Meta Peptidez — Privacy Policy

Effective date: August 3, 2026

Meta Peptidez ("the app") is a personal peptide-tracking and educational tool, available on iPhone and Android. This policy explains what data the app handles and where it goes. It also covers the separate Meta Peptidez store website, in its own section below.

The short version: your peptide protocol, dose history, symptoms, body measurements, and photos stay on your device unless you choose otherwise. The app does not require an account. If you create an optional Peptidez account and turn on cloud backup, the data you back up is stored under your account — in a dedicated database, never connected to the anonymous usage data described below, and deletable from within the app at any time. Everything that leaves your device is optional, off unless you turn it on, and described in full below.

Who we are

Meta Peptidez is published by Rocky Mountain Information Technology LLC. For privacy questions, contact: privacy@rockymountaininfotech.com. The Meta Peptidez store described below is a separate business, operated by a different party — see Who operates the store in that section — but the same address reaches us for both.

How we handle health information

Meta Peptidez is not a medical provider and does not offer diagnosis or treatment. The app helps you organize and track information you choose to enter for personal use with a licensed professional.

We treat the data you track — doses, symptoms, body measurements, progress photos, and related notes — as sensitive health information. Our defaults reflect that:

• Local-first: core tracking data stays on your device unless you explicitly enable a cloud feature described below.
• Separate systems: your optional account backup lives in a dedicated database that is never joined to anonymous usage analytics — or to the store's database, which is a third, separate system holding no identifier in common with either (see the store section below).
• No advertising or sale: we do not sell health data, share it with advertisers, or use it for cross-app tracking.
• Breach notification: if we experience a breach of unsecured health information held on our servers, we will notify affected users and regulators as required by applicable law, including the FTC Health Breach Notification Rule where it applies.

What the app stores on your device

• Your stack and dose logs (peptides you track, dosages, schedules, and logged doses), symptom logs, body measurements, progress photos, and vial inventory are stored locally on your device — using Apple's on-device database (SwiftData) on iPhone, and an on-device database (Room) on Android.
• AI provider keys — the key created when you connect your OpenRouter account (or paste your own OpenRouter API key) for the AI assistant — are stored in the device Keychain (iPhone) or sealed with the Android Keystore, never in plain storage and never transmitted to us.
• The app does not require an account, email, or sign-in to function. An optional account for cloud backup is described in its own section below.

iCloud backup (iPhone, optional)

If you enable iCloud backup, your stack and dose logs are synced to your own private iCloud account (Apple's CloudKit private database) so they survive device loss and sync across your devices. This data is stored under your Apple ID and is not accessible to the developer. Its handling is governed by Apple's Privacy Policy. If you leave iCloud disabled, all data remains local to your device.

On Android, the app's local database is included in your device's standard Android Backup if you have that enabled in your Google account settings. That backup is handled by Google under Google's Privacy Policy, and is likewise not accessible to the developer. Your stored API key is deliberately excluded from that backup.

Peptidez account & cloud backup (optional, off by default)

You can use the entire app without an account. If you want your data to survive device loss or move with you to a new phone — including between iPhone and Android — you can create an optional Peptidez account with your email address and a password.

If you create an account and back up, we store:

• Your email address and sign-in credentials. Your password is stored only in hashed form — we never see or store it in plain text. We use your email only to operate your account (confirmation and password reset) — never for marketing.
• The data you back up: your stack, dose logs, vial inventory, symptom logs, body measurements, and saved peptides — including any notes you wrote on them. Nothing is uploaded until you sign in; while you are signed in, backup runs automatically, and signing out stops it.
• Progress photos are not backed up and remain only on your device (and in your own iCloud or Android backup, if enabled). If we later offer optional progress-photo backup, it will require a separate opt-in with its own consent — it will never be bundled silently with stack backup.

Backed-up data is stored in a dedicated database we operate (hosted on Supabase), used for nothing but your backup. Per-user access rules enforce that only you, signed in to your account, can read or write your data, and all transfers are encrypted in transit.

Your account is never connected to anonymous usage data. The optional usage data described below lives on a separate server, under a random ID with no link to your account, and the two are never joined. Creating an account does not change what usage data contains or make it identifiable.

We keep your backed-up data for as long as your account exists, so you can restore it. You can delete your account at any time from within the app (Settings → Account → Delete account); this permanently deletes your email, credentials, and all backed-up data from our servers. Signing out, or never backing up, leaves your on-device data untouched.

Optional cloud features (summary)

Some features — present or planned — send additional data only when you turn them on. Each is independent; enabling one does not enable the others.

