Peptide Library

Privacy Policy

Last updated: November 6, 2026

1. Introduction

Welcome to Peptide Library ("we," "our," or "us"). We are committed to protecting your privacy and ensuring you have a positive experience on our website and in using our products and services. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and website.

2. Information We Collect

2.1 Information You Provide

We collect information that you provide directly to us, including:

  • Account registration information (email address, username)
  • Peptide research data and tracking information
  • Inventory and supply management data
  • Communication preferences
  • Support requests and feedback

2.2 Automatically Collected Information

When you use our services, we may automatically collect certain information, including:

  • Device information (device type, operating system, unique device identifiers)
  • Usage data (features accessed, time spent, interactions)
  • Log data (IP address, access times, pages viewed)
  • Error reports and crash data

2.3 Health Data (Apple Health, Health Connect, Oura, WHOOP and your own entries)

If you choose to connect Apple Health (iPhone) or Health Connect (Android) in the Peptide Library app, we read only the categories you turn on: body measurements (weight, body fat, lean body mass, BMI), sleep (sleep sessions and stages), heart and breathing (resting, walking and daily heart rate, heart rate variability, VO₂ max, respiratory rate, blood oxygen), activity (steps, distance, energy, exercise time and workouts), and blood glucose and temperature. We only read this data; we never write anything to Apple Health or Health Connect. You can also enter readings such as resting heart rate, sleep or soreness yourself.

  • Readings other than weight and body fat stay on your device unless you turn on "Back up health data". Weight and body fat follow your sync setting, as before. With backup on, readings are stored in your Peptide Library account so they appear on your other devices and can be restored. You can turn backup off and delete the backed-up copy at any time.
  • If you connect an Oura or WHOOP account (where offered), you authorize us to read the data you approve on that provider's consent screen. That data is retrieved by our servers and stored in your account so the app can show it. Access tokens are stored encrypted and never on your device; we never see your Oura or WHOOP password. You can disconnect at any time, which revokes our access; you can also revoke it in the provider's app.
  • We use health data only to show your own trends, baselines and comparisons in the app. These are descriptive and are not medical advice or a diagnosis. We never use health data for advertising, marketing or data mining, never sell it, and never share it with third parties, including analytics, advertising and attribution providers. Health data is not sent to AI services.
  • Our product analytics and error reports only record that a connection or sync happened or failed, never measurements or record identifiers.
  • You decide what is shared in Apple Health, Health Connect, Oura or WHOOP and can change it at any time. In the app (Health → Connections) you can turn categories off, which keeps readings already imported, or delete imported data. Deleting your account deletes all health data stored in your account and revokes connected wearable accounts.

2.4 Vendor Applications

If you apply to list a store in our vendor directory, we collect the business information you enter (such as company details, catalog and shipping information, and affiliate and discount terms), the contact details of the people you name, and any files you upload. We use it to review the application, contact you about it and, if approved, to build the listing. Business verification details, verification documents and contact details are only seen by the Peptide Library team and are never displayed publicly. Files are stored in private storage. Deleting your account deletes applications you never submitted; submitted applications are kept as a business record of the vendor relationship.

2.5 AI Assistant Access (MCP Server) and Developer API

Our public MCP server (peptidelibrary.app/mcp) lets AI assistants such as Claude, ChatGPT and Cursor read Peptide Library's public research content. It requires no account and never reads or changes account, tracker, inventory or other personal data. For each request we keep only aggregate daily counts: the type of request, the tool used, whether it succeeded, how long it took, and the name your AI client reports about itself (for example "claude-ai"). We do not store the questions or arguments your assistant sends, the results, or your IP address. Our hosting provider processes IP addresses briefly to apply rate limits and protect the service. What you type into an AI assistant is governed by that assistant provider's own privacy policy.

Our developer API (api.peptidelibrary.app, see peptidelibrary.app/developers) returns public research, vendor and price data and no personal data. If you create API keys, we link them to your Peptide Library account and store each key only as a one-way hash, with its name, scopes and when it was created, last used or revoked, and the API terms version you accepted. For each request we keep aggregate daily counts by endpoint, response status, client type (for example an SDK name), country (from our host's geolocation) and the peptides or vendors asked for; for requests made with your key, daily request and error counts and, for 30 days, the endpoint, status, error code and request id of failed requests, which you can see in your developer dashboard. We do not store IP addresses or the search text of requests. Our hosting provider processes IP addresses briefly to apply rate limits. Deleting your account deletes your keys and their usage records.

