Privacy Policy

Peptra is a personal tracking tool. It is not a medical service, and nothing in the app is medical advice.

The short version

• What you log (doses, compounds, vials, weight, check-ins) is stored in your account so the app can show it back to you. No other user can read it.
• We never sell your data, and we never share your health data with advertisers.
• To measure our ads, Meta and TikTok learn when the app is installed and opened, when an account is created, and when a trial starts or a subscription is bought — never your health data. On Android this is on until you turn it off; on iPhone it runs only if you allow tracking.
• Ask Pep sends your questions to Google only after you agree, and Apple Health or Health Connect is used only if you turn it on.
• You can delete your account and everything in it from inside the app, at any time.

1. Who we are

Peptra ("we", "us") is developed and published under the Wixpa name. For anything about your data, including requests under the law where you live, write to usmansgd42@gmail.com. We are responsible for the personal data described here.

2. What we collect

Your account

• Your email address and display name, used to create your account and sign you in.
• If you use Sign in with Apple or Google Sign-In, the name and email address that provider shares with us (with Apple this may be a private relay address).

What you log (health-related data you enter)

• Protocols and schedules you create, and the compounds you declare.
• Doses you log: compound, amount, time, injection site and any note you add.
• Vials you track: what is in them and how much is left, as you enter it.
• Weigh-ins, and a target weight and date if you set them.
• Daily check-ins, if you use them: mood, energy, sleep, tags and a note. Every question is optional.
• Peptides you save from the reference library.
• Your answers to the setup questions: goal, experience, cadence, compounds, target weight and how you heard about Peptra.
• Your Ask Pep conversations (section 4).

What you send us

• Ratings and feedback you choose to send in the app (stars, the reasons you pick and any text you write), with the app version, platform, language and the moment that asked. These never include your dose data or your name.
• Messages you send through Contact support, with the topic you pick, your account email, the app version, platform and language, so we can answer you.

Subscriptions and referrals

• Your subscription status and purchase history (section 6). We never see your card or payment details.
• If you use Refer a friend: your invite code, who invited you, and how many rewards you have earned (section 8).

Collected automatically

• Crash reports and performance data (app start time, screen rendering, network timings), so we can fix problems.
• Basic usage events (for example which screens are used, and steps of the referral flow) and session information. These events never contain a name, email, dose or health detail, and Firebase Analytics does not collect your advertising identifier.
• App Check tokens from Apple App Attest or Google Play Integrity, which prove requests come from the genuine app.
• If ad measurement is on: your device's advertising identifier and the five events listed in section 7.

Kept only on your device

• Preferences such as theme, language, units, recent searches, and your choices about Ask Pep sharing, ad measurement and reminders.
• Dose reminders, which are scheduled by your phone. They name the compound and dose; on a locked Android phone their content is hidden.
• Clinician reports (PDF or CSV) are made on your phone and go only where you send them with the share sheet. The copy the app makes is deleted at the next export, at sign-out and when you delete your account.

Device permissions

Peptra asks only for: notifications (reminders), exact alarms on Android (so reminders arrive on time), body weight in Apple Health or Health Connect (only if you turn sync on), and on iPhone, Apple's permission to track (ad measurement). It never asks for your location, contacts, photos, files, camera or microphone.

3. How we use it, and why we may

• To run the app for you — store your log, show your history, schedule and trends, sync it between your devices, and provide Pro if you subscribe. This is the service you asked for (performance of our agreement with you).
• Health-related data is processed only to show it back to you and to provide the features you choose. Where the law treats it as special-category data (for example the GDPR), we rely on your explicit consent, which you give by choosing to record it; you can withdraw it at any time by deleting the entries or your account.
• Ask Pep and Health sync run only with your consent, which you can withdraw in Settings.
• Ad measurement helps us understand which of our ads bring people to Peptra (our legitimate interest in promoting the app). On iPhone it runs only with your permission to track; on Android it is on by default. You can turn it off at any time in Settings (section 7).
• Crash reports, performance data, usage events, App Check and referral limits keep the app working, secure and fair, and help us improve it (our legitimate interests).
• Support messages and feedback are used to answer you and improve Peptra.
• Purchase records are kept as tax and consumer law require (legal obligation).

