Privacy policy

The short version

• Everything in Peptivist is something you typed or uploaded. We do not buy data about you, and the app derives nothing about your body from what you record.
• There is no advertising, analytics, attribution or crash-reporting software in this app at all. Not a reduced amount — none.
• We do not sell your data, and we never use health data for advertising. We do not share it with insurers or employers. Ever.
• The one kind of sharing that happens is the kind you ask for: granting another person access to a profile. That is the product, and it is described in full below.
• You can export everything and delete your account yourself, from inside the app, on any plan. Neither is ever behind the paywall.

What we record

To have an account at all

• Your email address. Sign-in is a numeric code sent to your address, so the address is your credential. There is no password to store.
• Your date of birth, as a self-attestation that you are 18 or over. It is stored on your login and is never attached to a profile or shared with anyone.
• A record that you accepted the disclaimer and the age check, including which version of the text you were shown, and when.
• A record each time you agree to something — the terms and privacy policy at sign-up, the calculator terms the first time you open it, and the Community warning when you join. Each record holds your account id, your email address, your Community username if you have one, the exact wording you agreed to (with a fingerprint of it), the server’s time, your IP address, a random id for this install of the app, the platform (iPhone, Android or web) and the app version. We email you a copy. We use these records only to show what was agreed, by whom and when, if that is ever questioned. We do not record your legal name or postal address.
• A push token, if you allow notifications. This is the random identifier Apple or Google issues so a notification can reach Peptivist on your phone. We store it with the platform and when it was last used, use it only to deliver order alerts and to tell your other devices to refresh, and delete it when you sign out, uninstall the app, or delete your account.
• Your notification settings — whether you want order alerts by push, by email, both, or neither.
• If you are a Founding Member and choose to be named, the nickname you type for the credits. It is shown to other signed-in Peptivist users and to nobody else, it is off unless you turn it on, and you can change or remove it at any time.

The profiles you keep. A profile is a person. It may be you, or somebody you track for who has no account of their own. Each profile holds:

• A display name, and the times of day that person’s “morning” and “night” actually are.
• Schedules — what is taken, how it is measured, how often, over what cycle, and any steps the dose changes in over time. Every one of these is something you typed. The calculator only does arithmetic on numbers you enter; if you choose to save a result to a vial, it is stored like anything else you type.
• Doses, as you tick them off: the date, whether it was taken, skipped or missed, and optionally an injection site and a note.
• Logs — weight, body measurements, food, training, sleep, water, notes and lab results, in whatever units you entered. Units are compared, never converted.
• Files you attach — bloodwork PDFs, certificates of analysis, receipts, and photographs, including body photographs and photographs of packages, products and vials that went bad.
• Inventory — vials, bottles and prescriptions, their vendors, lot numbers, prices and dates; notes on vials that went bad; and orders, with the carrier and tracking number you enter, what arrived, and what was wrong with it. Prescription records hold whatever you copy off the label, including the prescriber’s name.
• Order reviews — ratings, tags, notes and photos about an order and its vendor. Reviews are private: only people who can see that stock can read them, and they are never published or shared with vendors.
• A change history — what was edited on a profile, by whom, and when.

What we do not record

• We do not collect advertising identifiers or location. The device identifiers we hold are the push token described above (only if you allow notifications) and the random install id saved with agreement records and used for Community ban protection.
• We do not track you across apps or websites.
• We never run recognition, measurement, or any machine learning on a photograph you upload. A progress photo is stored as a file and treated as a file.
• We never see your payment card. Subscriptions are handled entirely by Apple or Google.

Photographs and location

Photographs carry hidden location data by default — a picture of vials on your kitchen counter usually contains the coordinates of your kitchen. Every image is re-encoded before it is uploaded, which removes that metadata. PDFs are uploaded unchanged, because re-encoding a lab report degrades it and a PDF does not carry coordinates.

Who can see your data

Other people you grant access to. This is the part worth reading carefully, because it is the point of the app. You can grant another Peptivist user access to a profile, and when you do, you choose which areas they can see, separately:

• Schedule — what is due and when, and doses ticked off
• Inventory — stock, orders, order reviews and photos, and run-out dates. People with access to your inventory also receive order alerts (below), which they can turn off.
• Logs — weight, measurements, food, training, sleep
• Lab results and photographs — bloodwork files and body photographs
• What Changed — the record of every edit

These are independent. Somebody granted the schedule and nothing else cannot see your bloodwork, and the app enforces that in the database rather than by hiding a screen.

Order alerts. When someone changes the status of an order on stock you share, the other people on that stock get a short alert by push and email — for example, “An order has shipped. Open Peptivist to see it.” Alerts never name the vendor, the products, quantities or prices. The person who made the change is not alerted. You can turn push and email off separately at Menu → Alerts.

You can revoke access at any time, immediately, without their approval and without notifying them. That is deliberate and it is not going to change.

If you delete your account, profiles that other people have claimed as their own are transferred to them rather than deleted. We will not destroy another person’s medical history because you closed your account.

Peptivist Community

If you join Community, we keep what you post there — messages, forum posts, private messages, reactions, photos and files — together with your username, when you joined, the roles you hold, who you can receive private messages from, and whether you chose to show as online. Other members see your username, your role badges, your posts and, if you allow it, a green dot while you have the app open. They never see your email address or anything you track.

