Privacy Policy

1. Overview

PepTrac is owned and operated by Blanket LLC (“PepTrac,” “we,” “us,” or “our”), located at 1209 Mountain Road Place Northeast #5747, Albuquerque, NM 87110, United States.

This Privacy Policy explains how we collect, use, store, disclose, transfer, and protect information when you use the PepTrac mobile application (the “App”), peptrac.app, and related services (together, the “Services”). Blanket LLC is the controller responsible for personal information processed to operate the Services.

This policy describes our practices. Reading or accepting it does not, by itself, provide any separate consent or authorization required for processing sensitive information. Where applicable law requires a separate consent, authorization, or opt-out mechanism, that requirement applies independently of this policy.

For consumer health data, also see our Consumer Health Data Privacy Policy.

2. Medical Disclaimer

PepTrac provides record-keeping, organizational, educational, and informational features. It is not a healthcare provider, medical device, pharmacy, telehealth service, or emergency service.

AI responses, research summaries, food estimates, syringe and reconstitution calculations, modeled level ranges, reminders, and tracking insights are informational tools. They are not medical advice, diagnoses, treatment recommendations, prescriptions, or instructions to take a substance or change a dose. Modeled levels are not measured blood levels, and nutrition estimates may be inaccurate.

Consult a qualified healthcare professional before making health-related decisions. Do not rely on PepTrac in an emergency.

3. Key Terms

Personal information means information that identifies, relates to, or can reasonably be linked to an individual or household.

Health data means information about your health, wellness, body, peptide or medication use, dose logs, injection sites, weight, nutrition, hydration, sleep, exercise, symptoms, and similar information you enter, upload, import, or generate in PepTrac. Health information included in messages, images, recordings, or notes is also health data.

Sensitive personal information means information treated as sensitive under applicable law, including health data, certain account credentials, and other protected information.

Consumer health data means health-related information protected by applicable consumer health privacy laws, including Washington’s My Health My Data Act and Nevada’s consumer health data law. It may include information inferred or derived from your records.

De-identified data means information processed so it cannot reasonably identify or be linked to you, subject to the requirements of applicable law. Removing a name alone does not necessarily make information de-identified.

Aggregated data means information combined into summaries or statistics. Aggregation alone does not guarantee that information is anonymous.

4. Where This Policy Applies

Features and platform availability may differ by App version. Listing a provider or platform does not mean that every feature is available on every device.

5. Information We Collect

Account Information

We collect information needed to create and manage your account, including your email address, account identifier, authentication information, and name or username if supplied. Sign in with Apple may provide a name, email address, relay email address, and authentication identifier according to your choices and Apple’s settings. We also store account settings, timezone, preferred units, and relevant consent records.

We use account information for authentication, account management, syncing, support, and security. Third-party sign-in providers process your credentials under their own policies.

Onboarding and Personal Details

You may provide your age, sex or gender selection, height, current and goal weight, goals, peptide experience, compounds you track, how you heard about PepTrac, and preferences. These inputs support personalization, relevant tracking tools, estimates, reminders, and display settings. PepTrac currently asks for age rather than a full date of birth.

Tracking Data

Depending on the features you use, we collect:

• Compound names, custom names, vial quantities, inventory, routes, reconstitution amounts and dates, bacteriostatic water inventory, and preferred measurement units.
• Protocols and schedules, doses you enter, timestamps, injection sites, notes, and dose history.
• Weight history, body measurements you enter, personal goals, and activity information.
• Foods, meals, serving sizes, nutrition estimates, nutrient targets, hydration entries, and sleep entries.
• Exercise selections and custom exercises, workout templates and folders, sets, repetitions, weights or assistance, duration, distance, effort, rest intervals, workout notes, and completion history.
• Wellness information and symptoms you choose to include in supported logs, notes, photos, or AI conversations.
• Reminder preferences, streaks, achievements, and estimates derived from your records, such as adherence, inventory forecasts, modeled level ranges, and nutrition targets.