2.6 Browser Extensions

Our browser extensions (the Peptide Calculator, Unit Converter, Research Library, Price Comparison and Inventory Tracker, for Chrome, Edge, Firefox, Opera and Safari) do not read, change or record the websites you visit, and they do not load code from the internet. They store what you save in them (history, presets, favorites, pinned conversions, your shipping country, preferences and, if you sign in, your session) in your browser's own extension storage, which other websites cannot access. Removing an extension deletes that data.

  • Public lookups. The Research Library, Price Comparison and (optionally) the Unit Converter and Peptide Calculator request public catalog data from our servers: peptide profiles you search or open, and vendor offers. The Price Comparison sends the shipping country you choose so we can show which vendors ship there; it stays stored on your device.
  • Your account. If you sign in (Inventory Tracker, and the Peptide Calculator for syncing saved calculations), your email and password are sent to our authentication provider (Supabase) to sign you in, and the extension then reads and changes only your own account data, under the same protections as the app and website. Signing out deletes the session from the extension.
  • Usage counts (opt-in). Nothing is counted until you agree on the extension's first screen or in its settings (in Firefox, also through Firefox's own data-collection permission). With your agreement, the extension sends daily totals: which extension, browser and version, and how many times features were used or errors happened. These totals carry no account, device or install identifier and never include peptide names, searches, amounts or inventory contents. You can turn this off at any time in the extension's settings.
  • Vendor links and affiliates. A vendor's page opens only when you click "Visit vendor" in the Price Comparison. Some of these links are affiliate links, labeled as such, which may earn us a commission at no cost to you. If you agreed to usage counts, we also record that an offer was viewed or clicked (the offer, vendor, extension and your chosen shipping country, without any identifier of you). Affiliate status never changes how offers are ranked.
  • Notifications. Inventory alerts are shown by your browser only if you turn them on and allow notifications; they are planned from your inventory inside the extension.

We do not sell extension data, use it for advertising, or use it to determine creditworthiness or for lending. Questions: see support.

3. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve our services
  • Process your transactions and manage your account
  • Send you technical notices, updates, and support messages
  • Respond to your comments, questions, and requests
  • Monitor and analyze usage patterns and trends
  • Detect, prevent, and address technical issues and security threats
  • Personalize your experience

4. Data Storage and Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. Your data is stored securely using industry-standard encryption and security practices. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

4.1 The installed web app

You can install peptidelibrary.app from your browser (Add to Home Screen, or Install in Chrome and Edge). The website and the installed web app are the same service with the same account.

  • Files kept by your browser. To load faster and open offline, your browser keeps copies of the site's code, images and public pages (such as library profiles). Pages that show your account data are not kept this way.
  • Offline copy. In the installed app, your browser also keeps the latest copy of your tracker and inventory on your device so they open without a connection; in a regular browser tab only if you turn on "Offline copy on this device" in Settings. Dose logs you make while offline wait on your device until they are sent to your account. This data stays on your device, separately for each account, and is deleted when you sign out, when another account signs in on that browser, or when you turn the offline copy off.
  • Web notifications. If you turn on notifications for a device, we store that browser's push subscription (an address at its push service and two encryption keys), its device type, browser, time zone and the notification types you chose. Dose reminders and stock alerts for that device are planned in your browser and their time and text are stored on our servers until they are sent; by default the text does not name peptides. Notifications are delivered through your browser maker's push service (for example Google, Apple, Mozilla or Microsoft) and are encrypted so that service cannot read them. Turning notifications off, signing out, or deleting your account removes the subscription; sent reminder records are deleted after three days (stock alert records after about four months, so the same alert isn't sent twice).
  • Usage events. We record events such as when an install invitation is shown, an install happens, the installed app is opened, or a notification is opened, with the device type, browser and display mode. While you are signed out these carry only a random ID created by your browser, never your name or research data.

5. Data Retention

We store user data. Account and research data—including your email address, username, dose logs, journal entries, metrics, inventory, formulas, blend presets, reminders, progress photos, streak records, and imported weight and body-fat readings—is retained for as long as your account exists, unless you delete a specific item sooner in the app or on the website.

When you delete your account in the app (Settings) or on the website (profile), we delete that account and the data listed above from our active systems, including progress photos stored in our systems and your marketing contact record. Deletion begins when you confirm it.

Data that exists only on your device is retained until you delete it in the app or uninstall the app.

