Privacy Policy

Last updated: 2026-10-27

WHO WE ARE

Peptidly is a personal peptide cycle tracker operated by Peptidly. This Privacy Policy explains what data Peptidly collects, why we collect it, who we share it with, and the rights you have over your information.

WHAT WE COLLECT

Account information
- Your email address
- (If you sign in with Google) your Google account identifier, and the email address, name and profile picture that Google shares with us
- A display name, if you set one
- Account activity records kept by our authentication system: when you signed up and signed in, when the app renewed your session, when you reset your password or signed out, the IP address the app most recently connected from, and a short technical description of the app or browser it used

Health and tracking data
- The peptides and compounds you choose to track, with their doses, schedules and notes
- Vial and stock inventory: item names, vial size, BAC water volume, how many vials you have and how much remains (including a record of each change), opened and expiry dates, and any notes you add
- Cycle plans: name, start and end dates, status (for example paused or completed, and why you paused), any notes you add, and each compound's frequency and scheduled injection times
- Dose logs: which dose, when it was scheduled, whether it was taken or missed (the app records missed doses automatically), when it was taken and how it was logged, the amount and the vial it came from, the injection site, and any note you add
- Your injection-site history and cycle journal entries
- Emergency information, if you add it: the text you enter, which may include medical conditions and an emergency contact's name and phone number. Only add someone else's details if they are happy for you to do so.
- Your app preferences and notification settings, such as units, quiet hours, language, and whether the biometric lock is on. Your fingerprint or face data never reaches the app: it is only told whether the check succeeded and which kinds of unlock your phone supports.

Feedback you send us
- When you use "Send feedback", we store your message, the type you chose, the app version, and your phone model and Android version.
- Messages you send us by email, and our replies, are kept in our mailbox.
- Notes we make while answering your messages or investigating a problem can include your email address and what you told us.

Technical data
- A device record: when you open or return to the app while signed in, it normally updates a record linked to your account, holding a random ID for this installation of the app, the platform, your Android version (API level), the app version and build, and when the record was created and last updated. The installation ID stays the same until the app is uninstalled or its storage is cleared, even if you sign out or another account signs in on the same phone.
- Request logs: our hosting provider (Supabase) keeps logs of each request made to our servers, by the app, by our unsubscribe page and by links in our emails, for a limited period (currently about 90 days). They include the IP address and the approximate location it suggests (country, region and city, and for some requests a postal code and time zone), the network provider, a short technical description of the app or browser, your account ID, the address requested, and, for sign-in, account and unsubscribe requests, your email address and, if you signed in with Google, your name.
- Usage and performance events, if "Share usage data" is on (see USAGE AND PERFORMANCE below)
- Error and crash reports (see Sentry under THIRD PARTIES WE SHARE WITH below)

What we do NOT collect
- Your location from GPS or your phone's location services (the app never asks for location permission)
- Your contacts or photos. The only file of yours the app reads is a backup file you choose to import.
- Advertising identifiers
- Browsing history
- Biometric identifiers
- Any data from other apps on your device

HOW WE USE YOUR DATA

We use your data to:
- Provide the app: showing your cycles, scheduling reminders, deducting from your vial inventory when you log a dose, computing your supply forecast, and synchronizing your records across devices
- Keep the app working: finding the cause of errors and sync problems, knowing which app versions are in use, and checking that a new version works well before it reaches everyone
- Improve the app, using usage events if "Share usage data" is on
- Email you: account emails such as sign-up confirmation and password reset, replies to messages you send us, and occasionally a request for feedback or a review of the app. Those occasional emails include an unsubscribe link.

We do NOT use your data for advertising or behavioural advertising, and we never sell it. We make a few simple automated choices from your activity: for example, the app may invite you to rate it once you have logged every scheduled dose on seven dosing days in a row, and an emailed request for a review goes only to people with dose records (taken or missed) added in the last 45 days.

If we add an option to receive product-update emails and you opt in, we will use your email address only to send you occasional feature-launch and product-update announcements — never for profiling, behavioural advertising, sale, or brokering — and you can withdraw that consent at any time with the unsubscribe link in any of those occasional emails, which puts your address on our do-not-email list, or by contacting us.

USAGE AND PERFORMANCE

If "Share usage data" is on, the app records which screens and features you use — for example "opened the calculator" or "logged a dose" — and a few facts about how the app itself is running: for example, how long a slow sync took, the rough size of the app's local database and of its queue of changes waiting to sync, and why the app last closed (such as "app updated" or "low memory"). This setting is on by default.

Each event carries your pseudonymous account ID, a random ID for the current app session, the time it was recorded, the app version and build, the language the app is set to, and the event's name and details. The details are fixed categories, yes-or-no values, small counts and rounded ranges: for a logged dose, for example, whether it was early, on time or late. They never include compound names, dose amounts, notes, or anything you type.

These events are stored in our own database on Supabase (EU) and are not given to advertisers or analytics companies. We use them to improve the app, to spot sync problems, and to check new app versions before releasing them to everyone.

