Privacy Policy (Android)

Last updated: 25 October 2026

This policy covers the PeptideTrack Android app distributed on Google Play, package name com.peptidetrackapp.peptidetrack. The iPhone version of PeptideTrack collects a different set of data and is covered by a separate policy. The difference is not cosmetic: the Android build ships without the advertising and attribution SDKs that the iOS build includes.

This policy tries to be specific rather than reassuring. Each section describes what the app actually does.

Who we are

PeptideTrack is an app for adults keeping a private record of peptide and compound protocols they are already following under a physician's care. The app is published by PeptideTrack ("we"). You can reach us at support@peptidetrackapp.com.

The short version

• Almost everything you log stays on your phone and is never sent to us.
• The Android app contains no advertising SDKs, no analytics SDKs, and no advertising ID. It does not request the AD_ID permission.
• Three optional features send data off the device: Community, Chat, and subscription management. Each is described below.
• We do not sell your personal information, and your health data is never used for advertising by anyone.
• You can delete everything, from inside the app, at any time.

What stays on your device

The information you log inside PeptideTrack, meaning your protocols, doses, inventory, body metrics, lab results, side effects, injection sites, daily check-ins, photos, notes, and app settings, is stored locally on your phone using Capacitor Preferences, which is backed by Android SharedPreferences in the app's private storage. Other apps on your device cannot read it. This data is not transmitted to our servers as a matter of course.

You can leave PeptideTrack signed out of any account and the core tracking features continue to work. The sections below are explicit about what leaves the device, where it goes, and why.

Permissions the app requests

This is the complete list of permissions in the released Android package, and what each one is actually for.

Note what is not in that list. PeptideTrack on Android does not request the advertising ID, location, contacts, microphone, call logs, SMS, nearby devices, or storage access across your device. Photos are chosen through the Android photo picker and the system camera, which hand the app only the single image you select or capture.

Health Connect

PeptideTrack on Android does not integrate with Health Connect and requests no Health Connect permissions. It does not read from or write to Google Fit or any other health aggregator. Your height, weight, and other body metrics are whatever you type in, and they stay on your device. (The iPhone version does offer an optional Apple Health read; the Android build has no equivalent.)

Advertising, analytics, and tracking

The Android build contains no advertising SDK, no attribution SDK, and no third-party analytics SDK. Specifically, it does not include AppsFlyer, Linkrunner, the Meta SDK, the TikTok SDK, Firebase Analytics, or Google Mobile Ads. It does not read the Google Advertising ID, and the com.google.android.gms.permission.AD_ID permission is absent from the package.

We do not build advertising profiles, we do not track you across other apps or websites, and we do not sell or rent personal information. No health data is shared with any advertising service.

Google Play itself collects some install and crash information independently of the app, under Google's own privacy policy. That is Google's collection, not ours, and we see only aggregate, non-identifying figures in Play Console.

Sign in with Apple

PeptideTrack uses Sign in with Apple for two optional features: the Community feed and Chat. On Android this runs as a web sign-in flow in a browser window. Apple authenticates you, and we receive a session managed by Supabase, our backend provider, keyed to your Apple ID. We store your Apple user identifier and, if you choose to share it, the email relay address Apple provides. We do not receive your real Apple ID email unless you opt to share it.

You can use most of PeptideTrack without signing in. Signing in is required only for Community and Chat.

Community

If you post, comment, or vote in the Community feed, the content you submit and your chosen display handle are stored in our Supabase database. You can edit your display handle in Settings, and you can delete your own posts and comments at any time. Reports and blocks are stored privately and used only for moderation.

Community photos you upload are stored in our Supabase storage bucket, scoped to your user ID. Deleting a post deletes its image files. Anything you post to Community is visible to other users, so treat it as public.

Chat

When you use the in-app Chat feature, the message text you send is forwarded to Anthropic, the operator of the Claude language model, along with a context block summarizing your active protocols, recent doses, latest lab values, body metrics, check-ins, and any conditions, medications, and allergies you have logged. The context block never includes your real name, your sign-in email, your doctor's details, your blood type, or your progress photos. Anthropic does not train its models on this data. Anthropic's data handling is documented at anthropic.com/legal/privacy.

You can turn off personal-context sharing under Settings → Chat → Share my data with Chat. With sharing off, Chat answers general questions without your personal context.

Your Chat history is stored in our Supabase database so you can return to it across sessions. You can clear it from the Chat menu or under Settings → Chat → Clear conversation. Deleting your account removes it entirely. Chat is rate-limited by a per-user daily counter stored on our server, used for nothing else.

