Privacy Policy

Effective date: November 12, 2026

Peptimes isn’t available in app stores yet. This policy describes the app as it will work at launch, and the website as it works now.

---

The short version

• Your health records are stored on your phone, not on our servers. That covers your doses, protocols, check-ins, side effects, weights, measurements, vials, your own compounds, badges and notes. We never receive them, so we can’t see, sell or share them.
• On iPhone, they can be included in the iCloud or computer backups you make. On Android (when released), they aren’t included in Google backups (§10). Peptimes doesn’t sync them to any cloud.
• Apple Health and Health Connect are read only, and only if you connect them. What Peptimes reads stays on your phone. Peptimes writes nothing to them (§6A).
• Our server holds only your account: your email address, your first and last name, how you sign in, and (for Apple or Google sign-ins) a record that you agreed to our terms. Our providers also keep technical connection records (§3).
• No advertising, no analytics, no tracking in the app. We never sell your information.
• Crash reports are off unless you turn them on. If you do, they contain technical details only, never your health records (§6).
• Reminders can show the compound and amount on your Lock Screen. Turn on Discreet reminders to hide them (§5).
• You can export a copy of your records, make a Doctor report, and delete your account, in the app at any time.
• Peptimes is for adults 18 and over.
• Wherever you live, your health records stay on your phone. Your account is stored in the United States (§14).

---

1. Who we are and what this covers

Peptimes is provided by PT Development LLC, a Wyoming limited liability company, doing business as Peptimes, 30 N Gould St #71196, Sheridan, WY 82801 (“Peptimes”, “we”, “us”).

This policy covers:

• the Peptimes app for iPhone (including its Home Screen widget) and for Android (when released);
• the website at peptimes.com (its own notice, the Website Privacy & Cookie Notice, adds detail);
• emails you send us, and the account emails we send you.

Privacy contact: privacy@peptimes.com, or the postal address above.

2. Where your information lives

On your phone: we never receive it	On our server: your account
Doses you log: the compound, amount and unit, date and time, how you took it, injection site, side effects and their intensity, pain, how you felt, notes; doses you marked not taken; past doses waiting for your answer	Your email address
Protocols: compounds, amounts, times, days, start dates, cycle lengths, pauses, blend names, reminder settings	Your first and last name
Your own compounds: the names and units you add	How you sign in: a password for email accounts (which we can’t see), or your Apple or Google sign-in identity
Vial Inventory: each vial’s compound, amount, unit, the dates you opened and finished it, the use-by date you typed, and which doses you counted against it	For Apple or Google sign-ins, a record that you agreed to our Terms, this policy and the Medical Disclaimer
Daily check-ins: energy, mood and sleep ratings, hunger and food-noise ratings, side effects and their intensity, notes, weight, water, calories and macronutrients, workout and cardio minutes, steps, muscles worked	When your account was created and last updated
Weigh-ins and Body Profile: height, current, start and goal weight, start date, sex, age, activity level. Weigh-ins can include ones brought in from Apple Health or Health Connect (§6A)	Technical records our providers keep when the app connects, such as IP address and time (§3)
Body measurements: waist, hips, chest, upper arm, thigh, body fat %
Badges and the Progress Jar: which badges you’ve earned and when, and what the jar last showed. A badge record can include a compound’s name
Goals, experience level, unit and notification settings, your Apple Health or Health Connect switches, your crash-report choice, and the estimates and summaries the app calculates from your records

“On your phone” means the app’s private storage on your device. Anyone who can unlock your phone and open Peptimes can see the records of the account signed in there (§9).

Your profile photo also stays on your phone, and we never receive it. It’s kept in a cache folder that is left out of backups, and the phone may delete it when storage is nearly full.

Your Home Screen widget (iPhone only) reads a small summary the app writes on your iPhone: today’s dose count and your next doses’ times and names. With Discreet reminders on, the names are left out. The summary holds no account details, is kept out of backups, and is rewritten when you sign out. The widget is set to show nothing while your iPhone is locked.

Sign in with Apple: the app keeps Apple’s sign-in token in your phone’s secure storage (the Keychain on iPhone), so that deleting your account can ask Apple to revoke it (§11).

3. Information on our server, and why

We receive the following through Supabase, our account and sign-in provider:

• Email sign-up: your email address, first and last name, and password. Our provider stores passwords in hashed form; we can’t see them.
• Apple or Google sign-in: the name and email address Apple or Google provide (or Apple’s private relay address, if you choose it), and your account identifier with that provider. If you sign in with Google or Apple, Supabase keeps what that sign-in shares with us: your name, email and, for Google, a link to your profile picture.
• Edit Profile: a new first or last name, when you change it. Your email address can’t be changed in the app.
• Terms acceptance: for Apple and Google sign-ins, a yes/no record that you agreed.
• Technical records: each time the app reaches our server, our provider records connection details such as IP address, time and the request. We use them only to run and secure the service.
• Account emails: password-reset and sign-up confirmation emails go to your address through our email-sending provider (§7).

