through Apple's SKAdNetwork. We also use a product-analytics service (PostHog) to understand in-app usage. See Section 5A.

2A. Information Collected Before You Create an Account

Peptade lets you complete onboarding and purchase a subscription before creating an account. During this stage we associate the onboarding answers and app activity on your device with a randomly-generated, device-local anonymous identifier — not your name or email. When you later create an account or sign in, that anonymous information (such as your onboarding profile) is linked to your account so your experience and subscription carry over. If you never create an account, the device-local data remains on your device and is not associated with an identified user; clearing the app or device removes it. Payment is processed by Apple and is governed by Apple's policies (see Section 5).

3. How We Use Your Information

• Service delivery: Providing peptide recommendations, the personalized stack, compound and dose tracking, injection-site history, the research library, calculators, and the lifestyle tracking features (sleep, hydration, nutrition, exercise, and body weight).
• AI-powered personalization: Processing your facial photo and profile data through AI models to tailor which peptides are suggested and to explain why. This is algorithmic personalization based on your self-reported profile — not clinical diagnosis or medical assessment, and it does not produce a score shown to you.
• AI assistant: Sending your question and a snapshot of your own in-app data to a third-party AI provider so the assistant can answer in context.
• Nutrition identification: Sending meal, menu, or barcode photos to our AI provider, and queries to a public nutrition database, to estimate foods and nutrients.
• Personalized stack tracking: Storing the personalization data you enter (cycle, supply amounts, BAC water volumes, dosing schedules, titration steps, doses per day, notes) so the App can display your configured doses, count down your remaining supply, drive reminders, and show simple injection-volume references derived arithmetically from the values you entered.
• Custom compound tracking: Storing the names and administration methods of any custom (non-catalog) compounds you add, solely so they appear in your tracker and dose log. Custom entries are not used to generate AI recommendations.
• Reminders: Scheduling local notifications on your device (dose reminders, and optional meal, water, sleep, and exercise reminders). These are generated on your device.
• Advertising and measurement: Measuring how our marketing performs — for example, which ads lead to installs, sign-ups, and subscriptions — and improving and optimizing our advertising. This uses app-event data and, only with your permission, your advertising identifier (see Section 5A). We do not use your health, biometric, facial-photo, or dose/tracking data for advertising.
• Security: Detecting fraud and abuse, rate-limiting AI services, and ensuring platform integrity.

4. How AI Features and Photos Are Handled

Peptade uses third-party AI services to power several features. All AI requests are made from our secure Supabase backend — your device does not contact AI providers directly.

• Facial photo analysis: During stack generation, your single front selfie is uploaded to our secure storage and sent (via OpenRouter to OpenAI's vision models) for analysis that helps tailor your peptide suggestions. No facial score, rating, or aesthetic assessment is generated for you or shown to you — only the suggested peptides and their rationales are surfaced.
• Recommendations and rationales: Your profile data and the analysis results are processed by AI models to generate personalized peptide recommendations and the "why" rationale for each.
• AI assistant ("Pep AI"): Your messages and a snapshot of your own in-app data are sent to a third-party AI provider (via OpenRouter) to generate responses.
• Food, menu, and barcode identification: Photos you capture for the nutrition features are sent to our AI provider for identification and estimation only, and are not retained as stored images.
• Real-time processing: AI providers process this data in real time to return the requested result and do not retain it for their own purposes or use it to train their models, per our processing arrangements with them.

4A. Biometric Data Collection and Use

When you provide a facial photo, Peptade's AI systems extract facial geometry and characteristics from that image. Under applicable state laws (including the Illinois Biometric Information Privacy Act and the Texas Capture or Use of Biometric Identifier Act), this extracted facial geometry constitutes biometric data.

Purpose. Biometric data is collected solely to help tailor your personalized peptide suggestions. It is not used for medical diagnosis, clinical assessment, or any purpose outside of the App's peptide recommendation feature, and it is never surfaced to you as a score, rating, ranking, symmetry measurement, face-shape result, or "aesthetic dimension."