We do not collect a record simply because a feature could support it; collection depends on your entries, permissions, and use of the Services.

Meal Scanner and Food Assistance

If you use meal scanning, your selected or captured meal photo is uploaded through PepTrac’s servers and sent to OpenAI to estimate the food and nutrition. The App can use the result to create a food entry you choose to save. The current meal-scan request does not automatically attach your full health profile.

If you request AI-generated nutrition for a food, the food name and serving description are sent to OpenAI. Food names, serving descriptions, and resulting nutritional estimates can be cached without an account identifier and reused to answer later requests. Do not include personal or medical details in food names or serving descriptions.

Food searches and barcode lookups send the search text, food identifier, or barcode through our API to USDA FoodData Central or Open Food Facts. These lookup requests do not include your account identifier or your private tracking history.

Uploaded Images and Camera Access

Photos you select for AI chat or meal scanning may be stored in private cloud storage and processed by our AI provider. Images may reveal health information, faces, labels, or other identifying details. Only attach information needed for your request.

Camera and photo-library permissions support capturing or choosing images and saving or sharing supported App outputs. Accessing the local photo picker does not upload your entire photo library. Selected chat images are resized and reencoded before upload to reduce file size and remove embedded image metadata.

PepTrac AI Messages

When you use AI chat, OpenAI may receive your current message, relevant conversation history, selected images, and a context summary assembled from your saved records. That summary can include your name, goals, current and goal weight, timezone, preferred units, compounds and vials, reconstitution information, active protocols, recent doses and injection sites, weight history, and computed tracking insights. Additional relevant information may be supplied when the assistant retrieves records to respond to your request.

Health measurements previously imported from Apple Health can be included if they have become part of the saved records used by AI chat. Using chat is optional; you can use other supported tracking features without sending a chat request.

Messages, responses, and attachment references are saved to your account for chat history. We do not use your private health data to train PepTrac-owned AI models. Provider processing and retention are described in Sections 9 and 13.

Voice Input

When you use PepTrac’s recording feature, your microphone captures a recording that is uploaded to our API and sent to OpenAI for transcription. The resulting text returns to the App and can be submitted as a chat message. Our transcription route does not save the original audio in our tracking database; temporary device files and provider processing may still occur.

If you instead use your device keyboard’s dictation feature, Apple or another device service handles that dictation under its own settings and privacy policy.

Apple Health Data

With your permission, supported versions of PepTrac can read steps, active energy burned, walking/running distance, height, and body weight. PepTrac can also write saved height and weight to Apple Health when you authorize those write permissions.

Imported height is saved to your PepTrac profile and imported weight is saved to your account’s weight history. Those values sync like records you enter yourself and can be used by relevant App features, reports, and AI context when you request AI chat. Authorized activity values are read for activity views and report generation; the current Apple Health activity flow does not save those activity values to our cloud tracking database.

You can change or revoke permissions in Apple Health or your device settings. PepTrac’s Disconnect control stops automatic syncing on that device; it does not revoke the underlying Apple permission or erase previously imported records. A later manual sync can reconnect the integration. Full revocation through Apple Health also controls access by manual sync and report generation. Deleting PepTrac records does not itself delete the source records in Apple Health.

The current App does not integrate with Android Health Connect. HealthKit restrictions and safeguards appear in Section 11.

Subscription Information

RevenueCat and the applicable app store process purchases and subscription entitlements. We may receive account-linked purchase identifiers, product identifiers, entitlement and subscription status, renewal or expiration information, trial eligibility, and purchase/restore metadata. RevenueCat receives an App-specific identifier that may be associated with your PepTrac account identifier.

We do not receive your full payment card details. The store handles payment information under its own privacy policy.

Notifications and Live Activities

We store notification preferences and, if you enable push notifications, a device push token and platform information. Cloud push delivery providers receive the token and notification payload. Payloads can reveal use of PepTrac or a tracking activity, such as a streak. Some reminders are scheduled locally on your device.

