Summary
This privacy notice for Blank Labs LLC, a Wyoming limited liability company ("Blank Labs," "we," "us," or "our"), explains how we process personal information when you use PeptidePal (formerly Pep Pal), including its research library, tracking tools, AI research assistant, health synchronization, progress photos, subscriptions, Community Q&A, and the peptidepal.health website.
Your complete protocol, dose-log, stack, and chat databases are stored locally on your device and are not conventionally cloud-synced. Selected protocol, dosing, demographic, health-observation, injection-site, conversation, community, product-usage, website-funnel, purchase, and attribution information is transmitted when needed for the features and purposes described below. PeptidePal should not be understood as universally "on-device only."
Our separate Consumer Health Data Privacy Policy provides additional detail about health-related data and applicable rights.
Information We Collect
Account information. When you sign in with Apple or Google, we receive an account identifier and an email address, which may be a relay address. We store account and authentication records through Supabase. We do not receive your Apple ID or Google account password.
Profile, onboarding, and health-related preferences. We collect information you provide about goals, experience level, obstacles, peptides of interest, check-in cadence, age, biological sex, height, and weight. We use it to personalize PeptidePal, and some fields may be converted into coarse demographic bands for aggregate product features.
Local protocol and tracking databases. Complete protocol entries, dose logs, custom stacks, schedules, streak history, chat history, and local preferences are stored on your device. We cannot restore these complete databases after you uninstall the app or lose the device. Selected fields from them are transmitted for specific features, including daily usage reporting and AI chat.
Daily protocol-usage reports. Once per day, PeptidePal may send one entry for each distinct peptide in active protocols to our backend. A report may include peptide identity, raw scheduled dose, unit, frequency, delivery form, blend details, age, height, weight, or BMI bands, biological sex, and goals. Reports use a one-way hash of a device identifier rather than the Supabase account identifier. Aggregate results use minimum-cohort suppression. The report-retention period has not been verified.
Health observations and platform health data. Measurements you enter, such as weight, body fat, lean body mass, waist circumference, and mood, synchronize to your private PeptidePal backend account. If you authorize Apple Health or Health Connect, PeptidePal reads selected observations locally and synchronizes them to that private account. With the applicable platform permission, PeptidePal may write supported observations back to Apple Health or Health Connect.
Progress photos. Photos you choose to capture are stripped of EXIF metadata before upload and stored in private, account-scoped storage. They are not displayed to Community members or sent to our AI or advertising providers.
AI conversations and context. When you use AI chat, PeptidePal sends your message, prior messages supplied as conversational context, and automatically generated active-protocol context through our backend to Anthropic. That context can include protocol and peptide names, dose amounts, units, and schedules; recent injection-site history is included for supported questions. There is no per-send opt-in control for this context today.
Community Q&A. We store questions, answers, votes, reports, blocks, a generated pseudonym, an avatar, and moderation records. Questions, answers, votes, pseudonyms, and avatars are visible to authenticated Community members but are not intended to be publicly indexed on the open web.
Subscription and referral information. We process information needed to determine entitlements and administer purchases through Apple, Google Play, Stripe, or PayPal. Depending on the channel, this may include provider, product or plan, subscription status, price and currency, a transaction or subscription identifier, current-period or trial dates, referral code, and redemption records. Apple, Google, Stripe, and PayPal process payment methods; we do not receive complete card or store-payment credentials.
App analytics and advertising attribution. We and our providers process device-scoped or pseudonymous identifiers, app version, environment, screens and features used, engagement counts, sign-in or registration completion, installs, app opens, trials, purchases, campaign attribution, and related events. AppsFlyer and Appstack receive a parameter-free first_dose_logged milestone once per install. It does not include a peptide name, dose amount, protocol, health measurement, name, email address, or Supabase account identifier. A dedicated consent gate for this milestone is not currently implemented.
