Privacy Policy

Effective date: April 30, 2026 · Last updated: September 24, 2026

1. Summary

Peptly is a peptide reconstitution calculator and personal injection log. The app is built around a privacy-first model: your protocols, injection log, and notes are stored only on your device. We do not require an account, and we do not sell your personal data. The only content you create that reaches a server is feedback you choose to send from inside the app (Section 4).

The information below explains the small amount of operational data the app does collect (crash reports, analytics, attribution for advertising, feedback you send) and how Apple's App Tracking Transparency framework gives you control over tracking.

2. Data on your device

The following data is stored exclusively on your device using Apple's SwiftData framework. It is not transmitted to our servers or any third party:

• Saved reconstitution protocols (compound name, vial strength, water volume, target dose, syringe).
• Injection log entries (timestamp, compound, dose, units drawn, syringe, injection site, notes).
• Recurring schedules and their notification settings.
• Custom peptides you add, and app preferences (locale, units, paywall variant cache).

When you uninstall Peptly, this data is removed by iOS along with the app. We never see it.

3. Diagnostic and analytics data

We collect a limited set of operational data to keep Peptly stable and to understand which features people use:

• Crash reports and non-fatal errors via Firebase Crashlytics: stack traces, device model, OS version, app version, and a stable random installation ID.
• Product analytics via Firebase Analytics: events such as paywall_shown, calculation_performed, protocol_saved and schedule_created, plus the screen, locale, and a random Firebase installation ID. These events do not contain compound-level details, dose values, or any free-text notes you enter.
• Marketing attribution via AppsFlyer: install source, ad campaign, and device identifiers as permitted by your App Tracking Transparency choice (Section 6).

We do not collect your name, email, address, contacts, photos, location, or health records. The peptide names and doses you save are never sent off-device.

4. Feedback you send

If you use the feedback form inside the app, the message you type is sent to our server (Google Cloud Firestore, part of Firebase) together with: the feedback category you chose, the app version and build, your device's language and region settings, whether you have Peptly Pro, and the app's random installation ID (the same one used for analytics). We use it only to read and answer your feedback and to improve Peptly.

Please don't include health details you don't want to share. To have your feedback deleted, email [email protected].

5. Subscriptions and purchases

Peptly Pro is sold through Apple's in-app purchase system. Your payment is handled entirely by Apple: we never see your credit card, bank, or Apple ID password. We use RevenueCat to verify and manage your subscription state. RevenueCat receives a random anonymous user ID, the product you bought, the status of your subscription, and the ad-attribution details Apple and AppsFlyer provide, so we can tell which campaigns led to a subscription. It does not receive your name, email, or payment details.

6. Tracking (App Tracking Transparency)

On first launch, iOS asks whether you want to allow Peptly to track your activity across other apps and websites. Your answer is respected app-wide.

• If you allow tracking, AppsFlyer may use Apple's advertising identifier (IDFA) so we can measure which advertising campaigns brought new users to Peptly. No on-device peptide data is sent.
• If you decline tracking, the IDFA is not used and attribution falls back to Apple's privacy-preserving SKAdNetwork framework. The app behaves identically.

You can change this choice at any time in iOS Settings → Privacy & Security → Tracking.

7. Third-party services

The full list of services the Peptly app relies on:

• Apple: App Store, in-app purchase, App Tracking Transparency, SKAdNetwork.
• Google Firebase: Analytics, Crashlytics, and Cloud Firestore (feedback you send, and the app's remote settings).
• AppsFlyer: install attribution.
• RevenueCat: subscription management.

8. Children

Peptly is rated 12+ on the App Store and is not intended for children under 13. We do not knowingly collect personal information from children. If you believe a child has used Peptly, contact us and we will help you remove any associated data.

9. Your rights

Because Peptly stores almost everything on your device, you are in direct control of your data:

• Access and portability: your injection log can be exported as a CSV file from inside the app.
• Erase: Settings → Data → Reset deletes your saved mixes and injection log. Uninstalling Peptly deletes all on-device data.
• Withdraw tracking consent: change your ATT choice in iOS Settings (Section 6).
• GDPR, UK GDPR and CCPA rights: if you live in the EU, UK, or California, you have the right to request access to, correction of, or erasure of any personal data we hold. Email [email protected] with the subject line "Peptly privacy request".

10. Data retention

On-device data lives until you delete it or uninstall the app. Diagnostic and analytics data is retained per the providers' defaults (Firebase Analytics: up to 14 months; Crashlytics: 90 days; AppsFlyer: up to 2 years). Subscription state at RevenueCat is retained for the lifetime of your subscription plus a short audit window. Feedback you send is kept until it is no longer needed to answer you or improve the app, or until you ask us to delete it.

11. International transfers

Our third-party providers (Apple, Google, AppsFlyer, RevenueCat) process data in the United States and other regions. They operate under standard contractual clauses and other transfer mechanisms recognized under EU/UK GDPR. Apart from feedback you send (Section 4), no data you create flows through our servers.

12. This website (thepeptly.com)

• Page views via Google Analytics 4, with IP anonymization.
• Standard web logs at the Cloudflare edge (IP address, user agent, requested path) for security and performance.

13. Changes to this policy

When we change this policy, we update the dates at the top of this page and post the new version here. Older versions are available on request.

14. Contact

Peptly is published by Barış Bingör (sole proprietor, Istanbul, Turkey). For privacy questions or rights requests, email [email protected]. You can also reach us through the Peptly support page.