Your agreement and consent. When you create your account, you agree to this Privacy Policy and our Terms. By creating your account and using Peptimes, you give your explicit consent to the processing this policy describes. That includes your account details, which show that you use a dose-tracking app and so can relate to your health, and their storage and processing in the United States and by the providers in §7 and §14.2. You can withdraw your consent at any time by deleting your account (§11). Withdrawing doesn’t affect what we did before, and without this consent we can’t give you an account.

We use this information only to: create and run your account, let you sign in, send the account emails you ask for, answer you, keep the service secure, and meet legal obligations. We don’t use any of it for advertising or profiling.

4. Information you choose to send or share

Exports.

• Export My Data creates a JSON or CSV file of your records and opens your phone’s share sheet. You choose where it goes (a files app, a cloud drive, email, a person). If you save it to a cloud drive, such as iCloud Drive or Google Drive, it’s stored there.
• Badges and the Progress Jar aren’t in the export.
• The file isn’t encrypted. Treat it like any document with health information in it.
• Your latest JSON and CSV exports each stay in the app’s cache folder on your phone until you export in that format again, use Reset All Data or Delete account, or the phone clears the folder.
• The app can’t load an export back in. It’s a copy for you to keep.

Doctor report.

• Doctor report makes a PDF on your phone and opens the share sheet. You pick the period, and the name shown on it (it starts with your first name; you can change or clear it).
• What it contains: that name; for each compound in the period, its schedule, how many scheduled doses were logged and not logged, the amounts you logged and the last time you logged it; your weigh-ins (including ones brought in from Apple Health or Health Connect); averages of your energy, mood and sleep ratings; and the side effects you noted.
• What it leaves out: notes, injection sites and estimated levels. It names your compounds even with Discreet reminders on.
• Where it goes: only where you send it. We never receive it. The file isn’t encrypted, and the app deletes it from your phone when the share sheet closes.

Report a Bug and Contact Support.

• Report a Bug opens an email in your phone’s mail app with what you type, the app version, whether you’re on iPhone or Android, and a screenshot if you choose to attach one. Contact Support opens a blank email to us.
• We receive only what you send, and use it to answer you and to fix and improve Peptimes. Please don’t include health details you don’t want to share.
• Support email is held by Google (Google Workspace), and kept for 2 years after your last message, then deleted. You can ask us to delete it sooner.

Help center and feedback board (Featurebase).

• What opens it: Help & FAQ and Feature Request (in Profile and in Insights), and the “Have an idea?” card in What’s New. They open pages run by Featurebase in an in-app browser.
• What the app sends: no account information and no records.
• What Featurebase receives: your IP address and browser details, and anything you type, post or sign in with on its pages.
• The feedback board is public.
• Featurebase’s own privacy policy also applies on those pages.

Sharing and links.

• Share Peptimes opens the share sheet with “The app that remembers my doses so I don’t have to → https://peptimes.com”. You choose whether and where to send it.
• Rate Peptimes uses the app store’s own rating prompt.
• Links to the Library’s sources (such as PubMed), to our Instagram, TikTok and X pages, and to Apple’s or Google’s pages open those sites, whose own policies apply.

5. Notifications, your Lock Screen and your watch

Your phone schedules every reminder itself. We don’t send notifications from a server.

What they show by default:

• Dose reminders: the compound (or your blend’s name) and the amount, for example “Time for your” and the compound’s name.
• “Not logged” follow-ups (on by default, two hours after the dose time): the compound, the amount and the scheduled time.
• Vial reminders (off unless you turn them on): the compound’s name, when a vial is running low or reaches the use-by date you entered.
• The daily check-in reminder: “How are you feeling today?” It names no compound.
• Where: your Lock Screen, your notification list, and a paired watch.

To hide them:

• turn on Discreet reminders (Profile → Notifications). Dose reminders, follow-ups and vial reminders then say only “You have a reminder” and “Open the app to see it.”;
• on iPhone, set Show Previews to When Unlocked in iOS Settings; on Android (when released), hide sensitive notification content on the lock screen in your phone’s settings;
• on iPhone with iOS 18 or later, lock Peptimes from its Home Screen icon (Profile → App Lock shows how).

Signing out cancels your reminders and clears Peptimes’ notifications from your notification list. So do Reset All Data and Delete account.

