Peptide Schedule

Privacy Policy

Effective April 8, 2026 · Last updated August 21, 2026

What We Collect

We collect the minimum data needed to run the site and your account.

  • Account data: Email address, and name if you sign in with Google.
  • Protocol data: The peptides, doses, and schedules you save in the Schedule Builder. This is health-related information and we treat it with extra care (see below).
  • Analytics: Pages visited, time on site, device type, and general location (via Google Analytics). We don't tie this to your account.

Health-Related Data

Your protocol data (which peptides you use, your doses, your schedule) may qualify as health information under regulations like GDPR. Here's how we handle it:

  • Encrypted at rest in our database (Supabase).
  • Never shared with third parties. Never sold. Period.
  • Never sent to analytics tools.
  • You can delete it anytime by deleting your account.

Peptide Schedule is not a healthcare provider and is not subject to HIPAA. However, we apply strong protections to your data regardless.

Protocol Pages (Public Profile Content)

Anything published on an educational profile is public because its owner chose to publish it. That includes the bio, the protocols, and any contact email the owner displays. Anyone who opens the page can see it.

We exclude profile pages from search engine indexing. That is not the same as privacy. Anyone with the link can still open the page and share it.

Handle availability checks, the automated content rule checks that run when a page is published, and any takedown decisions are processed as part of providing this feature. Protocol Pages collect no new categories of visitor data, and there is no messaging feature on Peptide Schedule.

Cookies

We use two types of cookies:

  • Authentication cookies (Supabase) — Required for login. These keep your session active. You can't opt out and still use account features.
  • Analytics cookies (Google Analytics) — Help us understand how the site is used. These collect anonymized browsing data.

Browser storage

Some things are kept in your own browser rather than on our servers, and never leave your device unless you create an account:

  • A protocol you build before signing up — held locally so it survives a refresh, and copied to your account if you create one.
  • Which sign-in method you last used— the provider name only (for example "google"), so the login page can point you at the right button. Your email address is not stored this way.
  • Display preferences — such as saved calculator mixes and notices you have dismissed.

Clearing your browser data removes all of it. Nothing here is used for advertising or shared with anyone.

Third-Party Services

We use these services to run Peptide Schedule:

  • Supabase — Authentication and database hosting. Stores your account and protocol data.
  • Google Analytics — Anonymous traffic analytics. No personal data is sent.
  • Google OAuth — If you sign in with Google, we receive your email and name from Google.
  • Vercel — Website hosting. Processes your requests and may log IP addresses.

Each service has its own privacy policy. We recommend reviewing them.

Your Rights

For EU residents (GDPR)

You have the right to:

  • Access your personal data
  • Correct inaccurate data
  • Delete your data ("right to be forgotten")
  • Export your data in a portable format
  • Object to processing

For California residents (CCPA)

You have the right to:

  • Know what personal information we collect
  • Request deletion of your data
  • Opt out of the sale of personal information (we don't sell any)

To exercise any of these rights, email hello@peptideschedule.com. We'll respond within 30 days.

Data Retention

We keep your account and protocol data as long as your account is active. If you delete your account, we remove your data within 30 days. Database backups may retain data for up to 30 additional days before being rotated.

Data Breach Notification

In the unlikely event of a data breach affecting your personal information, we will notify affected users within 72 hours of becoming aware of the breach, as required by GDPR. Notification will be sent to the email address associated with your account.

Age Requirement

Peptide Schedule is for adults 18 and older. We don't knowingly collect data from anyone under 18. If you're under 18, don't create an account.

Changes to This Policy

We'll update this page when our practices change and note the date at the top. For significant changes, we may notify you by email.

Contact

Questions about your data? Email hello@peptideschedule.com.