Lab results and photos

Lab PDFs and photos you add are parsed on your device. The biomarker values, reference ranges, and lab metadata are stored locally. Lab files are not uploaded to our servers. Lab values are included in the Chat context block only if you have Chat data-sharing enabled.

Progress photos stay on your device. The only images that leave your phone are ones you deliberately attach to a Community post.

Subscriptions

The PeptideTrack subscription on Android is sold through Google Play Billing and managed by RevenueCat on our behalf. We receive an anonymized RevenueCat customer identifier, your subscription status, and the active product identifier. We never see your Google account password, your billing address, or your card details; Google handles the transaction itself. RevenueCat's privacy policy is at revenuecat.com/privacy, and Google Play's terms govern the purchase.

Notifications

Dose, lab, and inventory reminders are scheduled as local Android notifications on your device. They do not pass through our servers, and the app sends no push notifications. If you decline the notification permission, the rest of the app works normally and you simply will not get reminders.

Data collected, at a glance

This table maps to the categories in our Google Play Data safety declaration.

All data in transit between the app and our backend is encrypted with HTTPS/TLS. Data at rest in Supabase is encrypted, and Community and Chat rows are protected by row-level security policies keyed to your user ID.

Who we share data with

We use these processors, and no others, for the Android app:

• Supabase, database, authentication, and file storage. supabase.com/privacy
• Anthropic, generating Chat replies. anthropic.com/legal/privacy
• RevenueCat, subscription entitlement management. revenuecat.com/privacy
• Google Play, billing and app distribution. policies.google.com/privacy

We do not share your data with data brokers, advertising networks, or analytics vendors. We may disclose data if we are legally required to, for example by a valid court order.

How long we keep your data

Local data stays on your device until you delete it in Settings or uninstall the app. Server-side data, meaning Community posts and Chat history, persists until you delete it individually or delete your account. Database backups rotate out within approximately 30 days.

International transfers

Our Supabase database and the Anthropic API operate in the United States. If you use PeptideTrack from another country, the data described above is transferred to and processed in the United States. By using those features you consent to this transfer.

Deleting your data

You can erase everything without contacting us.

• Delete all local data: Settings → Make PeptideTrack better → Delete all data. This wipes the device-side record and returns the app to onboarding.
• Delete your account and server-side data: Settings → Make PeptideTrack better → Delete my account. This removes your profile and cascades through your Community posts and comments, Chat threads and messages, and stored images.
• Clear Chat history only: Settings → Chat → Clear conversation.
• Export your data first: Settings → Data → Download all data (CSV).

If you have already uninstalled the app and want your server-side data removed, email support@peptidetrackapp.com from the address associated with your account and we will delete it. Full details are on the Account Deletion page.

Deleting your account does not cancel your subscription. Cancel that separately in the Google Play Store app under Menu → Subscriptions → PeptideTrack.

Your rights

If you are in the EEA, the UK, California, or another jurisdiction with statutory data-subject rights, you have the right to access, correct, delete, and port your personal information, and to object to or restrict certain processing. Most of this you can do yourself with the controls above. For anything else, email support@peptidetrackapp.com and we will respond within the period your local law requires.

Where we rely on consent, for example for Chat personal-context sharing or notifications, you can withdraw it at any time without losing access to the rest of the app.

California privacy rights

We do not sell your personal information, and we have not sold personal information in the preceding 12 months. On Android we also do not "share" personal information for cross-context behavioral advertising as the CPRA defines it, because the app contains no advertising or attribution SDKs and collects no advertising identifier. California residents have the right to know, delete, and correct their personal information, and to be free from discrimination for exercising those rights.

Medical disclaimer

PeptideTrack is a record-keeping tool. It does not provide medical advice, diagnosis, or treatment, it does not recommend or calculate doses, and it does not sell or source any substance. Chat answers questions from published literature and your own logged data; it is not a medical professional. Always consult a qualified healthcare professional before starting, stopping, or changing any protocol. See our Medical Disclaimer.

Children

PeptideTrack is intended for adults only. It is not directed to children, it is not part of the Google Play Families programme, and we do not knowingly collect data from anyone under 18. If you believe a child has provided us data, email support@peptidetrackapp.com and we will delete it.

Changes to this policy

If we change this policy meaningfully we will update the "Last updated" date above and surface the change in the app's About screen.

Contact

Privacy questions: support@peptidetrackapp.com