6. What we don’t do, and crash reports

• We don’t sell or rent your information, or share it for advertising.
• The app has no advertising, analytics, attribution or tracking tools. It doesn’t track you across other companies’ apps or websites, so “Do Not Track” signals don’t change anything we do.
• We don’t use any personal information, including account information, to train AI models.
• How we make money: subscriptions only. Peptimes has no advertising, and we earn nothing from your information.
• The app stores’ own sharing: if you’ve chosen in your phone’s settings to share analytics or diagnostics with app developers, Apple or Google gives us crash logs and summary statistics. They don’t include your records.

Crash reports, only if you turn them on.

• Off until you say yes. Peptimes asks once, with a card on Home (“Send crash reports?”). You can change your answer at any time in Profile → “Share crash reports”. The choice belongs to each account on the phone, and turning it off stops reports straight away.
• What a report contains: the app version and build, the phone model, the operating system version, and where in the app’s code an error happened (the file, function and line), or a fixed category name for a problem the app catches itself, such as a dose history it couldn’t read.
• What it never contains: doses, protocols, check-ins, compound names, amounts, notes, health values, your name, your email or your account ID. Error messages are removed, except the app’s own fixed ones. Each report is rebuilt on your phone from a list of allowed fields before it’s sent.
• Your IP address: the app tells Sentry not to record it.
• Who receives it: Sentry (Functional Software, Inc.), in the United States. Reports are kept for up to 90 days.

Subscriptions.

• You buy through Apple’s App Store on iPhone, or Google Play on Android (when released). The store handles payment; we never see your card.
• To confirm your subscription, our subscription provider, RevenueCat, receives from Apple or Google your purchases (product, dates, price, currency, country or region, trial status), an app user ID that is your Peptimes account ID, and the device and app details any app service sees with each request (phone model, operating system version, app version, language, IP address).
• RevenueCat never receives your records, compound names, name or email.
• Deleting your account doesn’t cancel your subscription (§11).

6A. Apple Health and Health Connect

Off unless you connect them. Each is read only: Peptimes writes nothing to Apple Health or Health Connect.

On iPhone (Apple Health):

• What Peptimes can read: only the types you allow, each with its own switch in Peptimes and its own iOS permission: weight, body-fat percentage, steps, sleep, resting heart rate, heart rate variability, workouts, waist size, and nutrition (water, calories, protein, carbohydrates, fat and fiber).
• To stop: iOS Settings → Privacy & Security → Health → Peptimes, or turn the switches off in Profile → Apple Health.

On Android (when Peptimes for Android is released), Health Connect:

• What Peptimes can read: only the types you allow, each with its own switch in Peptimes and its own Health Connect permission: weight, body fat, steps, sleep, resting heart rate, heart rate variability, exercise sessions, hydration, and nutrition (calories, protein, carbohydrates, fat and fiber). Health Connect has no waist type, so Peptimes doesn’t read waist size on Android.
• Older data: Peptimes also asks to read data older than 30 days, so that weigh-ins from the start date you set can be brought in.
• Only while you use the app: Peptimes doesn’t read Health Connect in the background.
• To stop: Health Connect → App permissions → Peptimes (on Android 14 and later, Health Connect is in Settings → Security and privacy → Privacy controls), or turn the switches off in Profile → Health Connect.
• Google’s rules: the use of information received from Health Connect will adhere to the Health Connect Permissions policy, including the Limited Use requirements.

On both:

• Where it goes: it’s read on your phone and shown in Peptimes. It’s never sent to us or anyone else, never sold, and never used for advertising, marketing or data mining.
• What Peptimes keeps: weigh-ins it brings in are added to your weight list on your phone, marked as imported (at most one a day; a weight you type always wins). Steps, nutrition and workout minutes are kept only inside a check-in you save. Sleep, body fat, waist size, resting heart rate and heart rate variability are read when a screen shows them, and never kept.
• Storage: what Peptimes keeps follows §10 like your other records. Peptimes doesn’t store it in iCloud or any other cloud.
• Sharing: if you export your records or share a Doctor report, it can include weigh-ins Peptimes brought in.
• Deleting: Profile → Apple Health (or Health Connect) → Remove imported weigh-ins removes them. Reset All Data and Delete account remove them too.

7. Who we share information with

Service providers that run Peptimes for us, under contracts that limit their use of it to providing their service and require them to protect it:

• Supabase (accounts and sign-in), servers in the United States (Oregon); the company is Supabase Pte. Ltd., in Singapore (§14.2);
• Loops (sends account emails such as password resets, and the website launch waitlist’s one email to people who sign up there; an address given for Android is kept until Peptimes is on Google Play, emailed once then, and deleted within 30 days after that email, or when we decide not to release on Android), under its own terms;
• Google (Google Workspace: our support email);
• Sentry (crash reports, only if you turn them on);
• RevenueCat (subscription status).

