what we collect, and why.

reptides is a peptide research reference site and iOS app. This policy covers what we collect and why. Effective date: August 29, 2026. Questions: reptidesinfo@gmail.com.

When you are signed in and journal sync is enabled, saved stacks, private notes, research plans, journal entries, and deletion tombstones are stored in your Supabase account. Bounded recovery checkpoints are retained so you can restore earlier copies. Deleting a stack keeps its tombstone and recovery history; deleting your account removes its synced stacks and recovery history.

When you use the beta COA checker, every quota-approved image or PDF you submit is stored on upload, before analysis, including a file whose scan times out or does not complete. Completed structured analysis is stored with the source. Sharing starts off. If you explicitly turn it on under the current COA document-sharing disclosure, a completed check publishes only when its read is current and complete and every privacy and publication gate clears. Its public record includes the grade and the reasons behind it; the vendor, testing lab, batch, and test details read from the document; every retained certificate page; and a link to the retained PDF or high-resolution source image. A multi-image upload links to the retained source copy for each page. The uploader is never shown. A missing page, incomplete document read, incomplete privacy read, private name or contact detail, or customer, account, or order identifier keeps the check private. A generic review cannot waive those privacy holds. The original PDF is preferred; if a photo still cannot be read after the reader's retries, the checker asks for the PDF or a flat, sharp, uncropped, glare-free reshoot instead of publishing a grade. COAs uploaded before this disclosure, and sharing choices made only under an older disclosure, remain private until the uploader explicitly opts in under the current disclosure. Before publication, you can keep the COA private. Once published, it cannot be deleted or removed from the public board through the locker. An uploaded COA cannot be individually deleted from the locker. Reptides may review submitted files, grades, and grade reports to audit and improve the beta reader.

When you use Forums or the leaderboard, your chosen profile name and profile picture can appear on public profiles, posts, replies, and leaderboard rows. Forum posts and replies, and aggregate like and dislike counts, are public. The account behind an individual reaction is not shown publicly. Reply notifications are private to the signed-in recipient. Reports you submit are private and used for moderation.

Direct messages are stored on our servers so they can be delivered. They are not end-to-end encrypted. Each message is checked by an automated text filter when it is sent.

We do not read messages as a routine. Admins read messages when a member of the conversation reports it, when the law requires it, or to investigate abuse or a security problem.

A report gives the admins a copy of messages from that conversation.

(a) Your email address, when you subscribe to the dispatch newsletter or create an account. (b) Account data via Supabase auth: your email, a user id, and a session token. (c) Purchase records: your email, which product you bought, and the amount, processed by Stripe on the web and by Apple for in-app purchases. We never see or store full card numbers. (d) Community Trials reports require a verified signed-in account. The private service-only source row stores the account user id and a salted one-way account hash for the 28-day cooldown, idempotent retries, and reward ownership. Neither identifier is included in the public row or aggregate. The report stores the compound, structured answers, and optional notes; email and phone patterns in free text are scrubbed. Unreviewed compound labels are grouped publicly as other compound rather than reflected as public names. Saved research stacks also feed the community dosing and frequency figures: the compound, the recorded amount, and the recorded weekly cadence are counted in aggregate, never your name, codename, account, notes, journal entries, or blood panels. A compound shows a figure only once at least five separate researchers have recorded one, and no figure is traced back to an account. (e) A device notification token, only if you enable push notifications, so we can send dispatch alerts. (f) Aggregate usage analytics via Google Analytics, which we use to understand traffic. (g) Face ID or Touch ID, if you enable it, is handled entirely by your device's operating system. The biometric never leaves your device and we never receive it. (h) In the iOS app, Meta and TikTok may receive limited app-install, app-open, device, and advertising-attribution data. RevenueCat may send generic subscription lifecycle events to Meta. Apple controls access to tracking identifiers through its App Tracking Transparency permission. We never send Ask questions, peptide names, article titles, saved stacks, journal entries, or community-report content to advertising platforms.

We use what we collect to deliver the dispatch and welcome emails, to grant and verify membership access, to process payments, to send only the push notifications you opt into, to run Community Trials reports, to produce aggregate community dosing and frequency figures from saved research stacks, to transcribe and analyze COA documents you submit, to publish opted-in COAs that clear the current read, privacy, and publication gates, to understand aggregate traffic, to prevent abuse, and to measure whether our own Meta and TikTok ads lead to app installs or subscriptions. We do not sell your data, serve third-party ads inside reptides, or use research activity for ad targeting.

We use Forums data to operate public profiles, leaderboard identity, discussions, aggregate reaction counts, private reply notifications, private reporting, and moderation.

We share data with a short list of processors, each bound by its own privacy terms to protect your data: Supabase (authentication, database, and private file storage), Anthropic and OpenAI (AI processing for Ask Reptides and submitted COA documents), Stripe (web payments), Apple (in-app purchases, push delivery, and tracking permission), RevenueCat (in-app purchase management and subscription attribution), Meta and TikTok (limited advertising measurement), Resend (email delivery), Vercel (website hosting), Capgo (app updates), and Google Analytics (aggregate analytics).

You can unsubscribe from emails at any time using the link in every email. You can allow or deny tracking when iOS asks, and change that choice later in Settings under Privacy & Security, then Tracking. Saved-stack recovery retains one baseline and a bounded set of recent distinct checkpoints per stack without time-based tombstone deletion; older non-baseline checkpoints can be displaced when that fixed cap is reached. COA uploads cannot be deleted individually from your locker. Before publication, you can keep a COA private. Once published, it cannot be deleted or removed from the public board through the locker. If your locker contains a COA record, self-service account deletion is unavailable; contact reptidesinfo@gmail.com for help. Otherwise, you can delete your account and its data inside the app under Account, then "delete account", which removes your authentication account, synced stacks, and recovery history, and anonymizes your subscriber and purchase records. Deleting your account also removes private reply notifications tied to your profile and removes your profile name and picture from public presentation. A moderation report may remain as deidentified evidence after identifiers linking it to your account and profile are removed. To request deletion or a copy of your data by email, contact reptidesinfo@gmail.com.

Deleting your account removes your copy of your conversations, the message requests sent to you, and your blocks. The other member keeps their copy of your conversations and of any message request you sent them, shown as from a deleted member, with no link to your profile and no way to reply. If the other member deletes their account, you keep your copy the same way. A copy of reported messages may remain as moderation evidence after your account and profile identifiers are removed. The text of those messages is kept as it was written.

reptides is intended for adults. The app requires you to confirm you are 21 or older at sign-up. We do not knowingly collect data from minors.

We will update this page and its effective date when this policy changes.

For privacy questions, data requests, or other concerns, contact: reptidesinfo@gmail.com.