Workout timers and Live Activities can display exercise names, set details, weights, and countdowns on the Lock Screen or Dynamic Island. Notification previews and shared screens may be visible to others nearby. You can control notifications and Lock Screen visibility in App and device settings.

Device and Technical Information

Our systems and service providers may process IP addresses, request timestamps, device and operating-system information, App version, authentication/session information, usage-limit records, error information, and network or security logs to deliver the Services, troubleshoot failures, and prevent abuse.

The App includes the Meta (Facebook) SDK for advertising measurement. It sends Meta app events such as installing or opening the App, creating an account, finishing onboarding, and viewing the subscription screen, together with device and technical information such as IP address, device model, operating-system and App version, and an SDK-generated anonymous identifier. If you allow tracking when your Apple device asks (Apple’s App Tracking Transparency prompt), your device’s advertising identifier is included, and RevenueCat also reports trial and subscription events to Meta with that identifier. If you do not allow tracking, the advertising identifier is not collected and subscription events are not reported to Meta. These events never include the compounds, doses, measurements, photos, messages, or other health information you enter. You can change your choice at any time in your device’s Settings under Privacy & Security > Tracking. The App and public website do not use dedicated third-party product analytics or session-replay tools, and the public website does not use advertising pixels.

Support and Feedback

We process the contact details, messages, attachments, and troubleshooting information you choose to send to team@peptrac.app. Avoid unnecessary health details. Health information included in a support request receives the protections applicable to that information.

Feature-request titles, descriptions, comments, and vote totals are visible to other signed-in users. The current feedback interface does not display the author’s account identifier. You can still identify yourself or disclose health information through the content you post, so do not put private health records into the feedback board.

6. Health Data

We collect health data directly from your entries, uploads, recordings, and messages; from Apple Health when authorized; and through estimates and inferences generated from your records. Collection includes processing information you ask an AI feature to analyze.

We use health data to provide requested tracking, history, inventory, reminders, fitness, nutrition, reports, calculations, personalization, and AI features; save and sync records; maintain reliability and security; and resolve support requests. Access by personnel is limited to what is needed for support, security, compliance, or another authorized purpose.

Relevant health data is processed by cloud infrastructure providers and, when you request an AI feature, by OpenAI. Notification providers can receive information included in a notification payload. Your chosen report recipients, Apple Health when you authorize exports, and other users when you post feedback can receive the information you direct us to disclose.

We do not sell or license consumer health data, use it for advertising, share it for targeted advertising, or use it to train our own AI models. We do not use geofences around healthcare facilities to identify or target people seeking health services.

Our separate Consumer Health Data Privacy Policy explains categories, purposes, sources, recipients, and applicable consumer health rights. Where law requires consent or authorization beyond providing a service you request, we must obtain it before the relevant processing. This policy is not a substitute for that consent.

7. How We Use Information

We use information to:

• Operate the Services, authenticate accounts, and save and sync records.
• Provide tracking, history, inventory, protocols, calculators, fitness, nutrition, reports, and educational features.
• Generate estimates and personalized outputs from the information you provide.
• Provide AI chat, image analysis, nutrition estimates, and transcription you request.
• Manage subscriptions, entitlements, trials, purchase restoration, and associated support.
• Deliver enabled reminders, notifications, transactional communications, and account messages.
• Send promotional emails where you have opted in; your marketing choice is separate from necessary account and service communications.
• Operate the feedback board and respond to support or privacy requests.
• Diagnose failures, maintain reliability, protect accounts, prevent fraud and abuse, comply with law, and protect legal rights.

We do not routinely review private AI conversations for general product improvement or publish private tracking information in marketing. Authorized personnel may access relevant information when needed to resolve your support request, investigate abuse or a security issue, or comply with a legal obligation.

Reviews and Testimonials

If we want to feature a testimonial you send us, or use your private health records, photos, or messages in marketing, we will seek separate permission and any additional authorization required by law. Using PepTrac does not grant blanket permission to use your private health information in advertising. Contact team@peptrac.app to withdraw permission for future use, subject to applicable law.