Others:

• Apple, for App Store purchases, Sign in with Apple, and revoking Apple’s sign-in token when you delete your account; Google, for Google Play purchases and when you sign in with Google.
• Featurebase hosts our help and feedback pages. It receives only what you give it there (§4).
• Where the law requires it, or to protect someone’s safety or our legal rights.
• A buyer or successor if Peptimes is sold or merged, who must honor this policy.

We never share your health records, because we don’t have them.

8. How long we keep information

What	How long
Your account (email, name, sign-in details, terms record)	Until you delete your account. In-app deletion removes it from our server straight away. Supabase keeps short-lived logs for a few days.
Technical connection records	A few days (Supabase’s short-lived logs)
Account emails sent through Loops	We delete the waitlist within 30 days after the launch email; Loops keeps its own sending records under its policy.
Crash reports (only if you turned them on)	Up to 90 days
Support emails and bug reports	2 years after your last message, then deleted
What you post or type on Featurebase	Featurebase’s retention
Your records on your phone	Until you delete them, use Reset All Data or Delete account, or delete the app. On iPhone, copies in backups you made follow your own backup settings; we can’t see or delete them.

9. Security

• On your phone: your records are in the app’s private storage, protected by your phone’s operating system. Peptimes doesn’t add its own encryption, so your screen lock (passcode, Face ID or fingerprint) is the main protection. Keep one set. On iPhone with iOS 18 or later you can require Face ID, Touch ID or your passcode to open Peptimes (Profile → App Lock shows how); anyone who knows your passcode can still open it.
• In transit: the app reaches our server over encrypted (HTTPS) connections.
• On our server: your account row can be read only by you when signed in, and the app can change only your first and last name. We limit who at Peptimes can access account data. Our Supabase, GitHub, Sentry, Google Workspace and Apple developer accounts require two-step sign-in.
• No system is perfectly secure. If a security breach affects your information, we’ll notify you, and the authorities, as the law requires, including within the deadlines set outside the US (for example, 72 hours to the authority in the EU and UK).

10. Backups, lost phones and new phones

On iPhone:

• Your records can be included in your iPhone’s backups. iOS can include the app’s private storage in the iCloud or computer backups you make. Whether a backup holds them depends on your settings: iCloud Backup must be on (or you make a computer backup), and you can leave Peptimes out of iCloud Backup in your iPhone’s settings. We never receive your backups, and Peptimes can’t restore your records itself.
• How backups are protected is up to Apple and you. iCloud backups are end-to-end encrypted only if you turn on Advanced Data Protection; otherwise Apple holds the keys. A computer backup is protected by the password you set, if you encrypt it.
• A new iPhone: signing in gives you your account. Your records may not come across to a new iPhone, so export a copy first.
• The profile photo and the widget summary are left out of backups.

On Android (when released):

• Your records aren’t included in Google backups, and don’t move to a new phone when you transfer your data. Only a few app settings do.
• A new Android phone: signing in gives you your account, but not your records. Export them first.

On both:

• A separate copy: use Export My Data. The app can’t load an export back in.
• Deleting: Reset All Data and Delete account remove your records from this phone, not from backups you made earlier.
• Without a backup or export, losing your phone or deleting the app means your records are gone. We can’t recover them.

11. Your choices and rights

In the app, you can:

• view your records, and edit or delete doses, protocols, vials and your own compounds;
• update your Body Profile and measurements. Single check-ins and weigh-ins can’t be deleted yet; Reset All Data clears them with everything else. Imported weigh-ins can be removed together (§6A);
• export your records (Profile → Export My Data) and make a Doctor report;
• Reset All Data: clears this account’s records, and anything saved before you signed in, from this phone, and keeps your account. Other accounts’ records on this phone aren’t affected. It also returns this phone’s notification settings, including Discreet reminders, to their defaults for every account on it;
• Delete account (Profile → Delete account, with an internet connection): deletes your account from our server and this account’s records from this phone, straight away. For Sign in with Apple, it also asks Apple to revoke Peptimes’ sign-in token; if Apple doesn’t confirm, the app tells you how to stop using Sign in with Apple for Peptimes in Settings;
• turn reminders, Discreet reminders, Apple Health or Health Connect, and crash reports on or off.

Deleting your account doesn’t cancel a subscription. On iPhone, cancel in Settings → your name → Subscriptions, or at apps.apple.com/account/subscriptions. On Android (when released), cancel in the Google Play Store app → your profile icon → Payments & subscriptions → Subscriptions.

What happens when:

• you sign out: your records stay on this phone, and other accounts signed in here can’t see them in the app;
• you delete the app: the phone removes what Peptimes stored on it, but your account remains until you delete it.

Requests by email. You can ask us to access, correct or delete the account information we hold, or to list the providers that receive it, by emailing privacy@peptimes.com.