Face data is not used for facial recognition, identity verification, user authentication, behavioral profiling, advertising, sale to third parties, or training third-party AI models. The App does not match your face against any database of identities.

Retention. The original facial photo file is automatically deleted from our servers after 90 days. Any biometric data derived from it is retained only for the duration of your active account. Upon account deletion or withdrawal of AI-data consent, all remaining biometric data — including any source photo not yet purged — will be permanently deleted from our systems within 30 days.

Disclosure. We do not sell, lease, trade, or otherwise profit from your biometric data. It is shared only with the AI service providers listed in Section 5 (OpenRouter/OpenAI) for the sole purpose of generating your analysis, processed in real time without permanent storage by those providers, and is not used for model training.

Consent. By agreeing to AI data processing during onboarding and before stack generation, you provide your informed written consent to the collection, use, and storage of your biometric data as described in this section. Providing a facial photo is optional, and you may withdraw your consent at any time through the app's Privacy settings; you may also delete your account or your data at any time (see Sections 7 and 8).

5. How We Share Information

We share data only with service providers necessary to operate the App:

• Supabase: Database hosting, authentication, file storage, and server-side functions (US region).
• OpenRouter / OpenAI: AI-powered facial-photo analysis, peptide recommendations and rationales, the in-app AI assistant, and food/menu/barcode identification.
• RevenueCat: Subscription and payment management. RevenueCat receives your account identifier and Apple purchase information to manage entitlements.
• Sentry: Error and crash monitoring for our backend services. Diagnostic events may be associated with your account identifier; we configure Sentry not to collect additional personal information.
• Nutrition and product data providers: A public nutrition database (such as USDA FoodData Central) for food and nutrient lookups, and a product database for barcode lookups.
• Apple: For Sign in with Apple, the App Store (billing), and — only if you connect it — Apple Health (see Section 11).
• Google: For Sign in with Google, if you choose it.
• Meta Platforms, Inc. (Facebook): We share app-event data (such as app installs, opens, completed sign-ups, and purchases) and, only where you have allowed tracking, your device advertising identifier and related attribution data, so Meta can measure and help optimize our advertising campaigns. See Section 5A.
• PostHog: A product-analytics service that helps us understand how the App is used so we can improve it. Usage events may be associated with your account identifier.

We do not sell your personal information for money. The App includes an advertising-measurement SDK (Meta) and a product-analytics SDK (PostHog); what they collect and how you can opt out is described in Section 5A. Our sharing of advertising-identifier and app-event data with Meta for advertising may qualify as a "sale" or "share" under some U.S. state privacy laws — see Section 10 for how to opt out. We never share your health, biometric, facial-photo, or peptide/dose data for advertising.

5A. Advertising, Analytics, and Your Tracking Choices

To run and measure our advertising, Peptade uses the Meta (Facebook) SDK. It records standard app events — installs, app opens, completed sign-ups, and subscription purchases — and reports them to Meta so we can see which ads work and optimize our campaigns.

• App Tracking Transparency (your choice). After onboarding, iOS shows an "Allow Peptade to track…" prompt. If you allow it, Meta may use your device advertising identifier (IDFA) for person-level measurement. If you decline, no advertising identifier is used, and measurement happens only in aggregate through Apple's SKAdNetwork. You can change your choice anytime in Settings ▸ Privacy & Security ▸ Tracking.
• What Meta receives. App-event data and, only with your permission, the IDFA and related attribution data. Meta does not receive your health data, facial photo, biometric data, dose or injection logs, or the contents of your in-app tracking. Meta's handling of the data it receives is governed by the Meta Privacy Policy.
• Product analytics. We use PostHog to understand in-app usage (such as screens viewed and features used), associated with your account identifier. This is first-party analytics and is not used for cross-app advertising. You can opt out of analytics anytime in the App's Privacy settings.
• No sensitive-data advertising. We never use or share your health, biometric, facial-photo, or peptide/dose data for advertising or cross-app tracking of any kind.