We will update this policy's effective date and notify you in the app before any new row in this table becomes available.

Apple Health (iPhone, optional)

If you turn on weight sync, the app reads your most recent weight from Apple Health so you don't have to retype it, and writes weight you record in the app back to Apple Health. This is off until you enable it, uses only the Weight data type, and stays on your device — Health data is never sent to us. You can revoke access at any time in the Health app.

The Android version does not connect to Health Connect; weight you record there stays entirely within the app. If we add Health Connect support in the future, it will follow the same local-first rule: health data read for display stays on your device unless a future feature explicitly says otherwise in an updated policy and consent screen.

Anonymous usage data (optional, off by default)

The app can send anonymous, de-identified usage data to a server we operate (hosted on Supabase) to help us improve the peptide catalog and the app. This is off unless you turn it on, and you can turn it back off at any time in Settings.

When it is on, we receive:

• Bucketed dose ranges (e.g. "250–500 mcg") — never your exact amounts
• How often you dose, as a band (e.g. "4–6×/week") — never the exact days or times
• Peptide names you ask the AI to estimate, and catalog searches that find nothing — so we know what to add to the catalog
• Which features you open (export, calculator, assistant, and similar)
• A random anonymous ID, generated on your device, not tied to your name, email, or any account (including a Peptidez account, if you create one), and not derived from any device identifier. You can reset it at any time in Settings.

We never receive, and the app never sends:

• Your name or email
• Notes you write on any peptide or dose
• Progress photos
• Weight, measurements, or body-fat figures
• Symptom logs
• Your dose history, or exact dose amounts and times
• Your location

Data is de-identified on your device before it is sent. You can review exactly what would be sent, at any time, from Settings → Help improve the catalog → Preview my data.

This data is used only to improve the app and its catalog. It is never sold, never shared with advertisers, and never used for advertising.

AI assistant (optional)

The app includes an optional assistant you can choose to use:

• On-device mode (the default on supported devices): runs entirely on your device — with Apple Intelligence on iPhone, and with Gemini Nano (Android's built-in on-device AI, provided by the system's AICore service) on supported Android devices. Your prompts and chat content are processed on the device and are never sent to us. On Android, downloading the on-device model is handled by Google Play services as part of the operating system; the app itself sends nothing. On-device chat content is not sent to any server by the app on either platform.
• OpenRouter mode (your own account): if you connect your own OpenRouter account (or paste your own OpenRouter API key), your chat messages — including context about your current stack and estimated peptide levels — are sent to OpenRouter (openrouter.ai), which routes them to the AI model you selected (for example a Claude, ChatGPT, or Grok model). This happens only when you actively use that mode, and usage is billed to your own OpenRouter account. That data is handled under OpenRouter's Privacy Policy and the policy of the model provider you choose, under your own agreement with OpenRouter. We do not receive or store these messages. You can disconnect at any time in Settings, and revoke the app's key from your OpenRouter account dashboard.
• Peptidez Pro mode (subscription): if you have Peptidez Pro and choose the "Peptidez Pro" engine, your chat messages — including context about your current stack and estimated peptide levels — are sent to our service, which relays them to an AI model provider (via OpenRouter) to generate the response and streams it back to you. We use our own AI key, so you don't need one. We keep a count of tokens used per account (to enforce fair-use limits) but do not store the content of your conversations — messages are processed to generate the reply and then discarded. Conversation content is never used for advertising, never used to train models by us, and never sold. This mode requires a signed-in Peptidez account and will require explicit in-app consent before your first use; it only operates when you actively choose it, and the other modes remain available.

One exception on Android: the optional "AI estimate" feature for peptides not in the catalog always uses a cloud mode — Peptidez Pro if that's your selected engine, otherwise OpenRouter — because the on-device model is too small to produce reliable structured estimates. It sends only that request, and only when you use it. On devices without a supported on-device model, the assistant is available only in the cloud modes. You can use the app fully without the AI assistant.

Future Pro intelligence features (such as periodic protocol summaries) will follow the same rules: opt-in, capped, grounded in your own logged data, descriptive rather than prescriptive, and disclosed here before they ship. They will never automatically change your doses or protocols.

Progress photo backup (not yet available)

When this feature becomes available, you will be able to opt in separately from stack backup to store progress photos in your Peptidez account so they survive device loss. It will be off by default, require its own consent screen, and explain that photos are identifiable health information stored on our servers. You will be able to turn it off and delete cloud copies from Settings. We will not use backed-up photos for advertising or model training.