• We’ll verify the request and answer within 30 days, or sooner where the law where you live requires it (§14.3).
• If you live outside the US, §14 lists more rights and where to complain.
• We won’t treat you differently for using your rights.
• If we decline, you can appeal by replying to our decision.
• Records on your phone aren’t something we can access or delete. If we delete your account at your request by email, its records on your phone can no longer be opened in Peptimes, so export them first.

Washington, Nevada and Connecticut residents: see our Consumer Health Data Privacy Policy.

Nevada residents: we don’t sell covered information. You can still send a request not to sell to privacy@peptimes.com.

12. Children

• Peptimes is for adults 18 and over, and isn’t directed to children. Where the age of adulthood is higher than 18 where you live, you must have reached it.
• We don’t knowingly collect information from anyone under 18. If we learn an account belongs to someone under 18, we’ll delete it.
• If you think someone under 18 has a Peptimes account, email privacy@peptimes.com. We’ll look into it and delete the account if so.

13. HIPAA

Peptimes isn’t a healthcare provider, health plan or business associate, so HIPAA doesn’t apply to the app or to this policy.

14. International users

This section applies if you live outside the United States. The rest of this policy applies to you too.

14.1 The basics, wherever you live

• Your health records stay on your phone. We never receive them, wherever you live. Only your account (§3) reaches our server.
• Who is responsible for your account information: PT Development LLC, doing business as Peptimes, 30 N Gould St #71196, Sheridan, WY 82801, United States. Phone: +1 (510) 863-0298. Email: privacy@peptimes.com. In data-protection terms, we are the “controller” (or “data user”, “data fiduciary” or “responsible party”) of your account information.
• Our Privacy Officer: Privacy Officer, PT Development LLC, privacy@peptimes.com, or the postal address above. Where a country’s law asks for a privacy officer, data protection officer, grievance officer, person in charge of the protection of personal information, or representative for that country, it’s our Privacy Officer, unless this section names someone else.
• Where your account is stored: in the United States. It’s sent there when you sign up and each time the app reaches our server, over encrypted connections.
• Your consent. By creating your account and using Peptimes, you give your explicit consent to the processing this policy describes, including of your account details (which show that you use a dose-tracking app) and their storage and processing in the United States and by the providers below (§3). You can withdraw it at any time by deleting your account (Profile → Delete account). Withdrawing doesn’t affect what we did before. Without it we can’t give you an account.
• Do you have to give us this information? No law requires it. But we need your email address, your name and a sign-in method to create your account. Without them, you can’t use Peptimes.
• You may use a nickname instead of your real name. We don’t check names.
• No automated decisions about you. We don’t make decisions about you by automated means that have legal or similarly significant effects. When a trial or subscription ends, the app limits features as the Terms say (Terms §5). That follows from the store’s record of your subscription, not from a profile of you.
• No sale, no advertising. §6 applies everywhere.

14.2 Who receives your account information, and where

Provider	What it does for us	Where it’s based, and where the data is processed	Safeguard for sending data abroad
Supabase (Supabase Pte. Ltd.)	Your account and sign-in; technical connection records	Company in Singapore; servers in the United States (Oregon)	Standard Contractual Clauses in its data-processing terms, with the UK Addendum and the Swiss amendments
Loops (Astrodon Corp.)	Account emails, such as password resets; the website waitlist email	United States	Its EU–US Data Privacy Framework certification, UK Extension and Swiss–US framework
Google (Google LLC)	Our support email (Google Workspace)	United States, and other countries where Google operates	Its EU–US Data Privacy Framework certification and Google’s Standard Contractual Clauses
Sentry (Functional Software, Inc.)	Crash reports, only if you turn them on	United States	Its EU–US Data Privacy Framework certification
Featurebase	Our help center and feedback board, only what you give it there (§4)	Cordnet OÜ, doing business as Featurebase, in Estonia (European Union)	Its data-processing agreement, part of its terms
RevenueCat (RevenueCat, Inc.)	Subscription status (§6)	United States	Standard Contractual Clauses in its data-processing terms, with the UK Addendum and the Swiss amendments

• Why each receives it: only to provide the service named above, under contracts that limit them to our instructions and require them to protect it.
• How long each keeps it: as in §8.
• Apple and Google receive information from you directly when you buy, sign in or use their stores, under their own privacy policies. We don’t send them your account information, except to revoke Sign in with Apple when you delete your account.
• Laws abroad. The United States and Singapore may not protect personal information in the same way as your country. Authorities there, including law-enforcement and national-security authorities, may be able to require access to it under their laws.
• More detail. On request, we’ll tell you more about these providers, the safeguards we rely on, and the privacy laws of the countries involved.