You can turn this off at any time in Settings → Account → "Share usage data". Turning it off stops the device you change it on straight away, and your other devices once the change reaches them; a phone where you have just signed in may send some events before it receives your setting. Events already stored are kept until your account is deleted. In app versions before 1.20.26, the facts about how the app is running were sent with our error reports instead (see Sentry below) and did not follow this setting.

Separately from this setting, automated checks on our servers look at your synced records (such as doses, vials and compounds), your device record and your account activity to find sync and data problems. When a check finds something to look at, our error-reporting provider (Sentry) receives the kind of problem, counts, app build numbers and the first eight characters of the affected account IDs, never a full account ID or your email.

WHERE YOUR DATA IS STORED

Your app data lives in two places:

1. Locally on your device, in the app's private storage, which other apps cannot read. Peptidly does not add its own encryption to this database; it relies on your phone's built-in storage encryption. The app's data is excluded from Android's cloud backup.

2. On our cloud backend hosted by Supabase, in the West EU (Ireland) region. Data is encrypted in transit (TLS) and at rest (Supabase managed encryption). Row-level security policies ensure that, through the app, only your signed-in account can read or write your records. Our own administrators can access the database to run and support the service.

Error reports, emails, our notes and the other copies described under THIRD PARTIES WE SHARE WITH are held by those providers. Sentry stores error reports in its EU data region. Some providers may process data outside the UK and EU: Google, Resend, GitHub, Umami, ImprovMX, Microsoft, Anthropic and OpenAI, and also Supabase and Sentry for support, security and running their services, even though they store our data in the EU.

THIRD PARTIES WE SHARE WITH

- Supabase (database and authentication provider) — receives all your account and tracking data so we can sync it across devices and provide cloud backup.
- Google Sign-In (only if you choose to sign in with Google) — Google processes your sign-in identity for authentication.
- Sentry (error and crash reporting) — when the app hits an error, crashes, or does not start properly, it sends Sentry a technical report. The report says what went wrong and where in the code, and includes your pseudonymous account ID, a random ID for this installation of the app, device details (such as manufacturer and model, Android version, memory, storage and battery state, screen size, network type, language and time zone, and which app permissions are granted), the app version, and a trail of recent technical steps, such as the screens opened and the requests the app made to our servers. Reports are designed to leave out compound names, notes and your email, but a report about a problem with one of your records can include that record's ID and some of its numbers, such as a vial's stock count or remaining amount. When the app does not start properly, the report can also include how many records of each kind are stored on your phone and the size of its database, never their contents. The app also sends Sentry a short record each time it is opened, used to count sessions that ended in a crash, and short notes about a few account and repair steps, such as whether an email confirmation or a password reset went through. Sentry can see the network address your phone connects from; we have set Sentry not to store that address or the approximate location it suggests. App versions before 1.20.26 also put your email address in these reports, sent timings for about one in ten screen loads, and sent the facts about how the app is running described under USAGE AND PERFORMANCE; we have set Sentry to remove email addresses before it stores a report. Error reporting does not follow the "Share usage data" setting, because we need it to keep the app working. The "Send diagnostics" and "Contact support" buttons on the app's recovery screen also send a report this way.
- Resend (email delivery) — receives your email address, and your first name when we have it, so it can deliver the emails we send you, including account emails. Resend records whether you click a link in those emails. Our emails load their fonts from Google Fonts, so your email app may contact Google when it shows one.
- ImprovMX (email forwarding) — passes the emails you send to hello@peptidly.co.uk on to our mailbox, which is hosted by Google.
- Anthropic and OpenAI (AI assistants) — we use AI assistants (Anthropic's Claude and OpenAI's Codex) to help us investigate problems and answer support messages. They can see the data involved in that work, such as error details, records from our database or the text of your message, and they keep working records of it.
- Microsoft (OneDrive) — stores our working notes, which can include your email address and what you told us when you contacted us.
- Google Play In-App Review — when the app invites you to rate it, Google shows its own rating window. The app is not told whether or how you rated it.
- GitHub Pages (hosts our website, peptidly.co.uk) — when you open our website, including the privacy policy and the unsubscribe page, GitHub receives standard web request information such as your IP address. The unsubscribe link in our emails includes your email address so that the page can process your request.
- Umami (visit statistics for our website, not the app) — the home page and the calculator page at peptidly.co.uk load Umami's script, which reports each visit, and each click on one of our Google Play links: the page address, the page that linked to it, the type of browser and device, your browser's language and screen size, and an approximate location. We use these statistics only to see how the site is used and to improve it. Umami uses your IP address to work out the location and, with your browser details, to make a code that groups your visits within a month as one visitor; the code changes every month. The statistics hold that code, not the address, though Umami and its hosting providers may keep the address in their security logs. It sets no cookies and never receives anything you type into the calculator. Umami is based in the United States and keeps these statistics for a limited period set by our Umami plan. To stop being counted, use the "Don't count my visits" button at the foot of those pages; it saves a setting in your browser that Umami's script checks before sending anything, and the same button turns counting back on.
- Google Play Billing (only if you buy the optional paid upgrade) — Google acts as the merchant of record and processes your payment. Peptidly never sees or stores your card number or payment details. We keep only a purchase record: the order ID, a purchase token, the product purchased, its status, the purchase date, and the platform (Google Play). This same record is included in your JSON data export.

