Privacy Policy

Who is responsible

Peptide Stack is published by DeadPixel Studio UG (haftungsbeschränkt), Berlin, Germany, registered at Amtsgericht Charlottenburg under HRB 279669 B, VAT ID DE459996624. Managing director: Rouzbeh Abadi.

We are the controller for the purposes of the GDPR. You can reach us at [email protected]. The full postal address is on our Imprint.

Information we do not collect

The app does not collect any of the following:

• your name, email address, phone number, or postal address;
• a persistent user identifier tied to your identity;
• your Apple ID;
• your IDFA, the identifier for advertisers;
• your precise or coarse location;
• your journal content, photos, notes, doses, injection sites, or body measurements;
• your contacts, calendar, health data, or motion data;
• fingerprints, browsing history, or any tracking data.

The app does not use tracking technologies as defined by Apple's App Tracking Transparency framework. You will not see an ATT prompt, because there is nothing to track.

Information stored on your device

The app stores the following on your device using Apple's SwiftData, Core Data, and iCloud CloudKit APIs:

• Journal, protocol, and dose data you create, including entries, tags, mood, sleep, energy, side effects, injection sites, weight, waist, hip, thigh, calf, other body measurements, and any photographs you attach.
• Preferences such as measurement units, language, appearance, notification settings, and rating-prompt state.
• Cached subscription state so the app knows whether you have Pro access when it launches offline.

If iCloud is enabled on your device, this data is replicated across your Apple devices via Apple's CloudKit private database, which uses end-to-end encryption controlled by your Apple ID. We have no access to that database.

Analytics

We use TelemetryDeck for privacy-first product analytics. TelemetryDeck receives:

• a short signal name, for example Screen.Home or paywall_open;
• optional non-identifying string parameters, for example surface: ai_tab;
• your device model, operating system version, app version, and locale;
• an anonymised, one-way-hashed installation identifier that we cannot reverse.

TelemetryDeck does not receive your Apple ID, IDFA, IP address, journal content, compound names, doses, injection sites, photographs, or any other personal data. Signals are transmitted over TLS to servers operated by TelemetryDeck in the European Union.

Subscriptions

Paid subscriptions are sold, billed, and refunded by Apple through the App Store under Apple's Terms of Sale and Privacy Policy. We use RevenueCat to verify entitlements. RevenueCat receives Apple receipt metadata and a pseudonymous App User ID that is not linked to your identity, and processes it as our processor in the United States under appropriate contractual safeguards.

Neither RevenueCat nor DeadPixel Studio ever receives your card number, PayPal account, or Apple Pay device account number. Those remain solely with Apple.

AI features

Peptide Journal generates summaries and reflections using Apple's Foundation Models framework, part of Apple Intelligence. All processing happens on your device and your journal content is not transmitted anywhere.

Peptide Stack offers an optional second-opinion feature that sends a redacted, symbolic summary of your active protocol to a large language model provider, Anthropic's Claude or OpenAI's ChatGPT. It fires only when you explicitly request it. The payload contains compound names and generic timing, but no identifying information and no journal content. Providers process it under their own policies: Anthropic, OpenAI.

Notifications

The app may schedule local notifications on your device, for example the reminders you configure. Local notifications never leave your device. We do not currently send remote push notifications.

This website

This page is served as static files and uses only strictly necessary cookies. It runs no advertising, retargeting, or cross-site tracking. Assets are served through a content delivery network, which may briefly record request-level metadata such as IP address and user agent for security and abuse prevention. That data is not linked to a user profile.

Children

The app is not directed to individuals under the age of 17 and we do not knowingly collect data from them. If you believe a minor has provided information to us, write to [email protected] and we will take appropriate action.

Legal basis and your rights

Where the EU GDPR or the UK GDPR applies to you, the legal bases for the limited processing described above are:

• Legitimate interests, Art. 6(1)(f) GDPR, for anonymised product analytics, to keep the app stable and useful;
• Contract, Art. 6(1)(b) GDPR, for delivering the app and honouring subscription entitlements;
• Legal obligation, Art. 6(1)(c) GDPR, where retention of transaction records is required.

You have the right, subject to statutory limits, to request access, correction, deletion, restriction and portability, and to object to processing. Because the app collects no personal identifier we could use to look you up, most of these rights are exercised on the device: edit or delete the data yourself, or uninstall the app and delete the iCloud container. For anything else, write to [email protected]. You may also complain to your local supervisory authority; ours is the Berlin Commissioner for Data Protection and Freedom of Information.

California residents

We do not sell or share personal information as those terms are defined by the California Consumer Privacy Act as amended by the CPRA, and we have not done so in the preceding twelve months. California residents may exercise the rights described above by writing to [email protected]. We will not discriminate against you for exercising them.

International data transfers

TelemetryDeck servers are located in the European Union. Apple and RevenueCat are US headquartered and may process metadata in the United States and other countries. Where personal data is transferred outside the European Economic Area or the United Kingdom, appropriate safeguards apply, including the European Commission's Standard Contractual Clauses.

Data retention

• Data on your device or in your personal iCloud stays as long as you keep it. Delete an entry, delete the app, or delete the iCloud container to remove it.
• Anonymous analytics signals are retained by TelemetryDeck for up to 180 days for trend analysis, then aggregated or deleted.
• Apple and RevenueCat retain subscription transaction metadata under their own policies and applicable accounting requirements.

Security

We take reasonable technical and organisational measures to protect the limited data we process, including transport encryption, data minimisation, and vendor due diligence. No method of transmission or storage is perfectly secure. You are responsible for the physical security of your device and for keeping your operating system up to date.

Changes to this policy

We may update this policy from time to time. Material changes will be signalled in the app or on this site, and the effective date at the top will be revised. Continued use after the updated policy takes effect constitutes acceptance of the changes.

Contact

DeadPixel Studio UG (haftungsbeschränkt), Berlin, Germany. [email protected]. See also the accompanying Terms of Use.