Privacy Policy

Peptide Wizard ("we", "our", "the app") is an educational tracking companion for peptide compounds. This Privacy Policy explains what data we collect, why we collect it, and how you control it.

1. What we collect

• Account data — email address and a bcrypt-hashed password when you register.
• Protocol data you enter — active peptide stacks, injection logs (dose, site, ratings), lab values, progress photos, vial purchases, wizard chat history.
• Subscription state — whether you are on the free or Pro tier. Payments are processed by Stripe; Peptide Wizard never sees your card number.
• Device metadata — anonymous crash logs and API request timestamps for reliability.
• Optional wellness metrics — weight, HRV, sleep, resting heart rate, when you choose to enter them.

1a. Vial label photos

If you use the optional "scan a vial label" feature, the photo you take is sent to our AI provider (OpenAI) so the text on the label can be read, and the extracted details are returned to you to confirm. The photo is not stored — not by us and not for AI training — and it is never linked to your account beyond the moment of the request. Camera access is only requested when you tap the scan button, and the feature is entirely optional: you can always type vial details in by hand.

2. What we DO NOT collect

• We do NOT collect precise location.
• We do NOT collect contacts, calendar, camera, or microphone data unless you explicitly grant permission and use a feature that needs it (e.g. progress photos).
• We do NOT sell or rent your data, and we do NOT share it with advertisers or data brokers.
• We do NOT run any advertising SDKs.
• Data is only ever passed to the service providers and AI providers listed in section 4, and only for the purpose described there.

3. How we use your data

Your data powers the features you see — dose tracking, cycle analytics, wizard chat responses, interaction warnings, weekly insight reports, and lab-based recommendations. Data is stored in an encrypted MongoDB database hosted on secure cloud infrastructure.

4. Third parties

• Artificial intelligence providers (Google and OpenAI) — the "Ask the Wizard" feature is powered by Google Gemini 2.5 Flash, with OpenAI GPT-4o-mini as a fallback. When you send a message, your question is transmitted to the provider along with the context needed to answer it, which may include health-related information you have logged (such as the peptides on your current protocol, your entry history and wellness entries). Under Google Play's Data safety framework this transfer is disclosed as data sharing. The providers process the request to generate a reply; we do not permit your content to be used to train their models. This is entirely optional — if you never use Ask the Wizard, none of your data is sent to an AI provider. See Google's privacy policy and OpenAI's privacy policy.
• Stripe — processes subscription payments. See stripe.com/privacy.
• Apple App Store / Google Play — in-app purchase processing and receipt validation for subscriptions.
• Google Sign-In and Apple Sign-In — if you choose to sign in with Google or Apple, that provider confirms your identity and passes us your email address and display name.
• Cloud hosting — our database and API run on secure managed cloud infrastructure, accessed only over encrypted connections and used solely to operate the app.

5. Your rights

You may:

• Export your complete data at any time from Settings → Data Export (JSON download).
• Delete your account and all associated data from Settings → Delete Account. This is irreversible and executes immediately. Full instructions, including what is deleted and what is kept, are on our account deletion page.
• Delete individual records — entries, vials, progress photos, lab results, wellness entries, measurements, reminders and protocols — without deleting your account.
• Cancel your Pro subscription at any time via the App Store subscription settings or the Stripe customer portal.
• Email support@peptidewizard.app to request a copy or deletion of your data (GDPR / CCPA compliance).

6. Data retention

Account and protocol data is retained until you delete your account; deletion from the app removes those records from our database immediately. Purchase and subscription records are retained for up to 7 years where tax and accounting law requires it — these contain a transaction identifier and amount, not your health data. Technical server logs that may include an IP address are rotated and deleted within 90 days. Anonymous aggregate counts that cannot be linked to any individual may be retained.

7. Children

Peptide Wizard is intended for users aged 17 and older. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, contact us and we will delete it.

8. Not medical advice

Peptide Wizard is an educational tracking tool. It does not provide medical advice, diagnosis or treatment. Always consult a licensed physician before starting or modifying any peptide protocol.

9. Changes to this policy

We may update this policy from time to time. The "Effective" date at the top reflects the latest revision. Material changes will be announced in-app.

10. Contact

Questions about this policy? Email support@peptidewizard.app.