8. Future Uses We May Consider

This policy does not authorize a future research partnership, data sale, data licensing program, or new advertising use. We do not operate those programs with your personal or consumer health data.

If we introduce a materially different practice, we will first update the relevant disclosures and provide the notices, choices, consent, or authorization required by law. Existing HealthKit restrictions continue to apply. Business transfers are addressed in Section 9 and do not override your privacy rights.

9. How We Share Information

Service Providers

We disclose information to providers as needed to operate the Services and deliver features you request. Providers’ roles and applicable terms vary; app stores and user-selected third-party services also process information under their own policies.

OpenAI API inputs and outputs are not used to train OpenAI models by default under its published API data controls. Provider logging, retention, and any applicable account configuration remain relevant; this is not a promise of zero retention. See OpenAI’s API data controls.

At Your Direction

We disclose information when you choose a recipient through a share sheet, share a PDF report or workout image, authorize Apple Health writes, or post on the feedback board. The recipient may retain or redistribute the information under their own practices. Review exports before sharing them.

Legal and Safety Disclosures

We may disclose information when required by applicable law or valid legal process, or where legally permitted and reasonably necessary to investigate abuse, protect security, establish or defend legal claims, or protect rights and safety. Sensitive and consumer health information remains subject to additional legal restrictions.

Business Transfers

If Blanket LLC or PepTrac is involved in a merger, acquisition, reorganization, bankruptcy, or sale of all or part of the business, information may transfer as part of that transaction, subject to applicable law. A successor must respect applicable restrictions, privacy rights, and any consent or authorization requirements. A transfer does not authorize unrelated health-data commercialization, advertising, or AI training.

HealthKit commitments take precedence over broader business-transfer language. We will provide required notices and obtain required consent before any material new use.

10. What We Do Not Currently Do

PepTrac does not:

• Sell or license your personal information or consumer health data.
• Use health data for advertising or share it with advertising platforms.
• Train PepTrac-owned AI models on private health records or conversations.
• Use advertising pixels on the public website or session-replay recordings in the current Services.
• Routinely review private chat content for general product improvement.
• Use HealthKit data for sale, advertising, marketing, or prohibited data mining.
• Use healthcare-facility geofencing to identify or target people seeking health services.
• Provide medical advice, diagnosis, treatment recommendations, prescriptions, or dosing instructions.

Requests you send to an AI feature and disclosures needed to deliver the Services are still processing and sharing as described above.

11. Apple HealthKit Commitments

Apple Health access is optional and limited to supported data types you authorize. We use authorized information to provide relevant personal tracking, activity views, reports, and related features you request. Saved height and weight can be written to Apple Health only with the relevant permission.

We do not sell HealthKit data, use it for advertising or marketing, or use it for prohibited data mining or AI model training. We disclose it only as permitted by Apple’s rules and applicable law, including required permission for a requested feature. Imported height and weight are cloud account records; relevant saved weight can be included in AI chat context, as explained in Section 5.

Disconnecting stops automatic sync on that device; revoking permissions in Apple Health stops the corresponding future reads and writes. Neither action automatically deletes saved PepTrac copies or Apple Health source records. You can delete PepTrac records or submit a deletion request as described below. These commitments override broader future-use and business-transfer language.

12. Where and How We Store Data

We use technical and organizational safeguards designed to protect information, including encrypted network connections, authenticated access, private storage access controls, and user-scoped database policies. Cloud providers maintain their own storage protections. Device copies rely on your device’s security; we do not promise additional encryption of every local file or cache.

No system can guarantee absolute security. We will provide breach notifications where required by applicable law.

13. Data Retention and Deletion

We retain personal information for the purposes described in this policy for as long as reasonably necessary, taking into account account status, the feature involved, your deletion choices, security needs, and applicable legal obligations.

Delete Tracking Data removes supported tracking records while keeping your account, profile, settings, and certain operational information. It is different from deleting your account and does not remove feedback-board submissions or shared food-reference caches.

