Privacy Policy

1. Introduction

PepPal ("we," "our," or "us") operates the PepPal mobile application (the "App"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our App.

By using PepPal, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the App.

2. Information We Collect

2a. Account Information

When you create an account, we collect:

• Email address
• Display name (optional)
• Authentication credentials (securely hashed; we never store plaintext passwords)

2b. User-Generated Content

When you use the App's features, you may voluntarily provide:

• Research cycle data: Peptide names, dosage amounts, frequency, duration, and research notes you enter in the Cycle Tracker
• Wellness journal entries: Self-reported energy, mood, sleep quality, recovery, training performance, and appetite ratings
• Chat messages: Questions and conversations with the AI research assistant
• Recommendation survey responses: Age, sex, weight, height, health background, goals, lifestyle, and preference data entered to receive personalized research recommendations

2c. Apple Health Data

With your explicit permission, PepPal may read the following data from Apple Health:

• Step count
• Active calories burned
• Sleep duration
• Heart rate

Apple Health data is read locally on your device and displayed in the App. We do not upload, store, or transmit Apple Health data to any server. This data is never shared with third parties. Access can be revoked at any time through your device's Health app settings.

2d. Automatically Collected Information

• Device information: Device model, operating system version, and app version (for crash reporting and compatibility)
• Usage data: Anonymous feature usage patterns to improve the App experience

We do not collect precise location data, contacts, photos, or any data beyond what is described above.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the App's features
• Authenticate your account and manage your subscription
• Power the AI research assistant with conversation context
• Generate personalized research protocol recommendations
• Display your wellness trends and research cycle progress
• Respond to support requests
• Detect and prevent fraud or abuse

4. Data Storage and Security

Your account data and user-generated content are stored securely using Supabase, a cloud database platform with:

• Encryption in transit (TLS/SSL)
• Encryption at rest (AES-256)
• Row-level security policies ensuring you can only access your own data
• SOC 2 Type II compliant infrastructure

Some data (such as saved recommendations and local preferences) is stored on-device using secure local storage and is not transmitted to any server.

While we implement commercially reasonable security measures, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

5. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information to anyone.

We may share information only in these limited circumstances:

• Service providers: We use Supabase for database hosting and authentication, and OpenAI/Anthropic for AI chat processing. These providers process data solely on our behalf and are bound by their own privacy policies and data processing agreements.
• Legal requirements: We may disclose information if required by law, regulation, legal process, or governmental request.
• Safety: We may disclose information when we believe it is necessary to protect the rights, safety, or property of our users or the public.

We do not use any third-party advertising SDKs or share data with advertising networks.

6. Your Rights and Choices

You have the following rights regarding your data:

• Access: You can view all your data within the App at any time.
• Correction: You can update your profile information in the Account section.
• Deletion: You can request deletion of your account and all associated data by contacting us at peptpal@gmail.com. We will process deletion requests within 30 days.
• Data portability: You can request an export of your data by contacting us.
• Withdraw consent: You can revoke Apple Health access at any time through your device's Settings > Health > Data Access.

7. Children's Privacy

PepPal is intended for users aged 18 and older. We do not knowingly collect personal information from anyone under the age of 18. The App includes an age verification gate at first launch. If we become aware that we have collected data from a user under 18, we will promptly delete that information.

8. Data Retention

We retain your data for as long as your account is active or as needed to provide services. When you delete your account:

• Your personal data is permanently deleted within 30 days
• Chat conversation history is permanently deleted
• Anonymized, aggregated usage statistics may be retained (these cannot identify you)

9. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place for such transfers in compliance with applicable data protection laws.

10. Third-Party Links

The App may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

11. California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information we collect and how it is used
• Right to request deletion of your personal information
• Right to opt out of the sale of personal information (we do not sell personal information)
• Right to non-discrimination for exercising your CCPA rights

12. European Residents (GDPR)

If you are a resident of the European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR), including the right to access, rectify, erase, restrict processing, data portability, and the right to object to processing. Our legal basis for processing your data is your consent (provided at account creation and through the age gate) and the performance of our service contract with you.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy in the App and updating the "Last Updated" date above. Your continued use of the App after changes constitutes acceptance of the updated policy.

14. Medical Disclaimer

PepPal is a research and educational reference tool. It does not provide medical advice, diagnosis, or treatment recommendations. All content is for informational purposes only. Always consult a qualified healthcare professional before making any health-related decisions. PepPal does not recommend, endorse, or encourage the use of any substance.

15. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at:

Email: info@peppal.io