Web companion (planned)

We may offer a signed-in web view of your backed-up data for review and export. If we do, it will be read-only at first, use short-lived sessions, and be described in an updated policy before launch. We will not place third-party advertising or analytics scripts on pages that display your health data.

Lab data (planned)

We may let you enter or import lab results for personal organization alongside your protocol timeline. Manual entry and display without automated interpretation may arrive first. Any feature that analyzes labs or suggests actions based on them will require separate consent, will be framed as educational organization — not medical advice — and will be disclosed here before it ships. Lab values will never be automatically linked to dose changes by the app.

Notifications

If you enable dose reminders, the app schedules local notifications on your device. No notification data is sent to any server.

Meta Peptidez store (separate website, optional)

The Meta Peptidez store (store.metapeptidez.com) is a small, local, pickup-only shop paid for by Venmo. It is a website, not part of the app — you never have to visit it, you do not need it to use the app, and nothing you do in the app puts anything into it unless you deliberately link an order to your account — an optional step described later in this section.

If you place an order, we collect only what handing an order to a person actually requires:

• A display name, so we know who we are handing the order to. A first name and last initial is plenty — it is the name you will answer to at the pickup, not a legal identity check.
• One contact method — an email address or a phone number, whichever you prefer. We use it to arrange your pickup and to reach you about that order, and for nothing else. We never ask for both.
• An optional note, if you choose to write one at checkout. It is free text, it can be left empty, and what goes in it is entirely up to you.
• What you ordered, what it cost, and when — the items, the prices at the time of the order, and the order's timestamps — kept as the business records of a sale.

No shipping address is ever collected. This is deliberate, not an oversight: the store is pickup-only, so there is no address field at checkout and no address column in the store's database. An address we never ask for is one we cannot lose.

No card or bank details are ever collected, and we never see them. Payment happens entirely inside Venmo, between you and Venmo. The store shows you a handle, an exact amount and an order code; it takes no payment itself, stores no payment credentials, and has no automated connection to Venmo at all — a person reads the Venmo feed and matches your code by hand. What you send through Venmo is handled by Venmo under its own privacy policy. Note that Venmo transactions are public by default — that is Venmo's setting, not ours, and it is exactly why the note you put in the payment is a meaningless order code rather than a description of what you bought.

There is no store login and no customer account. An order is reachable only through a secret link you are given at checkout. That link is the only way in, for you or for anyone else, and we cannot regenerate it if it is lost.

Purchase certificates carry no buyer details. A confirmed order gets a certificate with a serial number that anyone can check on the store. What that check shows is the order code, the items and the total — never your name, your contact detail or your order link.

The store is a separate system from the app — and that is enforced by how it is built, not just promised. Store data lives in its own separate database, apart from both the server holding anonymous usage data and the server holding Peptidez accounts and backed-up health data. Those three systems share no identifiers and no keys in common — a store order carries no Peptidez account ID and no anonymous usage ID, and someone holding all three databases still could not match a record in one to a record in another. That holds whether or not you use the optional account link described below: linking stores a one-way hash, not your account ID, and it is not a value that appears in the accounts database. The reason is plain: an order says a named person bought a specific compound on a specific date. Sitting next to that same person's dose logs, symptom logs and body measurements, that record would become a health record. Kept in its own database, the connection does not exist to be made — not by us, and not by anyone who ever got hold of one of those databases.

What that does and does not mean. Ordering is not anonymous: you give a name and a contact method, we can see what you bought, and the order record is a record of a real person's purchase. What the separation guarantees is narrower, and worth stating plainly — your purchase never sits alongside your health data, and it is not stored in a form that can be matched to it. Buying from the store does not create a Peptidez account and changes nothing about the anonymous usage data described above. Nothing from an order reaches your health data unless you take the optional step described next, yourself.

Linking a purchase to your Peptidez account (optional, and you never have to). If you have a Peptidez account, you can choose to attach an order to it so the app can offer to import what you bought into your stack instead of you typing it in again. It is opt-in: guest checkout stays available permanently, an order is never linked unless you ask for it, and an order you do not link behaves exactly as described above. What the store keeps when you do link is not your account ID — it is a one-way keyed hash of it (a value the store calls an account_ref), computed with a secret that exists only in the store's own system. It cannot be reversed back into your account ID, and it is not a joinable identifier: someone holding a copy of the store's database and a copy of the accounts database still cannot match a row in one to a row in the other, because nothing they contain is the same value. Being exact about the limit, because it matters: that hash is deterministic, so whoever holds the secret can take a specific account and confirm whether it matches a specific order — that check is precisely how the feature works. The claim here is narrow and is only this: the value stored on your order is not an identifier that can be joined against the accounts database. It is not a claim that the link is unknowable to the system that computes it.