After account deletion, we do not retain your research content, health readings, or progress photos. We may retain limited records that no longer identify you where needed to prevent fraud or duplicate referral rewards, to maintain a billing audit trail, or where the law requires a record.

Peptide activity records used for Peptide Trends (section 7.5) are kept while your account exists and deleted with it; records from a signed-out device carry only a random device ID. Analytics, crash reports, website analytics, and advertising measurement data are retained under those services' own retention settings. Website Google Analytics cookies last up to two years, as described in section 7.1. These analytics do not include your research content or health measurements.

Deleted information may remain in encrypted backups until those backups are overwritten in the ordinary course of operations, and is not used for any other purpose.

6. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

  • With your explicit consent
  • To comply with legal obligations or respond to lawful requests
  • To protect our rights, privacy, safety, or property
  • With service providers who assist us in operating our services (under strict confidentiality agreements)
  • In connection with a business transfer or merger

7. Cookies and Analytics

We use a small number of cookies, two analytics services, two advertising measurement tags and our own first-party measurement of visits and app downloads (section 7.5) on our website. These load only on peptidelibrary.app, so they do not run on local development or preview builds.

Your choices. In the European Economic Area, the United Kingdom, Switzerland, Washington State and Nevada we ask before using analytics or advertising measurement, and nothing in sections 7.2, 7.4 or the advertising parts of 7.5 runs unless you accept. Everywhere else they run unless you refuse. You can change your choice at any time with "Privacy choices" in the footer. If your browser sends the Global Privacy Control signal, we treat it as a refusal everywhere. Accounts and sign-in need their cookie and aren't affected.

7.1 Cookies We Set

  • Authentication. A cookie whose name begins with "sb-" and ends with "-auth-token" keeps you signed in. It is required for accounts to work, and is not used for advertising or for tracking you across other websites.
  • Google Analytics. Cookies named "_ga" and "_ga_07LJ0QP20E" tell Google Analytics whether you are a new or a returning visitor. Google sets these with a default lifetime of up to two years.
  • OpenAI Ads. OpenAI's measurement pixel sets first-party cookies so that a visit that started from one of our ads in ChatGPT can be credited to that ad. See section 7.4.
  • Partner links. When you open a Peptide Library partner's link (peptidelibrary.app/r/…), we record that the link was opened: the partner, the campaign and UTM tags in the link, whether you are on iPhone, Android or a computer, and the website you came from (its domain only). We do not record your IP address, your browser's user agent or a device identifier for this. We set a cookie named "pl_pc" holding a random token for that visit, plus "pl_pcs" (the partner's link name) and "pl_pcp" (whether the visit still has to be linked to an account), all for 30 days. If you create an account, sign in or subscribe within that time, the token links your account to the partner so they can be credited and paid a commission. Partners never see who you are: only counts, products and amounts with an anonymous label. On Android, the same token may be passed to Google Play so the app can credit the partner after you install it.

7.2 Google Analytics 4

We use Google Analytics 4, provided by Google LLC, to understand how the site is used: which pages are viewed, how visitors arrive, and general device, browser and approximate location information derived from IP address. We use this to decide what to write and what to fix. You can prevent Google Analytics from collecting your data by blocking cookies in your browser, by browsing in a private window, or by installing the Google Analytics opt-out browser add-on.

7.3 Ahrefs Web Analytics

We also use Ahrefs Web Analytics, provided by Ahrefs Pte. Ltd., which reports aggregate traffic only. Ahrefs states that this product uses no cookies and collects no personal data.

7.4 OpenAI Ads Measurement

We advertise in ChatGPT through OpenAI Ads, and our website loads OpenAI's measurement pixel, provided by OpenAI, to learn whether those ads work. The pixel reports the pages you visit, when you tap an App Store or Google Play button, and when you create an account on the website, together with browser and device information and, if you arrived from one of our ads, an identifier for that ad click. If you enter an email address in a form on our site, such as when creating an account, the pixel may convert it in your browser into a one-way hash and send only that hash to OpenAI, which uses it to match the visit to an ad. The pixel never receives your research content or health measurements. OpenAI processes this data under its own privacy policy. You can prevent it by blocking cookies or third-party scripts in your browser.

If you arrive from one of our ChatGPT ads on a phone, the App Store and Google Play buttons go through our app attribution provider, Appstack, which records that the visit came from that campaign before sending you to the store, so we can see which ads lead to installs.

