Privacy Policy
Version 1.0 · Effective August 28, 2026
Plain-English summary
- We collect the minimum needed to run your tracker: your Google account basics and the entries you create.
- We never sell your data and never share it for advertising.
- You can access, export and delete everything at any time — deletion completes within 30 days.
- Pepprep is 18+ only, and we do not knowingly collect data from minors.
The summary is for convenience — the full text below is what applies.
What we collect
Only what the app needs to work:
- Account basics from Google sign-in: name, email address and profile picture URL.
- Profile details you enter: age, weight, height and goals.
- Your entries: peptide logs, vials, reminders, body metrics, goals, side effects and expenses.
- Compliance records: which disclaimers you accepted, the version and the timestamp.
- Safety records: reports you file and automatic red-flag events.
- Minimal technical data needed to serve and secure the app.
What we do not collect
We do not collect:
- Payment card numbers or bank details.
- Government identifiers, insurance numbers or clinical records from providers.
- Precise location or contact lists.
- Advertising or cross-site tracking identifiers.
How we use it
To show your dashboard, streaks, charts, reminders and anonymised leaderboard position; to keep the service secure; to investigate safety reports; and to keep legally required records of disclaimer acceptances.
We never sell your data
Pepprep does not sell, rent or trade personal information, and does not share it with advertisers or data brokers. Under the CCPA/CPRA we have no sale or sharing of personal information to opt out of.
When we share
Personal data leaves Pepprep only when:
- A processor we use to host the database and authentication handles it on our instructions under contract.
- We are legally required to disclose it by valid law, subpoena or court order.
- It is necessary to prevent imminent harm to you or another person.
Your rights
Wherever you live, you can request access, correction, export in a portable format, restriction, objection or deletion. If you are in the EEA/UK (GDPR) our legal bases are contract (running your account), consent (optional features) and legitimate interest (safety and security); you may also lodge a complaint with your supervisory authority. If you are in California you additionally have the right to know, delete, correct and to be free from discrimination for exercising those rights.
Exercise any right in the app or by emailing privacy@pepprep.dev. We reply within 30 days.
Security
Data is encrypted in transit, stored in an access-controlled managed database and protected by row-level security so a signed-in member can only reach their own rows. Access to production data is limited to personnel who need it.
How long we keep it
Deleting your account removes your data within 30 days, with narrow exceptions:
- Accounts banned for a safety violation are retained indefinitely so the ban can be enforced.
- Records preserved under a valid court order or legal hold are kept up to 7 years.
- Mentor safety reports that indicate an ongoing risk to members are retained indefinitely.
- Disclaimer acceptance records are retained for as long as needed to defend a legal claim.
Children
Pepprep is for adults 18 and older. We do not knowingly collect data from anyone under 18; if we learn an account belongs to a minor we terminate it and delete the data.
Contact
Privacy questions: privacy@pepprep.dev. Safety concerns: safety@pepprep.dev. General support: support@pepprep.dev.