Website Product Analytics
Marketing-page measurement. If you allow product analytics, our landing page, guides, and tracker pages send page-view and download-button events to PostHog using a separate random per-tab session identifier. These events include only a broad page category, button placement, and destination category (download section, download dialog, iOS, or Android). They do not include the page URL, guide topic, referrer, campaign text, quiz answers, email, or health details. They do not create person profiles or establish that an app was installed. Cookies are omitted from these requests and referrer information is suppressed; ordinary network transport metadata can still reach the provider. Declining analytics or enabling Global Privacy Control prevents this measurement.
PostHog on peptidepal.health. Our application code sends explicit funnel milestones with a random journey identifier only while product analytics consent is granted and both PostHog configuration values are present. In the protocol guide, a linked legal disclosure points to this policy, and continuing from the first protocol-guide question grants this optional category only when it was previously undecided; an existing opt-out remains denied. Other website flows may ask for an explicit product analytics choice. Global Privacy Control forces both optional website categories off.
Checkout analytics can record which closed-set payment options were visibly available or selected (such as card, Link, Apple Pay, Google Pay, Amazon Pay, or PayPal), plus the provider and method category for a verified completed purchase. These events exclude payment-provider object identifiers, complete card data, billing details, and payment credentials.
Funnel analytics records the sequence of steps viewed and completed, navigation, timing, and checkout milestones using a random browser-stored journey identifier. It does not send raw quiz answers, birth year, measurements, email, email hashes, or your account identifier to PostHog. Signup and checkout retain that journey identifier without creating an email-keyed person profile. This is pseudonymous measurement, not a guarantee of anonymity or a way to identify the same person across devices.
The application reconstructs event payloads from a per-event property allowlist and excludes Supabase account identifiers, URLs, query strings, referrers, advertising click identifiers, names, and free text. The application code also disables session replay, autocapture, automatic page views, surveys, console capture, and network capture, and disables person profiles and identity/alias events.
These are code-enforced controls. The current production PostHog project retention, IP and GeoIP handling, AI-feature settings, proxy configuration, keys, and live-event behavior have not been live-verified for this update and remain unresolved operational facts. If PostHog is enabled, normal transport metadata such as an IP address, user-agent details, and request timestamps may still be processed. You can withdraw product analytics consent through Website Privacy Choices below; withdrawal stops future events and clears PostHog browser persistence. This change does not automatically delete earlier events or email-keyed profiles created by previous versions. A deletion request covers the random funnel identifier and any earlier email-keyed profile associated with it.
Website Advertising Measurement
Meta measurement requires an independent advertising-measurement consent state. Advertising starts only after an intentional interaction on a screen that links our Terms and Privacy Policy, and only when this category was previously undecided; an existing advertising opt-out remains denied. On explicitly allowlisted quiz routes, the Meta Pixel runs only inside a sandboxed, no-referrer attribution bridge. The bridge receives approved advertising identifiers and generic page-entry or standard conversion events, but it does not receive the parent route, funnel name, quiz answers, result context, free text, or PostHog identity. Product analytics consent does not enable Meta.
Marketing-page downloads may use Appstack links after you allow advertising measurement. Appstack receives the website campaign, ordinary connection/device information, and supported install and purchase attribution signals. We do not add your email, quiz answers, page URL, or website journey identifier to these links, and browser referrers are suppressed. Without this consent, with Global Privacy Control, or when optional tracking is disabled, downloads use direct-store links or an untracked QR destination. The desktop popup always offers direct-store alternatives. This website preference does not change the mobile app's own attribution settings.
A completed website purchase may be sent through Meta's server-side Conversions API only when checkout request values and first-party consent cookies agree that advertising consent version 1 was granted. This stored consent state is user-agent evidence, not cryptographically signed proof. Missing, malformed, duplicate, or disagreeing evidence fails optional measurement closed without blocking checkout.
The purchase event uses the generic router as its source URL, not a health-funnel URL. It may include purchase value and currency, the Stripe Checkout Session identifier used to deduplicate approved browser and server purchase copies, validated Meta browser identifiers, a one-way SHA-256 hash of the checkout email, and the checkout request's browser user agent, captured only when advertising consent was granted. We do not send Meta your readable email, name, Supabase account identifier, quiz answers, funnel slug, result context, or health details.