We never sell your data, we do not use your health data for advertising, and we do not build an advertising profile about you.

4. Ask Pep and Google Gemini

Ask Pep is an optional educational assistant powered by Google's Gemini models, provided by Google LLC.

When data is sent: only after you tap "Agree & continue" on the Ask Pep permission screen, which explains what is sent and to whom. Until then, nothing is sent. You can withdraw permission at any time in Profile → Settings → Ask Pep (AI) → AI data sharing; after that, nothing more is sent unless you agree again.

What is sent: the text of each question you type, plus up to the last 20 messages of your Ask Pep conversation so the assistant can follow the context.

What Gemini never receives: your name, email address, account ID, protocols, dose logs, weight entries, setup answers, or any other data from your account — unless you type it into a question yourself. Please don't include personal details in your questions.

The route: your question travels from the app to Peptra's Cloud Function on Google Cloud (Firebase), which forwards it to the Gemini API. The function also counts how many questions your account has asked, to apply daily limits, and, where Ask Pep is part of Pro, checks your subscription with RevenueCat using your account ID. If the function is unavailable, the app sends the question to Gemini through Google's Firebase AI Logic service instead. In every case the recipient of the question is Google.

How Google uses it: only to generate Pep's reply. Peptra uses Google's paid Gemini API service. Under the Gemini API Additional Terms of Service (https://ai.google.dev/gemini-api/terms), Google does not use prompts or responses from paid services to improve its products, and keeps them only for a limited period to detect abuse and meet legal requirements. Google processes this data under those terms, the Google Cloud and Firebase data processing terms, and the Google Privacy Policy (https://policies.google.com/privacy).

Your conversation history: Peptra saves your Ask Pep conversation in your account so you can scroll back. You can clear it at any time from the Ask Pep screen (trash icon), and it is deleted with your account.

5. Apple Health and Health Connect

Off until you turn it on in Profile → Settings. Peptra reads and writes body weight only — it never asks for any other kind of health data.

• When it is on, a weigh-in you record in Peptra is also saved to Apple Health or Health Connect.
• Weigh-ins from other apps or a smart scale are read only when you tap Import weigh-ins, and they are then stored in your Peptra account like any other weigh-in.
• Data from Apple Health or Health Connect is never used for advertising or shared with Meta, TikTok or any other third party.

You can turn sync off in Settings, and remove Peptra's access in the Health app or in Health Connect at any time.

6. Subscriptions (Peptra Pro)

Payments are handled entirely by Apple (App Store) or Google (Google Play); we never receive your card or payment details. We use RevenueCat, Inc. to manage subscriptions: it receives your Peptra account ID and the purchase records from the store (product, price, currency, dates, trial and renewal status), so the app knows whether you have Pro. Cancelling is done in your App Store or Google Play account; while you have a paid subscription, Profile → Settings → Manage or cancel subscription takes you there.

7. Ad measurement (Meta and TikTok)

We use the Meta (Facebook) and TikTok software development kits to measure whether our ads work. When ad measurement is on, they receive these events, together with your device's advertising identifier and basic device information (such as model, operating system and IP address):

• the app was installed;
• the app was opened;
• an account was created (and whether by email, Apple or Google);
• a free trial started;
• a subscription was bought (the plan, its price and currency).

Meta's software also records when each app session starts and ends, which tells Meta how long the app was open. Nothing else from the app is sent to either company.

They never receive your doses, compounds, weight, check-ins, protocols, Ask Pep questions, anything you type in the app, your email address or your phone number. Meta and TikTok process this data under their own privacy policies (Meta, TikTok).

Your choices: on Android, ad measurement is on from the first launch until you turn it off. Turn it off at any time in Profile → Settings → Data & privacy → Ad measurement; nothing more is sent after that. On iPhone it also runs only if you tap Allow on Apple's tracking prompt, which Peptra shows once after you sign in; you can change that answer in iOS Settings → Privacy & Security → Tracking. You can also reset or delete your advertising identifier in your phone's settings.

