Peptideo · Legal
Privacy Policy
How we collect, protect, and process your personal data, in line with the GDPR.
IN EFFECT SINCE 1 JUN 2025 · REVISED JUN 2025
Peptideo is a personal logging tool for educational and informational use. Your privacy is our priority. We do not sell data, we do not share individual records with third parties, and we never use your health data for commercial purposes.
01
Data controller
The controller of personal data collected through Peptideo is the service operator, reachable at support@peptideo.app.
For the purposes of the General Data Protection Regulation (GDPR — Regulation (EU) 2016/679), the controller is the entity that determines the purposes and means of processing personal data.
02
Data we collect
We collect only the data needed to provide the service:
Email address and password (for authentication)
Display name (optional, set by the user)
Body weight (optional, used only in dose calculators)
Dose logs, stock, cycles, notes, and reminders you enter yourself
Privacy preferences and account settings
Technical session data (authentication tokens, last-access timestamp)
We do not collect location data, we do not access the camera or microphone, and we do not track behaviour outside the platform.
03
Purpose and legal basis
Data is processed for the following purposes:
Providing the personal logging service (basis: performance of a contract)
Account authentication and security (basis: legitimate interest)
Improving the platform through anonymous aggregated analytics, where consented (basis: consent)
Compliance with legal obligations, including under the GDPR (basis: legal obligation)
We never process your health data for marketing, behavioural advertising, or sharing with third parties without your explicit consent.
04
Storage and security
Data is stored on Supabase infrastructure (PostgreSQL with encryption at rest), located on servers in the European Union. Transmission is protected by TLS.
We apply Row Level Security on the databases, which means each user can access only their own data; not even platform engineers can access it without explicit authorisation.
Passwords are never stored in plain text. They are managed by the Supabase authentication layer, which uses bcrypt with salt.
05
Sharing data with third parties
We use the following sub-processors to provide the service:
Supabase Inc. — database and authentication (EU)
Vercel Inc. — web application hosting (EU/US under standard contractual clauses)
RevenueCat Inc. — subscription management (native apps only, US under SCCs)
We do not share your data with advertisers, data brokers, insurers, or healthcare entities.
06
Data retention
Data is kept while the account is active. You can request deletion at any time through the app Settings or by email to support@peptideo.app.
After deletion, data is removed from the active databases within 30 days. Encrypted backups are deleted in the next rotation cycle (maximum 90 days).
07
Your rights (GDPR)
Under the GDPR, you have the following rights:
Access — obtain a copy of your personal data
Rectification — correct inaccurate or incomplete data
Erasure ("right to be forgotten") — request deletion of your data
Portability — receive your data in a structured, machine-readable format
Objection — object to processing based on legitimate interest
Restriction — restrict processing in certain circumstances
To exercise any of these rights, use the "Export data" or "Delete all data" function in the app Settings, or contact us at support@peptideo.app. We will respond within a maximum of 30 days.
You also have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD) at cnpd.pt.
08
Cookies and tracking
The web application uses localStorage only to keep the authenticated session. We do not use tracking cookies, marketing pixels, or advertising identifiers.
Analytics, when enabled, is anonymous and aggregated. It does not allow individual users to be identified.
09
Minors
Peptideo is not intended for anyone under 18. We do not knowingly collect data from minors. If we learn that a minor has provided personal data, we will delete that information immediately.
10
Changes to this policy
We may update this policy from time to time. We will notify registered users by email of material changes. The version in force is always available at www.peptideo.app/privacy.
11
Contact
For questions about privacy, data protection, or to exercise your rights:
support@peptideo.app
www.peptideo.app
Peptideo — For educational and informational purposes only. Not medical advice.