If you install the app from the website, we may route a store link through an AppsFlyer OneLink carrying campaign parameters and a device-scoped click identifier, but not quiz answers or health details.
First-Party Funnel Progression Events
Our standalone website funnels send a small set of first-party funnel progression events to our own server. Each contains the event name, canonical funnel identifier and version, step identifier, timestamp, and a random per-tab session identifier. Where relevant, it can also contain a low-cardinality branch identifier, protocol status, a duration bucket, and an aggregate selection count. We never send raw quiz answers, option labels, symptom answers, birth year, measurements, the consent label, your name, or your email in these events. They are written to structured application logs in Google Cloud and are not used to make health inferences. Under the repository's logging controls, we retain these funnel-event logs for 30 days.
How We Use Information
We use information to create and secure accounts; provide protocol, dose, health, photo, chat, injection-site, and Community features; synchronize supported observations; personalize the app; generate AI responses; moderate and protect Community Q&A; calculate aggregate product and community statistics; provide support; administer subscriptions and referrals; measure product performance and advertising effectiveness; prevent abuse and fraud; debug and secure the service; and comply with legal obligations.
AI Chat
AI responses are generated by a large language model and may be inaccurate, incomplete, or outdated. PeptidePal's AI is designed for general research and is configured to refuse personalized dose, titration, protocol, cycle, and stack recommendations. It is not medical advice.
Blank Labs does not persist AI messages or responses as server-side chat history. The response is returned to and stored on your device. Our current provider is Anthropic, PBC. Anthropic does not use commercial API inputs and outputs to train its generative models by default. Its standard API retention generally deletes inputs and outputs within 30 days, subject to contractual settings and exceptions for law, safety, and usage-policy enforcement. Content flagged for suspected policy violations may be retained longer under Anthropic's policies.
Your account email and Supabase user identifier are not included in the AI request. If we change AI providers or materially change the context sent, we will update this notice.
Community Q&A
Community participation is pseudonymous, not anonymous to Blank Labs: posts are associated with your authenticated account while the account exists, but other members see a generated pseudonym and avatar rather than your account email. Do not post information that directly identifies you or another person.
Community posts are screened by automated moderation before publication. Members can report content and block other members. We use Community information to operate, moderate, secure, and improve the forum. We do not use profile health goals, medical history, protocols, dose values, health observations, or progress photos to rank Community content or target advertising within Community.
You can delete your own posts before deleting your account. If you delete your account, your Community profile, pseudonym, votes, and account association are removed, but published questions and answers may remain in disassociated form under a generic member identity.
Service Providers and Other Recipients
- Apple Inc. — Sign in with Apple, App Store purchases, push notifications, Apple Health integration, and platform attribution services.
- Google LLC. — Sign in with Google, Google Play purchases, Health Connect integration, and Google Cloud hosting.
- Supabase Inc. — authentication, Postgres database, and private file storage.
- Anthropic, PBC. — AI response generation from messages and automatically generated protocol or injection-site context.
- Superwall Inc. — paywall presentation, purchase and entitlement support, and paywall analytics.
- Stripe, Inc. — direct web checkout, subscription billing, and payment processing.
- TelemetryDeck GmbH. — device-scoped product analytics and engagement counts.
- PostHog, Inc. — consent-gated website funnel analytics using a random journey identifier if the service is configured; older versions may have created email-keyed profiles.
- Meta Platforms, Inc. — limited app-event, website-event, purchase, and campaign-attribution measurement subject to the boundaries above.
- AppsFlyer Ltd. and Appstack. — install, registration, subscription, purchase, and first-dose milestone attribution.
- Other Community members. — content and pseudonymous profile information you choose to publish in Community Q&A.