We also advertise on Google, and our website can load Google's advertising tag, provided by Google LLC, to learn whether those ads work. It tells Google which of our pages you visited after clicking one of our ads and when you take a step such as creating an account or tapping a store button, and it sets cookies whose names begin with "_gcl". We don't use it to build remarketing audiences or personalize ads, and it never receives your research content or health measurements.

7.5 How We Measure Visits and App Downloads

To learn which of our pages lead people to the app and to Pro, our website keeps its own first-party records. They stay with us: we do not send them to any advertising platform.

  • In your browser. Your browser's local storage remembers how you first arrived (for example a search engine, another website or a link with campaign tags), the first page you landed on, the most recent such source, and when your current visit started. This is kept for 90 days after your last visit and is not a cookie, so it is never sent with page requests.
  • Counts. We count visits, first visits, views and taps of our download buttons, store links opened and sign-ups per day, by source (such as "Google search"), landing page, page type and device type (iPhone, Android or computer). These counts contain no identifier of you or your browser.
  • App Store and Google Play links. When you tap a link to Google Play, we add a random token to the link and record it with the page you tapped it on and how you first arrived. If you install the Android app, it reads the token from Google Play when it first opens and confirms the install; if you then sign in, the token is linked to your account. App Store links carry Apple's campaign tag for the kind of source you came from (for example "search"); Apple reports only totals per tag to us.
  • Google ads. If you arrive by clicking one of our Google ads, we record the campaign, ad group and keyword of that ad (our keyword, not what you searched for), the page you landed on and your device type, with the click identifier Google adds to the address (gclid, gbraid or wbraid). The identifier is stored on our servers, not in your browser, is deleted after 90 days and is removed if you delete your account. We link the click to your account as described below, including after you install the app from Google Play. We keep it so we can tell which ads lead to subscriptions. We do not send it, or anything about your account, to Google or any other advertising platform.
  • Your account. When you create an account or sign in on the website, the sources stored in your browser are linked to your account, so we can see whether visitors from a source go on to use the app or subscribe. We use this only in aggregate reports, together with subscription records, to decide what to write and where to advertise.

We never record your IP address, your browser's user agent, or a device or advertising identifier for this. Counts and click records are kept for 400 days; the link between your account and how you found us is deleted with your account. If your browser sends the Global Privacy Control signal, we only add your visit to the counts: no token is added to store links, no ad click is recorded and nothing is linked to your account. You can also clear your browser's site data at any time.

7.6 Our Mobile Apps

Our mobile applications use Google Analytics for Firebase. That data is recorded separately from website analytics.

The apps also record which peptides you calculate, add to your watchlist, inventory or schedules, search for and view, with your account ID when you are signed in or a random device ID when you are not. We use these records to publish Peptide Trends, which shows only totals of at least five researchers and never doses, schedules or anything that identifies you. You can turn this off in the app under Settings, "Include my activity in Community Trends": we then stop collecting these records from that device and remove your past activity from the published trends. If you turn on Peptide Trends notifications, we compare your saved watchlist with the published trends to decide when to notify you; the notifications never name a peptide.

8. Third-Party Services

Our services may contain links to third-party websites or integrate with third-party services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any information.

8.1 Payments and Subscriptions

Pro bought in the apps is processed by Apple (App Store) or Google (Google Play). Pro bought on our website is processed by RevenueCat, our subscription provider, with Stripe as the payment processor. They receive your email address, your account ID, the plan you buy, your billing country and your payment details; your card details go directly to them and are never sent to or stored by Peptide Library. RevenueCat also tells us whether your account has Pro, so it works on every device you sign in on.

For each website purchase we keep the plan, the price, the dates, the payment provider's transaction reference, and how you reached the purchase (for example the campaign, referral code or partner link in the address you visited), stored in your browser until checkout. We use this to run your subscription, prevent double billing, process refunds, credit referrals and understand which pages and partners bring subscribers. We do not share it with advertising platforms.

9. Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information, including:

  • The right to access your personal information
  • The right to correct inaccurate information
  • The right to delete your personal information
  • The right to restrict or object to certain processing
  • The right to data portability
  • The right to withdraw consent

To exercise these rights, please contact us at support@peptidelibrary.app

10. Children's Privacy

Our services are not intended for children under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes.

12. Contact Us

If you have any questions about this Privacy Policy, please contact us at:

Email: support@peptidelibrary.app

Company: Superfime LLC