6. Data Security

• All data is transmitted over HTTPS/TLS encryption.
• Row-level security (RLS) policies ensure users can only access their own data.
• Rate limiting prevents abuse of AI services.
• Photos are stored in private Supabase Storage buckets.
• Authentication tokens are stored in the device secure storage (iOS Keychain).

7. Data Retention

We retain your data for the duration of your active account, with one exception: facial photo files are automatically deleted from our servers after 90 days to minimize data storage. Your peptide stack history, dosing records, tracking data, and other derived data remain available for the life of your account.

Upon account deletion, all remaining personal data — including profile information, any remaining photos, biometric data, scan results, peptide stacks, dosing records, injection logs, tracking data, and associated records — will be permanently deleted from our primary systems within 30 days. Backup copies may persist in encrypted backups for up to 90 days before automatic purging.

The App also offers a "reset data" option that deletes your tracking data while keeping your account and subscription. You may request deletion of all your data at any time through the App's Profile/Privacy settings or by contacting us at help@peptade.com. Any active App Store subscription must be cancelled separately through your Apple ID.

8. Your Rights

You have the right to:

• Access your personal data stored in the App.
• Correct inaccurate profile information.
• Delete your account and all associated data, or reset your tracking data while keeping your account.
• Data portability: Request an export of your data.
• Withdraw consent for AI data processing, and disconnect Apple Health, at any time in the app's settings.

9. Children's Privacy

Peptade is intended solely for adults. You must be at least 18 years of age to create an account or use the App, and the App is not directed to children. We do not knowingly collect personal information from anyone under 18. If we learn we have collected personal data from a person under 18, we will promptly delete it. A parent or guardian who believes a minor has provided personal information to Peptade may contact us at help@peptade.com to request deletion.

10. California / GDPR Rights

If you are a California resident, you have additional rights under the CCPA, including the right to know what personal information we collect and to request its deletion, and the right not to be discriminated against for exercising those rights. If you are in the European Economic Area, you have rights under GDPR including data access, rectification, erasure, and restriction of processing. To exercise these rights, contact us at help@peptade.com.

Opt out of "sale" or "sharing" for advertising. Some U.S. state laws (such as the CCPA/CPRA) treat our sharing of advertising-identifier and app-event data with Meta for advertising as a "sale" or "share." You can opt out at any time by declining the App Tracking Transparency prompt, by turning off tracking in Settings ▸ Privacy & Security ▸ Tracking, or by emailing help@peptade.com. We do not knowingly sell or share the personal information of anyone under 18, and we never sell or share your health, biometric, or facial-photo data for advertising.

Data Transfers: Peptade's infrastructure is hosted on Supabase (powered by Amazon Web Services) in the United States. If you are located in the European Economic Area, United Kingdom, or Switzerland, your data is transferred to the United States for processing. These transfers are conducted under Standard Contractual Clauses (SCCs) as approved by the European Commission, which provide appropriate safeguards for your data. By using Peptade, you acknowledge this transfer.

11. Apple Health

Connecting Apple Health is optional. If you connect it, the App may:

• Read metrics such as steps, active and basal energy, exercise minutes, distance, body weight, hydration, dietary energy, heart rate, and sleep, to display alongside your tracking.
• Write values you log in the App — such as body weight, hydration, and nutrition (calories and macronutrients) — back to Apple Health so your data stays in one place.

Apple Health data is processed to power the App's own tracking features. Data read from Apple Health is handled on your device and, where it feeds features that sync to your account (such as daily activity, imported weight, sleep, and nutrition), is stored with your other tracking data under the same protections described above. We do not share Apple Health data with advertisers, insurers, employers, or any third party beyond the service providers listed in Section 5, and we never sell it. You can disconnect Apple Health at any time in the app's settings; because iOS does not allow apps to revoke Health permissions programmatically, disconnecting stops further reading/writing from within the App, and you can also manage permissions in the iOS Health app.