We may also disclose information when required by law, to investigate abuse or security incidents, to protect rights and safety, or as part of a corporate transaction subject to appropriate safeguards.
Sale, Advertising, and Tracking
We do not sell personal information to data brokers or exchange consumer health data for monetary consideration. We use limited app, device, subscription, and milestone events with Meta, AppsFlyer, and Appstack to attribute installs and measure Blank Labs' advertising. We do not send those providers your name, readable email address, Supabase account identifier, progress photos, health measurements, complete protocol, peptide identity, or raw dose value. As described above, an advertising-consented web purchase may include a one-way hash of the checkout email.
PeptidePal does not request Apple's App Tracking Transparency permission and does not intentionally collect IDFA without permission. Advertising and attribution technologies may use other platform, campaign, or device-scoped signals. Whether applicable law characterizes a flow as a "sale," "sharing," or targeted advertising depends on that law; you may contact us to exercise any applicable opt-out right.
Retention
- Complete local protocol, dose, stack, and chat histories remain until you clear them, delete your account through the app, reset the app, or uninstall it.
- Account, profile, health-observation, and progress-photo records remain while your account is active or until you delete an item, subject to limited backup, security, legal, accounting, and fraud-prevention retention.
- Daily protocol-usage reports use a hashed device identifier rather than your account identifier and may remain in product-research records; a specific retention period has not been verified.
- Published Community questions and answers may remain after account deletion in disassociated form unless you delete them first.
- Referral, provider-attribution, transaction, consent, support, security, and legal records may remain as applicable.
- Analytics and attribution providers retain information under their own contracts and retention practices.
- Anthropic retention is described in the AI Chat section above.
Security and International Transfers
We use safeguards including TLS, authenticated requests, private storage, row-level database security, and access controls. No security measure is perfect, and we cannot guarantee absolute security.
Blank Labs and its providers may process information in the United States and other countries, which may provide different levels of data protection. We will take measures required by applicable law for cross-border transfers.
Minors
PeptidePal is for adults aged 18 and older. We do not knowingly permit anyone under 18 to register. If you believe a minor has provided personal information, contact us so we can investigate and delete it as appropriate.
Your Privacy Rights and Export
Depending on where you live, you may have rights to access, correct, delete, or obtain a portable copy of personal information; withdraw consent; object to or opt out of certain processing; and appeal a refusal. These rights may be subject to legal exceptions and identity verification.
Email help@blanklabs.io from the address associated with your account and describe your request. The authenticated self-service export currently returns health observations only; it is not a comprehensive export of every category described in this policy. Additional health-data rights appear in our Consumer Health Data Privacy Policy.
Website Privacy Choices
Use these controls to allow or withdraw optional product analytics and advertising measurement independently. Saving either choice as off records a denial. Global Privacy Control keeps both choices off.
Account and Data Deletion
In-app account deletion removes your authentication record, profile, account-linked health observations, and progress photos, and the app then clears its local data. It does not guarantee immediate deletion of every backup, provider record, transaction, security record, legal record, or device-scoped record.
Referral records may be detached and retained for accounting. Published Community questions and answers may remain in disassociated form. Device-hash reports and attribution records not linked to your account may not be reachable through account deletion. See our Data Deletion page.
Account deletion and subscription cancellation are separate actions. Deleting your account or uninstalling PeptidePal does not cancel an Apple App Store, Google Play, or Stripe subscription. Stripe cancellation is complete only when support confirms it. See our Refund Policy and Terms of Service.
Global Privacy Control
Within the mobile app, PeptidePal does not receive browser-based Global Privacy Control signals. On peptidepal.health, Global Privacy Control is treated as a denial of both optional website product analytics and advertising measurement, overrides a prior grant, and prevents optional PostHog and Meta events. The website's GPC choice does not change mobile-app attribution settings.
Changes and Contact
We may update this notice as our practices or legal obligations change. We will post the revised notice with a new date and provide additional notice when required.
Contact Blank Labs LLC, a Wyoming limited liability company, at help@blanklabs.io.