Privacy Policy

PepMe is built around a simple promise: your data is yours, we don't sell it, and we don't run ad trackers. This policy explains what we collect, why we collect it, where it goes, how long we keep it, and what control you have. PepMe is operated by Oppy Group ("we", "us"), a US-based team.

Quick summary

• What we collect: account info, the protocols and injections you log, your journal entries (including any weight and progress photos you attach), bloodwork values you enter, plus the technical breadcrumbs every app produces (device type, IP, session timing).
• Analytics: we use Google Analytics to count visits to the public website. Inside your account it only runs if you accepted cookies — decline and your activity there is not measured. Visitors in the UK, EU/EEA and Switzerland are asked before anything is measured at all. It is never loaded in the iOS or Android app, and it records page names — never what you logged.
• What we still don't do: no Facebook Pixel, no ad tracking pixels, and nothing that profiles you across other sites.
• What we don't do: we don't sell your data, rent it, or share it with advertisers. We don't read your journal to train AI models that aren't doing work for you. We don't share your protocol with insurers or employers.
• You can export or delete everything from inside the app (You → Export, You → Delete account) or by emailing [email protected].

Information we collect

Account information

• Your email address and a hashed password (we never see the plaintext).
• Your name, plus a nickname or display name you choose.
• Preferences — units (metric vs imperial), default dose unit (mcg/mg/IU), timezone, notification settings.
• Date of birth, if you choose to enter it (used only to gate 18+ access).

If you sign in with Google or Apple, those providers send us your email and a unique identifier so we can match you to an account. We don't get your contact list, calendar, or anything beyond what's needed to log you in.

Protocol data

• Cycles you define (name, start date, length).
• Compounds you add (name, dose, route, cadence, optional notes and cost).
• Schedules linking compounds to days and times.
• Individual injections you log (compound, dose, time, site).
• Vials you track (mass, BAC water volume, reconstitution date).

Journal entries

• Daily 0–10 ratings (sleep, energy, mood, pain) and free-text notes you write.
• Weight values you log (stored as kilograms regardless of your display preference).
• Progress photos you attach to entries (stored privately on Amazon S3 and served only through short-lived signed links, never indexed or shared).

Bloodwork

• Lab marker names, values, units, reference ranges, and the draw date you enter.
• If you paste a PDF panel for parsing, the PDF itself is processed and then discarded; only the structured values you confirm are saved.

Health-source integrations (optional)

If you connect Withings, Apple Health, or Health Connect, we read only the data categories you authorise — typically weight, body composition, and sleep. We store derived values needed to render your trend; we don't keep raw historical pulls beyond what shows on your dashboard. You can disconnect any source from You → Health sync at any time, and the linked data stops flowing in.

Technical and diagnostic

• Your IP address (seen by Cloudflare, which sits in front of the site; we keep it briefly for abuse-rate-limiting, then drop it).
• The device and browser type that's signed in (used for session management and security alerts).
• Crash and error logs from Sentry, scrubbed of personal identifiers, used to fix bugs.
• Activity timestamps (last login, last sync) for security review.

How we use your information

• Run the service. Most of your data is what the app needs to do its job — render your dashboard, work out how consistent you've been, surface your next dose, fill your journal.
• Generate AI notes and estimates — only when you ask. Three features send data to Anthropic's Claude API, each one thing at a time and none of them automatic:
  • A pattern note on your bloodwork, or a trend synopsis on your journal: we send the relevant rows.
  • A body-fat estimate from a progress photo: we send that photograph. It happens per photo, only when you request it, and never on upload — a photo you attach and say nothing about is never sent anywhere.
  We never send your name or your email with any of it. Anthropic processes the request and returns a result; per Anthropic's commercial terms your data is not used to train their models. If you would rather no photograph of you left our systems, simply don't ask for the estimate — everything else in PepMe works exactly the same.
• Send service email. Welcome, verify-your-address, password reset, and notification emails are delivered through Mailgun. Marketing email is opt-in; if you opt in, you can opt out from any email's footer.
• Customer support. If you email us, we keep the thread until the issue is resolved + a reasonable archive period.
• Security and abuse prevention. Rate limiting, fraud detection, account integrity.
• Aggregate analysis. We may compute fully-anonymised aggregate counts (e.g. "X% of users sync a health source") for product decisions. No individual is ever identified.

We do not use your data to target ads, train models that benefit anyone other than you, or sell it. We have no plans to change that.

Who we share data with (subprocessors)

The third parties listed below process data only on our instructions, under contract. We don't share data with anyone outside this list except where required by law.

• Cloudflare — sits in front of the site and the API, so it sees the IP address and headers of every request. Used for TLS, caching and abuse protection.
• Railway — application hosting and the Postgres database that holds your account and everything you log. Encrypted at rest.
• Amazon Web Services — S3 for progress photos, in us-west-2. Private, encrypted at rest with AES-256, and reachable only through short-lived signed links.
• Anthropic — Claude API for bloodwork pattern notes, journal trend synopses, and body-fat estimates from a progress photo. Only ever when you trigger one, and only the item concerned.
• Mailgun — transactional email delivery (welcome, verify, password reset, notifications).
• Sentry — error and crash reporting, with PII scrubbed.
• Stripe — payment processing, if you subscribe. Card numbers go directly to Stripe and never touch our servers.
• Withings / Apple Health / Health Connect — health-source providers, only when you explicitly connect one.
• Google / Apple — identity providers when you choose "Continue with Google" or "Continue with Apple".
• Google Analytics — counts visits to the public website. Inside your account it runs only if you accepted cookies, and it is never loaded in the iOS or Android app. See the cookie policy.

How long we keep your data

• Active accounts: we keep your data as long as your account is active.
• Account deletion: when you delete your account from You → Delete account (or by emailing [email protected]), we soft-delete immediately and hard-delete after a 30-day grace period. The grace exists so you can recover from an accidental deletion by signing back in; after it expires, your data is gone from production and removed from rolling backups within 90 days.
• Backups: rolling encrypted backups are kept for 14 days for disaster recovery; data deleted from production is not retrievable from backups beyond that window.
• Email and support threads: 2 years from last activity, then deleted.
• Aggregated, anonymised counts: kept indefinitely because they can't identify you.

Your rights

• Export your data. You → Export bundles everything we hold on you into a single download.
• Delete your account. You → Delete account, or email [email protected].
• Correct your data. Most fields are editable inside the app; for the few that aren't, email us and we'll fix them.
• Object or restrict. Email [email protected] with what you'd like restricted.
• Withdraw consent for health-source sync at any time from You → Health sync.
• Lodge a complaint. If you believe we've mishandled your data, you can contact your local data protection authority (e.g. the FTC in the US).

Security

We try to make this boring: TLS for everything in transit, AES-256 for storage at rest, hashed passwords, private database subnets, scoped IAM, no plaintext credential dumps to logs. If you find a security issue, please email [email protected] — we read those and respond.

Children

PepMe is for adults 18 and older. We do not knowingly collect data from anyone under 18. If we learn that a user is under 18, we delete their account and any associated data.

International users

Our servers are in the United States. By using PepMe from outside the US, you consent to your data being processed in the US, which may have different privacy laws than your country.

Changes to this policy

If we make material changes, we'll notify you by email and surface a note in the app before the changes take effect. The "last updated" date at the top of this page always reflects the current version. Past versions are available on request.