12. Peptide Information and Health Data Disclaimer

12A. Nature of the Service

Peptade is a peptide-tracking and improvement application that suggests peptides based on your self-reported profile, improvement goals, and a single optional facial photo, and that lets you track compounds, doses, and lifestyle habits. It is not a medical service, diagnostic tool, or clinical platform, and it does not produce a health or facial score.

12B. Recommendations Are Not Medical Advice

All peptide recommendations generated by Peptade are informational guidance based on algorithmic matching between your profile and the known properties of peptides in our catalog. Recommendations are NOT medical advice, clinical directives, prescriptions, or pharmaceutical guidance. They are not based on medical diagnoses, laboratory results, physical examinations, or clinical evaluations of any kind. The App does not diagnose, treat, cure, or prevent any disease or medical condition.

12C. Peptide Catalog and Evidence

The Peptade catalog contains peptides that are naturally occurring amino acid chains or synthetic analogs. Each peptide is classified as either "Clinically Proven" (strong peer-reviewed evidence) or "Promising Research" (preliminary or emerging evidence). The regulatory status of individual peptides varies by jurisdiction, and it is your responsibility to verify legality in your location.

12D. Dosing, Personalization, Reconstitution, and Calculators

The App provides general dosing references, application frequency, reconstitution guidance for injectable peptides, a syringe reference, and reconstitution and nutrition calculators. All such information is educational and informational only — it is not a personalized dosing prescription. When you enter both a total peptide amount and a BAC water volume for an injectable, the App will display an injection-volume reference (for example, "Draw 0.10 mL"). This reference is calculated arithmetically from the values you entered — it is not a medically prescribed dose. Peptade does not verify the accuracy of values you enter and does not recommend changes to your titration schedule. Soft on-screen warnings (for example, that a vial reconstituted more than 30 days ago is past general shelf-life guidance) are general references, not medical instructions.

12E. Injectable Peptides and Injection-Site Tracking

Injectable peptides carry additional risks compared to topical or oral peptides. If you are considering using any injectable peptide, you must consult with a licensed physician before purchasing, reconstituting, or administering any injectable product, regardless of whether a prescription is required in your jurisdiction. The App's injection-site (body-map) tracker is a self-tracking log for your own reference only and is not injection instruction.

12F. Health Profile and Tracking Data Usage

Health-related data collected by Peptade (including your profile, sleep, hydration, nutrition, exercise, body weight, dose logs, and any Apple Health metrics) is used exclusively to power the App's tracking features and to personalize peptide recommendations. This data is not used for medical diagnosis, clinical assessment, health-risk evaluation, or any purpose that would constitute the practice of medicine. Peptade does not share health data with insurers, employers, or any third parties beyond the service providers listed in Section 5.

12G. AI Assistant

The in-app AI assistant sends your messages and a snapshot of your own in-app data to a third-party AI provider to generate responses. Its responses are informational only, may be inaccurate, and are not medical or dietary advice.

12H. Custom (User-Defined) Compound Entries

The App allows you to add custom compounds that are not present in the Peptade catalog. When you do so, the compound name and administration method you enter are stored as user-generated content. Peptade does not pre-validate, attest to, recommend, or evaluate the safety, identity, legality, or accuracy of any custom entry. Custom entries are not used to generate peptide recommendations. You are solely responsible for the legality, identity, and clinical appropriateness of any custom entry, and you must not enter content that is illegal in your jurisdiction, that misrepresents a controlled substance, or that violates these terms or the Medical Disclaimer. Peptade reserves the right to remove custom entries that violate these terms.

12I. User Responsibility

You assume full responsibility for any health decisions made based on information provided by the App. You agree to consult a qualified healthcare provider before beginning, modifying, or discontinuing any peptide regimen, and to consult a licensed physician before using any injectable peptide. See the full Medical & Health Information Disclaimer (available within the App) for complete terms.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy within the App or on our website. Your continued use of Peptade after changes constitutes acceptance of the updated policy.

14. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us at help@peptade.com.