Delete Account removes your account and associated records from active cloud account systems, including cloud chat attachments as part of the deletion process. Device caches, local workout files, and exported reports may remain on your device; use device storage controls to remove local copies. Store subscriptions must be canceled separately through the applicable store; deleting an account does not cancel billing.

For deletion beyond an App control, including attachments, support records, provider-held information, or feedback submissions, contact team@peptrac.app. We will authenticate and handle the request within applicable legal deadlines and instruct relevant providers where required. Backups may require later deletion under legally permitted schedules. We do not claim instant deletion of every backup, provider log, or previously exported copy.

Legal, security, or other exceptions apply only where permitted by the law governing the request. Provider retention terms do not override statutory deletion obligations. Deleting PepTrac copies of imported Health data does not erase the original records in Apple Health.

14. Your Privacy Rights

Depending on your location and the law that applies, you may have rights to confirm processing; access, correct, delete, or obtain a portable copy of information; withdraw consent; restrict or object to processing; opt out of sale, targeted advertising, sharing, or certain profiling; request recipient information; and appeal a refusal.

You can edit many records and settings in the App, manage marketing preferences, control device permissions, and use deletion controls. Export Data produces a PDF tracking report; it does not contain every account record or replace a full access/portability request.

Send requests to team@peptrac.app, preferably from your account email address. Tell us which right you wish to exercise without including unnecessary health details. We may verify identity or an agent’s authority using information proportionate to the request. You do not need to create a new account to submit a request.

We respond within the deadline required by applicable law and explain any permitted extension or refusal. We will not unlawfully discriminate against you for exercising privacy rights. Withdrawing permission may affect features that need that information; it does not affect the lawfulness of prior consent-based processing.

15. California Residents

If the California Consumer Privacy Act, as amended, applies to our processing of your information, you may have rights to know, access, correct, delete, obtain a portable copy, opt out of sale or sharing, limit certain uses of sensitive information, and exercise rights without unlawful discrimination.

Categories described in this policy include identifiers and account records; age/sex information you provide; commercial subscription information; network/technical activity; photos and recorded audio you submit; health and other sensitive information; and inferences or estimates derived from your inputs. Approximate location may be inferred from IP addresses or store information; the current App does not request precise GPS location. We do not intentionally create biometric identification templates from photos or recordings. Employment or education details are not requested, though you could include them in free-form content.

Sources, purposes, recipients, and retention criteria are described in Sections 5–9 and 13. We do not sell personal information for money. Our disclosure of advertising identifiers and app events to Meta for advertising measurement (Section 5) may be considered “sharing” for cross-context behavioral advertising under California law; you can opt out by turning off Allow Tracking for PepTrac in your device settings or by contacting team@peptrac.app. Contact team@peptrac.app for a request or authorized-agent instructions. Any financial incentive involving personal-information collection would require its own disclosure before introduction; we do not operate such a program.

16. Oregon Residents

Where the Oregon Consumer Privacy Act applies, residents may have rights to access, correct, delete, obtain a portable copy, obtain information about third-party recipients, and opt out of sale, targeted advertising, or certain profiling. Contact team@peptrac.app to exercise applicable rights or appeal a decision.

17. Washington Residents

Washington’s My Health My Data Act provides rights concerning covered consumer health data, including confirming collection or sharing, accessing data and certain disclosure information, withdrawing consent, and requesting deletion. Our separate Consumer Health Data Privacy Policy explains those practices and how to submit requests.

We do not sell consumer health data or use healthcare-facility geofencing to identify or target people seeking services. Contact team@peptrac.app for a request. Applicable law governs response deadlines, provider deletion, and permitted backup handling.

18. Nevada Residents

Nevada residents may have rights relating to covered information and consumer health data, including confirmation, recipient information, stopping specified processing, deletion, and appeal. We do not sell consumer health data. See our separate consumer health policy and send requests to team@peptrac.app with the subject “Nevada Privacy Request.”