To prove which account is asking, the app sends your account's sign-in token to the store, and the store checks it against the accounts system's public verification key — so the store holds no secret belonging to the system that holds your health data. What the app gets back is only that account's own completed orders — the items, quantities and sizes you bought, and the certificate serials. No buyer name and no contact details are returned, because the app has already proved whose orders it is asking for and sending identity back would only copy contact details somewhere new.

Linking an order requires the private order link you were given at checkout — the order code together with its access token. A certificate serial on its own is deliberately not accepted: a certificate is made to be shown to other people and can be checked by anyone, so if a serial were enough, anyone who glimpsed one could attach your purchase to their account.

Nothing links automatically. The app never links an order on its own, and never links one in the background. It happens only when you paste your own order link and confirm it, and you can buy from the store for as long as you like without ever doing so.

Order details are never sold, never shared with advertisers, and never used for advertising.

Who operates the store. The store is operated by Dan Ivie, and that is a different party from the one that publishes the app: Meta Peptidez the app is published and operated by Rocky Mountain Information Technology LLC, which built the store's software but does not operate the store or sell anything through it. So the business you buy from is not the business that publishes the app. The point of contact is the same for both — privacy@rockymountaininfotech.com reaches us for a question about the app or about a store order.

How long we keep orders, and how to ask about one. Order records are kept as the business records of a sale, and nothing deletes them automatically — there is no scheduled clean-up, and an order record is not removed when an order is cancelled, refunded or collected. (An order that is never paid for does expire, and its items go back to stock, but the record of it stays.) To ask what the store holds about an order, or to ask for it to be removed, contact privacy@rockymountaininfotech.com — we will tell you what is held and remove what we are able to remove.

What we do NOT do

• No advertising, ad networks, or ad identifiers.
• No third-party analytics or tracking SDKs.
• No selling or sharing of your personal data — with anyone, for any purpose.
• No cross-app or cross-site tracking.
• No joining of your account with usage data — the two live in separate systems, by design.
• Your health data is never sent to us unless you choose to back it up or enable another optional cloud feature above. Without a Peptidez account, doses, symptoms, measurements, photos, and notes never leave your device except through backups you control (iCloud or Android backup). If you create an account and back up, that data is stored solely to provide your backup — never sold, never shared, never used for advertising, and deletable in-app at any time.

How long we keep things

Anonymous usage data (if you enable it) is retained in aggregate to inform catalog and product decisions. Because it carries no name, email, or account, and only a random ID you can reset, it cannot be traced back to you. If you created a Peptidez account, your backed-up data and email are kept for as long as your account exists, and permanently deleted when you delete your account in the app. AI token counts for Pro fair-use limits are retained with your account and deleted with it. Conversation content from Peptidez Pro AI is not stored. If you ordered from the store, that order record is the one thing here that lives neither on your device nor in your account: it sits in the store's own separate database and is kept as a business record of the sale, with no automatic deletion — see the store section above for what it contains and how to ask about it. Everything else lives on your device (and, if you enabled it, in your own iCloud or Android backup) for as long as you keep it.

Your control over your data

• Delete any tracked peptide, dose log, symptom, measurement, photo, or your API key at any time from within the app.
• Turn anonymous usage data off, and reset your anonymous ID, at any time in Settings.
• Delete your Peptidez account — and with it your email and everything backed up to it — at any time from within the app. No email or support ticket required.
• Export your data to CSV or PDF at any time from Settings → Export data.
• Deleting the app removes all locally stored data. If you used iCloud backup, you can also delete the app's iCloud data from your Apple ID settings.

Your consent choices

Children

Meta Peptidez is not directed at children and is intended for adults making personal health-tracking decisions in consultation with a licensed professional. The store does not accept orders from anyone under 18.

Not medical advice

Meta Peptidez is for education and personal tracking only. It is not medical advice and not a substitute for a licensed healthcare professional. Dose ranges and half-lives are approximate figures from public sources. AI-generated text and any future summaries are informational only and may be incomplete or inaccurate — always confirm with a qualified professional before making health decisions.

Changes to this policy

We may update this policy when we add features or change how data is handled. Material changes will be reflected by a new effective date above and, when appropriate, an in-app notice. If a change affects how cloud features use your health data, we will ask for your consent again before the new processing applies to you.

Contact

Rocky Mountain Information Technology LLC

• App support: support page or support@rockymountaininfotech.com
• Privacy questions: privacy@rockymountaininfotech.com