We do NOT share your data with advertisers, data brokers, or analytics vendors (Umami, above, counts visits to our website and receives nothing from the app), and we never sell, rent, or broker your personal data. If you have opted in to product-update emails, that consent only lets us email you directly about the app — it does not involve sharing your data for anyone else's marketing. (We do not offer product-update emails yet; this applies once we do.)

YOUR RIGHTS

You can:
- See and correct your records in the app, on the screens you use to manage them
- Export your data as JSON via Settings → Data → Export. The export is always free and includes your cycles, compounds, vials and stock, dose logs, notification settings, profile and entitlement records (what you have purchased). It does not yet include journal entries, injection-site history, preferences (including emergency information), feedback, usage events, device records, your account and sign-in details, records of the emails we have sent you, the history of changes behind your vial and stock counts, or most items you have deleted (deleted dose logs are included, marked as deleted): email us for a copy of those.
- Turn off usage data via Settings → Account → "Share usage data"
- Unsubscribe from our occasional emails with the link in any of them
- Delete your account via Settings → Data → Delete account
- Contact us to exercise any other right you have over your data, including getting a copy of everything we hold about you

When you delete your account, you have 30 days to change your mind: signing in again, or opening the app on a phone that is still signed in, during that time cancels the deletion. After the 30 days, your account (your auth.users record) and the data linked to it, including usage events, device records and your entitlement records, are permanently deleted, normally within a day, except for the records listed under DATA RETENTION.

DATA RETENTION

We retain your data for as long as your account is active. When you delete an item in the app, we keep a deleted copy so that your other devices remove it too; these copies can be kept until your account is deleted. When you delete your account, your account and the data linked to it are removed as described above, except for the records listed below.

These records are kept after deletion:
- Feedback you sent through the app is kept, no longer linked to your account. The message and our notes about it stay as written, so if they mention you, they still do. If you want your feedback deleted as well, tell us before the 30 days are up; after that we can find it only from what it says.
- If you unsubscribed from our emails, we keep that on a do-not-email list so that we do not send you those occasional emails again, even if you sign up again later. While your account exists, the list holds your email address with a short note about your request. Once your account is deleted, the address is normally replaced within a day by a one-way code made from it (a SHA-256 hash). The code is not your address, but anyone who already knows your address can compute the same code and match it. Account emails you ask for, such as a password reset, are still sent.
- Our authentication system keeps a log of account activity (such as sign-ups, sign-ins, session renewals, password resets and sign-outs) that includes your email address and, if you signed in with Google, your name. It is stored in our database and is not deleted with your account; each entry is deleted automatically after about 90 days.
- Our hosting provider's request logs and our email provider's delivery records are kept for a limited period set by those providers.
- Error reports already sent to Sentry are kept until Sentry's retention period ends. Reports Sentry stored before we made the settings described above may still include your email address and approximate location until then.
- Monitoring records that contain only the first eight characters of an account ID are kept for about 90 days.
- Emails you exchanged with us stay in our mailbox, and our notes and our own copies of the AI assistants' working records are kept until we delete them. Ask us and we will delete them. Anthropic and OpenAI also keep their own copies for a period set by their terms, which we cannot shorten.
- If you were signed in on another phone, the copy of your data on that phone may stay there until you, or someone else, sign in on it again.
- Backups taken before the deletion may persist for up to 30 additional days before they are rotated out.

Purchase records are handled separately. Google, as the merchant of record, holds the underlying transaction records for any purchases you make. Our own copy of your entitlement is deleted together with your account as described above. We may also retain certain purchase-related records, such as an order ID and purchase date, for as long as required by applicable accounting or tax law, even after account deletion.

CHILDREN AND AGE OF CONSENT

Peptidly is not intended for use by anyone under the age of 18. Our Terms of Service require you to be 18 or over because of the nature of the content (peptide tracking) and the associated health risks; the app does not check your age. Although UK GDPR sets the digital age of consent at 13, our minimum age requirement of 18 is stricter and applies regardless of jurisdiction. We do not knowingly collect data from minors. If you believe a minor has created an account, contact us at hello@peptidly.co.uk and we will delete it promptly.

CHANGES TO THIS POLICY

If we change this Privacy Policy, we will update the "Last updated" date above. If a change is significant, we will also tell you about it, for example in the release notes of the app update. If you keep using the app after a change, the updated policy describes how we handle your data. Where a change needs your consent, we will ask for it first.

CONTACT US

If you have questions about this Privacy Policy or want to exercise any of your rights, contact us at:

hello@peptidly.co.uk