19. Other U.S. State Privacy Rights

Other state laws may give residents additional rights, depending on where they live, the information involved, and whether a law applies to PepTrac. These may include access, correction, deletion, portability, recipient information, opt-outs, consent withdrawal, and appeal. Contact team@peptrac.app to exercise applicable rights.

20. International Users and Legal Bases

Blanket LLC operates from the United States. Our providers may process information in the United States and other countries where their infrastructure or personnel operate. Privacy protections may differ from those in your country. Where required, international transfers must use appropriate legal safeguards, such as approved contractual protections or another valid transfer mechanism.

For users in the European Economic Area and United Kingdom, the applicable legal bases depend on the purpose and type of information:

Where explicit consent is required for health-data processing, we must obtain it before that processing begins. Consent withdrawal is available by contacting team@peptrac.app, changing relevant permissions, or deleting the account. A necessary feature may become unavailable when its processing is no longer authorized.

You may have rights to access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. You may also complain to your local data protection authority, including the UK Information Commissioner’s Office. Requests receive a response within the applicable GDPR/UK GDPR timeframe, ordinarily one month, with any lawful extension explained.

21. Cookies and Tracking Technologies

The current public marketing and legal website does not set advertising cookies, use cross-site advertising pixels, or run dedicated product analytics/session replay. Hosting providers still process ordinary request information.

The App uses local storage, session tokens, and device identifiers for account access, preferences, offline features, and subscription handling. With your permission through your device’s tracking prompt, the App also uses your device’s advertising identifier for advertising measurement as described in Section 5. These are different from website advertising cookies. If authenticated web features are introduced, essential session cookies may be needed to provide them. New technologies requiring consent will not be introduced without required notices and controls.

22. Age Requirement

PepTrac is intended only for adults 18 years or older. It is not directed to children or teenagers under 18, and people under 18 should not create an account or submit personal health information.

If you believe someone under 18 has provided personal information to PepTrac, contact team@peptrac.app. We will investigate and take appropriate steps to remove the information and close the account where required. An App Store content rating does not replace PepTrac’s minimum user-age requirement.

23. Third-Party Links and Services

The Services may link to research publications, app stores, websites, or other third-party content. Third parties have their own privacy practices. This policy covers PepTrac’s handling of information, not a recipient’s independent activities after you choose to visit or share with them.

24. Do Not Track and Global Privacy Signals

The current website does not use cross-context advertising tracking and does not have a separate technical response to browser Do Not Track signals. Where applicable law requires recognition of an opt-out preference signal such as Global Privacy Control, we will honor that signal for covered activities. This does not imply that we currently sell or share information for advertising.

25. Appeals

If we decline a privacy request, you can appeal by replying to the response or emailing team@peptrac.app with the subject “Privacy Appeal.” Explain the decision you wish us to reconsider.

We will respond within the timeframe required by applicable law and explain our decision. Where required, we will also provide a way to contact the relevant Attorney General or privacy regulator if the appeal is denied.

26. Changes to This Privacy Policy

The current policy will be posted at peptrac.app/privacy with its effective date. Earlier versions may be requested from team@peptrac.app.

If we materially change the categories of information collected, purposes, recipients, rights, or health-data processing, we will provide appropriate notice, such as email or an in-App notice, at or before the change takes effect and earlier where law requires. Corrections and clarifications that do not change practices may be made by updating this page.

Where new processing requires consent or authorization, we will obtain it before the practice begins. Continued use alone does not substitute for a legally required consent, authorization, or opt-out mechanism. Changes to consumer health practices will also be reflected in the separate consumer health policy.

27. Contact Us

Blanket LLC — Owner and operator of PepTrac

1209 Mountain Road Place Northeast #5747

Albuquerque, NM 87110, United States

Email: team@peptrac.app

Privacy Policy: peptrac.app/privacy

Consumer Health Data Privacy Policy: peptrac.app/consumer-health-data-privacy