8. Refer a friend

Where Peptra Pro is sold, you can invite friends with a link or code. To apply the rules fairly (one reward per new account, limits on how many rewards one person can earn), we store your invite code, which account invited which, when, and the rewards granted. Rewards are granted through RevenueCat using your account ID. The referral screen shows counts only — never the names or emails of the people you invited, or of the person who invited you.

9. Who receives your data

We share data only with the providers that run Peptra for us, and only as described above:

• Google LLC — Firebase Authentication, Cloud Firestore, Cloud Functions, Hosting, Analytics, Crashlytics, Performance Monitoring, App Check, the Gemini API and Firebase AI Logic; Google Sign-In; Google Play billing; Play Integrity; Health Connect (on your phone).
• Apple Inc. — Sign in with Apple, App Store billing, App Attest, Apple Health (on your phone).
• RevenueCat, Inc. — subscription management and referral rewards.
• Meta Platforms and TikTok — ad measurement only, if it is on (section 7).

We may also disclose data if the law requires it, or to protect the rights and safety of our users or of Peptra. If Peptra is ever transferred to a new owner, this policy continues to apply to your data.

10. Where your data is stored

Your account and log are stored on Google Cloud servers in the United States (Firestore region nam5), encrypted in transit (TLS) and at rest. Security rules let only your signed-in account read or write your own data. On Android, the app's data is excluded from device backups and device-to-device transfer.

If you live outside the United States, your data is transferred there and to the other countries where our providers operate. We rely on the safeguards those providers offer for such transfers, such as the European Commission's Standard Contractual Clauses.

11. How long we keep it

• Your account, your log, Ask Pep conversations and their daily counter, feedback, support messages and referral records are kept while your account exists, and deleted when you delete it (section 12). One exception: if you invited someone, their account keeps a record that it was referred (without your account), so the same reward cannot be claimed twice.
• Purchase records held by Apple, Google and RevenueCat are kept as their policies and tax law require, even after you delete your account. Ask us if you want RevenueCat's record of your account deleted.
• Crash reports, performance data and usage events are kept for the retention periods set in Google's Firebase services, and are not tied to your name or email.
• Data received by Meta or TikTok is kept under their policies.

12. Deleting your account

In the app: Profile → Settings → Delete account → enter your password (if your account has one) → Delete forever. If you signed up with Apple or Google, you are asked to sign in with them once more to confirm.

This permanently deletes your profile and everything you have logged — protocols, doses, vials, weigh-ins, check-ins, saved peptides, Ask Pep conversations and feedback — as well as your support messages and referral records. It takes effect immediately and cannot be undone. Our servers delete your data a second time a little later, in case another phone that was still signed in tries to save something. If you cannot use the app, email usmansgd42@gmail.com from your account's email address and we will delete it for you.

Deleting your account does not cancel a subscription — cancel it in the App Store or Google Play first.

13. Your rights

Depending on where you live, you may have the right to access the data we hold about you, get a copy of it, correct it, delete it, restrict or object to how we use it, and withdraw consent at any time (this does not affect what happened before you withdrew it). Most of this you can do in the app: edit or delete any entry, export your log as a clinician report (a Pro feature where Pro is sold), turn off Ask Pep sharing, Health sync or ad measurement, or delete your account. For anything else, email usmansgd42@gmail.com; we answer within one month, and may ask you to confirm the request comes from your account's email address.

If you are in the European Economic Area, the United Kingdom or Switzerland, you can also complain to your local data protection authority.

California and other US states: we do not sell personal information. Sending app events and your advertising identifier to Meta and TikTok to measure ads may count as "sharing" for cross-context behavioural advertising under California law; you can opt out by turning off Ad measurement. We do not use your health data to infer anything about you, and we will not treat you differently for exercising your rights.

14. Children

Peptra is for adults (18 and over). We do not knowingly collect data from children; if you believe a child has created an account, email us and we will delete it.

15. Changes to this policy

When this policy changes, we update the effective date above. If a change is significant, we will tell you in the app before it applies to you.

16. Languages

This policy is published in several languages. If a translation differs from the English version, the English version applies, to the extent the law where you live allows.

17. Contact

Questions or requests: usmansgd42@gmail.com