Privacy policy

This policy covers the Peptiday iPhone app and this website, peptiday.com. Peptiday is made by Vlad Arama, an independent developer, who is the data controller responsible for your data under this policy. In this policy, “we” means Vlad Arama. Contact: vladarama2002@gmail.com.

What stays on your iPhone

Everything you enter in Peptiday stays on your device: the compounds you add, their schedules, the doses you log or skip, vial details, injection sites, units-to-draw notes, check-ins, weights, progress photos and your settings. The app saves this in its own private storage. We can't see it, and nothing in it is sent to us or to anyone else.

If you back up your iPhone with iCloud Backup or to a computer, Apple includes the app's storage in that backup under Apple's own terms. We can't access those backups.

Apple Health

If you connect Apple Health, Peptiday asks to read only the measures you choose:

• Sleep
• Heart rate variability (HRV)
• Resting heart rate
• Steps
• Weight

Peptiday reads these on your iPhone to draw your charts and before-and-after comparisons. It never writes to Apple Health. Health data is not sent to us or to any third party, and it is never used for advertising, marketing or data mining. It leaves your iPhone only in a visit summary you choose to share.

To stop sharing, open the Settings app on your iPhone, tap Privacy & Security, then Health, then Peptiday, and turn off the categories you want to stop sharing. Peptiday stops reading them right away.

Progress photos and camera

If you take progress photos, Peptiday uses the camera only while the camera screen is open. You can also pick a photo from your library, and Peptiday sees only the photo you pick. Photos are stored in the app's private storage on your iPhone, with location and other metadata removed. They are never uploaded and never included in the visit summary. Peptiday saves a comparison to your photo library only when you choose Save Image. Delete photos one by one, or all at once in Settings.

Reminders

Dose reminders are scheduled on your iPhone with Apple's notification system. They don't go through a server. By default the lock screen only says “Dose due”. You can choose to show the compound and amount in Peptiday's settings.

Purchases

Apple handles all payments for Peptiday Pro. We never see your card or payment details. To check whether you have Pro, the app uses RevenueCat, a subscription service that processes data on our behalf. When the app checks or restores a purchase, RevenueCat receives:

• A random customer ID that its software creates on your iPhone
• Your purchase history and receipts from Apple, including products, prices, currency and storefront country
• Your device's vendor identifier (IDFV), device model, iOS version, the app's version and build, and your preferred languages
• Your iPhone's app tracking permission status. Peptiday never asks for tracking permission and doesn't track you
• Your IP address, as part of each network request

RevenueCat does not receive your name, email address, dose records or Health data.

We use this information only to unlock Pro, restore purchases, prevent fraud and count how many people subscribe. RevenueCat is bound by a data processing agreement to protect it with the same care this policy describes. Apple keeps its own purchase records under Apple's privacy policy.

Exports

When you export your dose log as a CSV or create a visit summary PDF, the app creates the file only at that moment, and you choose where it goes. A visit summary includes Apple Health data only if you turn on Include Apple Health. Progress photos are never included. We don't receive a copy.

This website

peptiday.com is hosted by Vercel, which processes IP addresses and request details such as the page, browser and time to deliver pages and protect the site from abuse. We use Vercel Web Analytics to understand which pages people read. It records the page address, the referring site, your approximate location (country, region and city, derived from your IP address), browser, operating system, device type and the time of the visit. It doesn't use cookies. Visitors are grouped by a hash that resets every 24 hours, so it can't follow you across days or across other sites. The website doesn't collect health information.

Email

If you email us, we receive your email address and whatever you choose to write. We use it only to reply, to fix problems you report, or to tell you once when Peptiday launches if you asked. Launch addresses are deleted after that email.

What we don't do

• We don't sell personal data or share it for cross-context behavioral advertising, and we don't share it with data brokers.
• We don't show ads or use advertising or tracking SDKs.
• We don't require an account, a name or an email address to use the app.
• We don't use your Health data for anything other than showing it back to you.

How long data is kept

• Records on your iPhone stay until you delete them or delete the app. Deleting Peptiday deletes its records from your iPhone. Copies in an iCloud or computer backup remain until those backups are replaced or deleted.
• Purchase records at RevenueCat are kept while Peptiday offers Pro, so that restoring a purchase keeps working, and are deleted on request. Records that tax or accounting law requires may be kept for the period that law sets.
• Website hosting logs are kept by Vercel for a short period under its own retention settings. Analytics are kept as aggregated page statistics.
• Support emails are kept until your request is resolved and for up to 24 months after, or deleted sooner if you ask.

Legal bases

If you're in the European Economic Area, the UK or Switzerland, we rely on these legal bases:

• Checking and restoring purchases: to perform our contract with you.
• Fraud prevention, website security and analytics: our legitimate interest in running a safe, working service. You can object at any time.
• Answering your emails: our legitimate interest in helping you, or steps you ask for before a contract.
• Apple Health data is read only on your iPhone with your explicit permission, which you can withdraw in Settings at any time.

RevenueCat and Vercel are based in the United States, so purchase and website data is processed there. These transfers rely on the EU-US Data Privacy Framework where the provider is certified, and on the European Commission's Standard Contractual Clauses otherwise.

Your rights

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to restrict or object to how it's used, and to withdraw consent. Because your records stay on your iPhone, you already have them. For anything RevenueCat or we hold, email us. To help us find purchase records, include the order ID from your Apple receipt email. We'll respond within 30 days and won't treat you differently for using these rights. You can also complain to your local data protection authority.

Deleting purchase records doesn't cancel an Apple subscription. Cancel it in your App Store settings. Restoring a purchase later creates a new record at RevenueCat.

Children

Peptiday is for adults 18 and older. It isn't directed at children, and we don't knowingly collect data from anyone under 18.

Changes and contact

If this policy changes, we'll update it here and change the date at the top. For questions or requests, email vladarama2002@gmail.com.