• Private messages can be read only by the two people in the conversation. Admins cannot read them. If either of you reports a conversation, the admins can read that one conversation to look into it.
• Admins see reports and who made them, posts held for approval, your Admin Help thread, timeouts and bans. They do not see your Peptivist records.
• The owner log is seen only by the Community owner. It records admin actions and keeps a copy of a post or private message as it was before someone edited or deleted it (for a private message, the owner sees it only after that conversation is reported). Copies are erased after 180 days.
• Ban protection. When you join Community we note the random install id of the app and a scrambled form of your IP address (a one-way hash with a secret, so the address itself is not kept here). If an admin bans someone, a new account from the same install or network waits for an admin before it can post. A ban also blocks the email address the banned account used.
• Photos you post in Community are re-encoded first, which removes location data, and are stored in a private bucket that only Community members can read, through links that expire. Photos in a private message can be opened only by the two people in it. Nothing is ever recognized or measured in them.
• Who’s online is shown only while the app is open and only if “Show me as online” is on. Turn it off any time.
• Blocking someone hides their messages from you and stops them from messaging you privately. They are not told.
• Link cards are fetched by our server, not your phone, and carry no images, so a site you link to does not learn who read the message.
• GIF search goes through our server to GIPHY, so GIPHY does not learn who searched. When a GIF is shown, your device loads it from GIPHY, as any image on the web is loaded.
• Channels shown on peptivist.com. The owner can make a channel readable on our website without an account. Posts there appear under usernames only. Every channel says whether it is shown on the web.

Deleting your account deletes your Community messages, private messages, files, the owner log’s copies of your posts and your Admin Help thread, and blanks any forum post you started. The replies other people wrote stay. Your agreement records and any ban on you are kept, as described below.

Companies that process data for us

We use a small number of service providers, each under contract, each processing only on our instructions:

These are processors, not partners. They may not use your data for their own purposes. We do not sell your data, and we do not share it with advertisers, data brokers, analytics companies, insurers or employers. We will disclose data if legally compelled; if we receive a demand for your records and we are permitted to tell you, we will.

How it is protected

• Everything travels over HTTPS, and is stored in the United States.
• If a security breach affects your records, we will tell you — by email, and in the app — as soon as we know enough to say what happened, and in any case within the time the law where you live requires.
• Your files live in a private storage bucket. They are never given a public URL. When you open one, the app requests a signed link that expires in five minutes.
• Access is enforced by row-level security in the database, so a modified copy of the app cannot read what it is not entitled to.
• The audit trail cannot be written or erased by any user, including you. It exists so somebody can see afterward who had access to their record — a safety feature, and one that only works if it is not editable.

No system is perfectly secure, and we do not claim otherwise.

Keeping and deleting

We keep what you record for as long as your account exists. We do not have a retention schedule that quietly deletes your history — it is your record.

Three things have their own clocks. Copies of edited and deleted Community posts and private messages in the owner log are erased after 180 days. Agreement records (above) are kept for seven years after your account is deleted, because they are the proof of what was agreed if a claim is ever made; they hold no health data. A Community ban record is kept after the account is deleted, so the ban still applies to the same email address.

You can delete your account yourself, from Menu → Settings → Delete my account. Before you confirm, the app lists by name every profile that will be deleted and every one that will be handed to somebody else. Deletion is immediate and permanent, and it removes your uploaded files from storage, not merely the links to them. Nobody at Opsgrip can undo it. Full detail on the deletion page.

Deleting your Peptivist account does not cancel your subscription. Apple and Google own that; cancel it in the App Store or Play Store.

Database backups are taken daily and seven days are kept. A deleted account’s records age out of them within that week, and a backup is never used to restore a deleted account.

Your uploaded files are not in those backups at all. Database backups cover the database, which holds only a record that a file exists — not the file. When you delete, the bloodwork and the photographs are removed from storage there and then, and there is no backup copy of them to outlive it.

Your rights

Everyone, on every plan:

• Export everything. Menu → Settings → Export my records gives you every profile you own as spreadsheets and a PDF. Free, always.
• Delete everything, as above.
• Correct anything — it is all editable in the app.

If you are in Washington, Nevada or Connecticut, consumer health data laws give you additional rights, including the right to know what consumer health data we collect and who we share it with, the right to withdraw consent, and the right to have it deleted. Washington residents may enforce these rights directly. See the consumer health data page.

If you are in California: we do not sell personal information and do not share it for cross-context behavioral advertising, so there is nothing to opt out of. You have the right to know what we hold, to correct it, to delete it, and not to be treated differently for exercising those rights — all of which the app lets you do yourself, and we honor on request whether or not the CCPA technically applies to a company our size.

If you are in the EEA or the UK, you have rights of access, rectification, erasure, restriction, portability and objection. Write to us at peptivistsupport@opsgrip.com.

Children

Peptivist is for adults. You must be 18 or over to use it, and the app asks before you can enter anything. This is self-attestation; we do not verify it. We do not knowingly collect data from anyone under 18, and if we learn that an account belongs to someone under 18 we close it and delete its data. If you know of one, write to peptivistsupport@opsgrip.com.

Changes, and how to reach us

If we change this policy we will update the date at the top. If a change materially affects what we do with health data, we will tell you in the app before it takes effect rather than relying on you re-reading this page.

Opsgrip LLC — peptivistsupport@opsgrip.com