14.3 Your rights, reply times and complaints

• Your rights. Depending on where you live, you can ask us to:
  • tell you whether we hold information about you, and give you access to it and a copy;
  • correct it;
  • delete it, or stop using it (restriction or blocking);
  • give it to you, or to another company, in a machine-readable format (portability);
  • stop using it where we rely on our legitimate interests (objection);
  • tell you who we share it with;
  • withdraw your consent, at any time (this doesn’t affect what we did before).
• In the app: Edit Profile corrects your name, Export My Data gives you a copy of your records on your phone, and Delete account deletes your account and withdraws your consent.
• By email: privacy@peptimes.com. We’ll check it’s you, then answer within 30 days. Where the law where you live sets a shorter time, we meet it: one month in the EU, EEA, UK and Switzerland (which the law lets us extend by up to two months for complex requests, and we’ll tell you if we do), and 20 working days in New Zealand. We don’t charge for a request unless the law allows a fee for repeated or unfounded ones.
• Complaints. Please contact us first, and we’ll answer within 30 days. You can also complain to the data-protection authority where you live, at any time. For example: in the EU and EEA, your country’s data-protection authority; in the UK, the Information Commissioner’s Office (ico.org.uk); in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in Canada, the Office of the Privacy Commissioner of Canada (and in Quebec, the Commission d’accès à l’information); in Australia, the Office of the Australian Information Commissioner (OAIC); in New Zealand, the Privacy Commissioner; in Japan, the Personal Information Protection Commission; in South Korea, the Personal Information Protection Commission; in Singapore, the Personal Data Protection Commission; in Hong Kong, the Privacy Commissioner for Personal Data; in Brazil, the ANPD; in South Africa, the Information Regulator.
• Security breaches. If a breach affects your account information, we’ll notify the authorities and you within the times your country’s law sets (§9).

14.4 United Kingdom, European Union / EEA, and Switzerland

• Why we use your account information (legal bases):

Purpose	Legal basis
Creating and running your account, sign-in, account emails, answering your messages	Necessary for our contract with you; and, because an account with a dose-tracking app can reveal something about your health, your explicit consent, given by creating your account (§3)
Technical connection records (IP address, time, request)	Our legitimate interest in keeping Peptimes and your account secure and preventing misuse
Crash reports	Your consent (off until you say yes; §6)
Keeping records the law requires, and answering authorities	Our legal obligations

• Your health records on your phone are processed by the app on your phone, and we never receive them. You decide what to record. The consent you give by creating your account covers the processing this policy describes, including on your phone.
• Transfers: your account information goes to the United States and to providers in the United States and Singapore (§14.2). The European Commission hasn’t found Singapore adequate, and finds the United States adequate only for companies certified under the Data Privacy Framework. For each provider we rely on its framework certification or on Standard Contractual Clauses (with the UK Addendum or the UK’s international data transfer agreement for the UK, and the Swiss amendments for Switzerland). You can ask us for a copy of the relevant safeguards. Your account information reaches us in the United States because you ask us to create and run your account, and with your explicit consent (§3).
• Complaints: to the data-protection authority in the country where you live or work, or where you think the law was broken; in the UK, the ICO; in Switzerland, the FDPIC.

14.5 Canada

• The person accountable for your personal information, and the person in charge of the protection of personal information for Quebec, is our Privacy Officer, PT Development LLC, privacy@peptimes.com, 30 N Gould St #71196, Sheridan, WY 82801, United States.
• Outside Canada and Quebec: your account information is stored and processed in the United States, and by the providers in §14.2, including outside Quebec. It may be accessible to the courts, law-enforcement and national-security authorities of those countries. You can ask our Privacy Officer how we use providers outside Canada.
• Consent: you give it by creating your account (§3, §14.1). You can withdraw it by deleting your account.
• Our privacy practices: this policy is our summary of how we govern personal information: who is responsible (the Privacy Officer), how long we keep information (§8), how we handle requests and complaints (§14.3), and how we handle incidents (§9).
• Requests: within 30 days. Complaints: to us first; then the Office of the Privacy Commissioner of Canada, or in Quebec the Commission d’accès à l’information du Québec, or your provincial commissioner (Alberta, British Columbia).
• En français : la version française de cette politique est disponible à peptimes.com/fr/confidentialite.

14.6 Australia

• What we collect, how and why: §2 and §3. We collect it from you, when you sign up and use Peptimes, and from Apple or Google if you sign in with them. We hold it with Supabase in the United States.
• Health information. Because Peptimes helps you keep a record of your health, Australian law may treat your account details as health information. We collect them only with the consent you give by creating your account (§3).
• Overseas recipients: the providers in §14.2, in the United States and Singapore.
• Access and correction: ask us at privacy@peptimes.com. We’ll answer within 30 days.
• Complaints: to us first; we’ll answer within 30 days. If you’re not satisfied, you can complain to the OAIC (oaic.gov.au).

