Privacy
Effective 11 September 2026. This notice covers peptidetracking.app and Peptide. The app has not launched yet; the app sections describe the configuration prepared for release. Website and support email processing apply now. Christian Ali Kuri Martinez is responsible for the processing described here; the postal address and email are on the Contact page.
Records on your iPhone
Vial details, entered amounts, schedules, entries, inventory, injection sites and notes are stored in a local database on your iPhone. Version 1 has no app backend or cloud sync for these records.
You can manually export and delete local data. An export goes to the destination you choose; protect it and share it only with people or services you select.
Local records remain on your device until you delete them. Copies you export and any device backups are managed separately through your chosen destination and system settings. We do not receive or remotely access your local database.
Purchases and subscription access
Apple handles App Store purchases. RevenueCat processes purchase history, subscription status, a randomly generated app identifier, and technical information such as app/platform version, locale and currency to validate purchases, manage access and analyze subscriptions. The identifier is pseudonymous: it is not your name, but it can link purchase activity.
We do not receive payment card details from Apple. Your vial names, entered amounts, notes and record history are not sent to RevenueCat. Apple processes purchase data under its own privacy policy; RevenueCat processes app customer data on our behalf.
How you found the app
The app uses Apple AdServices standard attribution with RevenueCat to understand installation sources. Your selected answer about how you found Peptide is sent as a predefined category, not as free text.
The app does not use IDFA or request App Tracking Transparency permission. Names, entered amounts, notes and record history are excluded from analytics and crash reports.
Diagnostics and product analytics
Sentry and PostHog are inactive. The current app configuration sends neither crash reports to Sentry nor product events to PostHog. Any change to this processing will be reflected in this notice before activation.
This website
Cloudflare hosts and delivers this static website. It processes connection and request data, including IP addresses and traffic information, to deliver pages, operate its network and protect against abuse. The website has no analytics SDK, advertising trackers or contact form.
If you email support, Cloudflare Email Routing forwards your message to a Gmail inbox operated by Christian Ali Kuri Martinez. Cloudflare and Google process your email address, message, attachments and delivery metadata to route, store, secure and deliver that correspondence. We use it to respond to your request. Please do not send health information, vial records or complete exports.
What local deletion does
Deleting local app data does not cancel an Apple subscription or delete records held separately by Apple or RevenueCat. Exports you have already saved or shared are also separate copies.
Use the Contact page to request access to or deletion of data processed outside your device. We cannot recover or delete local records remotely.
Purposes, retention and your rights
Where applicable data protection law requires a legal basis, purchase validation and access management are necessary to perform the subscription contract. Support relating to that contract, or steps you request before purchase, serves the same purpose. Our legitimate interests are to operate a secure website, respond to other inquiries and understand subscription and installation sources. We also process data when required to comply with legal obligations. You can object to processing based on legitimate interests.
We keep support correspondence for as long as needed to resolve and follow up on your request. Purchase and attribution data are kept for as long as needed to manage access, reconcile purchases and evaluate subscription and installation sources. Any further retention is limited to what is necessary for legal obligations or disputes. When these purposes no longer apply, we delete the data or request deletion from the relevant service. Provider security logs and backup copies follow the provider’s applicable retention and deletion processes.
The operator is in Mexico. Cloudflare, Google, Apple and RevenueCat may process data in other countries, including the United States. Their published privacy and data processing terms explain the applicable transfer mechanisms, including standard contractual clauses where applicable. Contact us for information about safeguards relevant to your data or a copy where available.
Depending on applicable law, you may request access, correction, deletion, portability or restriction of your data, object to processing, and withdraw consent where processing is based on consent. Withdrawal does not affect earlier lawful processing. You may also ask to limit use or disclosure. Send your request to the email or postal address on the Contact page and describe the right you wish to exercise. We may request only the information needed to verify your identity and locate the relevant data; do not send your local records.
You may complain to your competent data protection authority. In the EEA, this includes the authority where you live or work, or where an alleged infringement occurred. Contacting us first is optional. Changes to this notice will be published here with an updated effective date.