14.7 New Zealand

• Who holds your information: PT Development LLC, 30 N Gould St #71196, Sheridan, WY 82801, United States. Our privacy officer is the Privacy Officer named in §14.1.
• Purpose: to create and run your account (§3). Giving it is voluntary, but without it you can’t have an account.
• Information from others: if you sign in with Apple or Google, we receive your name, email address (or Apple’s relay address) and account identifier from them, and from Apple or Google through RevenueCat, the details of your subscription.
• Access and correction: within 20 working days. Complaints: to us, then the Privacy Commissioner (privacy.org.nz).

14.8 Brazil

• Our data protection officer (encarregado): our Privacy Officer, PT Development LLC, privacy@peptimes.com. They can answer you and the ANPD in Portuguese.
• Your rights under the LGPD: confirmation that we process your data; access; correction; anonymisation, blocking or deletion of unnecessary or excessive data; portability; deletion of data processed with your consent; information about who we share it with and about refusing consent; and withdrawing consent.
• Legal bases: performing our contract with you, your consent, our legitimate interests (security), and legal obligations (§14.4 table).
• Complaints: to us, then the Autoridade Nacional de Proteção de Dados (ANPD).

14.9 Japan

• Business operator: PT Development LLC (doing business as Peptimes), 30 N Gould St #71196, Sheridan, WY 82801, United States. Representative: Privacy Officer, PT Development LLC. Phone: +1 (510) 863-0298.
• Purposes of use: to create and run your account, let you sign in, send account emails, answer you, and keep the service secure (§3).
• Providers in foreign countries: your account information is handled by the providers in §14.2, in the United States and Singapore. Each is bound by contract to protect it with measures equivalent to those Japanese law requires. On request, we’ll give you information about those measures and the countries’ privacy systems.
• Our security measures, in summary: access to account data limited to the account holder and to authorised staff; two-step sign-in on our provider accounts; encrypted connections; contracts with every provider; and a plan for handling incidents (§9).
• Requests for disclosure, correction, addition, deletion, suspension of use or of provision to third parties: email privacy@peptimes.com. We’ll confirm it’s you first. Complaints and questions: the same address.

14.10 India

• Grievance Officer: our Privacy Officer, PT Development LLC, privacy@peptimes.com, 30 N Gould St #71196, Sheridan, WY 82801, United States. We’ll resolve grievances within one month of receiving them.

14.11 South Korea

• Privacy officer: our Privacy Officer, PT Development LLC, privacy@peptimes.com, +1 (510) 863-0298.
• Overseas transfer and processing: the items (email address, name, sign-in identity, terms and consent records, technical connection records), the countries (United States and Singapore), the recipients and their purposes (§14.2), when and how (when you sign up and each time the app reaches our server, over encrypted connections), and how long they’re kept (§8).
• How to refuse: don’t create an account, or delete it. Without the transfer we can’t give you an account, because our servers are in the United States.
• Destruction: when you delete your account, we delete your account information from our server straight away. Supabase keeps short-lived logs for a few days (§8).
• Your rights: access, correction, deletion, suspension of processing, and withdrawing consent (§14.3). Complaints: to us, or to the Personal Information Protection Commission or the Personal Information Infringement Report Center (privacy.kisa.or.kr, call 118).

14.12 Other countries: what we publish for each

Where a country isn’t named here, §14.1 to §14.3 apply.

Country	What its law asks us to publish	Where it is
Singapore	A data protection officer’s business contact	§14.1 (the Privacy Officer)
Hong Kong	Purposes, who receives the data, whether it’s required, access and correction rights, a contact	§3, §14.1–§14.3, linked at sign-up
Taiwan	The company, purposes, kinds of data, where, how long and by whom it’s used, your rights, what happens if you don’t give it	§2, §3, §8, §14.1–§14.3
Israel	Whether a law requires you to give it, the purpose, the recipients	§3, §14.1, §14.2
Philippines, Brunei, Jordan, Sri Lanka (from 1 Jan 2027)	A data protection officer’s contact	§14.1 (the Privacy Officer)
Bermuda	A privacy officer	§14.1
Peru	A representative for Peru	Representative for Peru: PT Development LLC, privacy@peptimes.com
Argentina	The regulator’s role	Argentina: the Agencia de Acceso a la Información Pública, as the authority for Law 25,326, handles complaints about breaches of personal-data rules. La AGENCIA DE ACCESO A LA INFORMACIÓN PÚBLICA, en su carácter de Órgano de Control de la Ley N° 25.326, tiene la atribución de atender las denuncias y reclamos que interpongan quienes resulten afectados en sus derechos por incumplimiento de las normas vigentes en materia de protección de datos personales.
Mongolia, Kyrgyzstan, Tajikistan, Azerbaijan, Armenia, Jordan, Lebanon, Belarus	Your consent before data goes abroad	The consent you give by creating your account (§3, §14.1)
Oman	Consent before any marketing	We send no marketing email without your opt-in (§11)
South Africa	Our name and address, purposes, whether giving it is voluntary, recipients, the transfer abroad, and the right to complain to the Information Regulator	§3, §14.1–§14.3
Türkiye	Our identity, purposes, recipients, method and legal reason for collection, your rights	§3, §14.1–§14.4 (the same legal bases apply). Complaints: the Personal Data Protection Authority (KVKK)
Moldova	A contact for privacy requests	Privacy Officer, privacy@peptimes.com (§16)

15. Changes to this policy

• If we change this policy, we’ll post the new version here with a new effective date, and tell you before a material change takes effect.
• Before using information in a materially different way (for example, storing records on our servers in a future version), we’ll ask for your consent separately.

16. Contact

PT Development LLC, doing business as Peptimes
30 N Gould St #71196, Sheridan, WY 82801, United States
Phone: +1 (510) 863-0298
Email: privacy@peptimes.com (Privacy Officer, PT Development LLC)

---

Website Privacy & Cookie Notice

The short version

peptimes.com sets no cookies and runs no advertising or cross-site tracking tools. It counts visits with Vercel Web Analytics, which doesn’t use cookies or store your IP address. The Peptimes app itself has no analytics.

Who runs it

PT Development LLC, doing business as Peptimes, 30 N Gould St #71196, Sheridan, WY 82801, United States. Phone: +1 (510) 863-0298. Email: privacy@peptimes.com.

What happens when you visit

• Our hosting provider, Vercel, receives the standard details every website receives: your IP address, browser and device type, the page you asked for, the page that linked you, and the time. It uses them to deliver the site and keep it secure. Vercel keeps short-lived server logs under its own retention policy. We don’t use them to identify or profile you.
• Visit counts (Vercel Web Analytics). When a page loads, Vercel counts the visit: the page, the page that linked you, your country, and your device, browser and operating system. It sets no cookies, doesn’t store your IP address, and doesn’t follow you to other sites; visits are grouped by a short-lived hash that resets each day, so we can’t tell who you are or link your visits over time. We see only totals. Vercel Web Analytics counts visits without cookies and without identifying you, under Vercel’s own retention policy.
• No cookies. The site sets none.
• One browser setting, kept on your device: when you leave a page, your browser’s session storage remembers how far down you’d scrolled, so the Back button returns you to the same place. It’s never sent anywhere, and your browser deletes it when you close the tab.
• One optional form: the launch waitlist. If you enter your email, we send it to Loops, our email provider, to email you once when Peptimes is on the App Store. We delete the list within 30 days after that email. The form may ask, optionally, which phone you use. If you choose Android, we keep your address until Peptimes is on Google Play instead, email you once then, and delete it within 30 days after that email. If we decide not to release on Android, we delete it then. We never ask for health details on the website. The launch email carries our postal address (above).

Links that leave the site

If you join the waitlist, Loops (our email provider) holds your email address (and, if you give it, which phone you use) for that one email. Links to the App Store, Google Play, our help center and feedback board (Featurebase), our Instagram, TikTok and X pages, and outside sources (such as the FDA or PubMed) open those sites, whose own privacy policies apply. Email links open your own email app; what you send is covered by our Privacy Policy.

Visitors in the EU, EEA, UK and Switzerland

• Why we use your information (legal bases):
  • delivering the site and keeping it secure (Vercel’s standard logs): our legitimate interest in running a safe website;
  • counting visits (Vercel Web Analytics): our legitimate interest in knowing, in total, how the site is used;
  • the waitlist email: your consent, given when you submit the form. You can withdraw it with the unsubscribe link in the email, or by emailing privacy@peptimes.com.
• No cookies, and nothing stored on your device for analytics. Vercel Web Analytics doesn’t use cookies or store your IP address.
• Where it goes: Vercel (Vercel Inc., United States) and Loops (Astrodon Corp., United States). Safeguards: Standard Contractual Clauses in Vercel’s data-processing terms, and Loops’ EU–US Data Privacy Framework certification (Privacy Policy §14.2).
• Your rights and complaints: as in the Privacy Policy §14.3 and §14.4, including complaining to your data-protection authority (in the UK, the ICO).

Do Not Track and Global Privacy Control

The site doesn’t track you across sites (its visit counts stay on peptimes.com), so these signals don’t change anything we do. If we ever add a tool that would, we’ll honor Global Privacy Control and update this notice first.

Children

The site isn’t directed to children under 13, and the app is for adults 18 and over.

Contact

privacy@peptimes.com. The app’s Privacy Policy covers everything else.