Peptide Schedule

Privacy Policy

Effective April 8, 2026 · Last updated October 8, 2026

What We Collect

We aim to collect only what the site and your account need. Here is what that covers.

  • Account data: Your email address and how you sign in: email and password, Google, or Apple. If you sign in with Google or Apple, we also receive any name that service shares, and Google shares a link to your profile photo. Your profile holds a display name, any photo you upload, and settings such as units and the wearable devices you list. When you create an account, we also note where that visit started: the first page you opened, the domain of the site that sent you, and whether you used the installed app.
  • Health answers: Your goal and experience level, and your answers to four safety questions: medullary thyroid cancer or MEN2, active or recent cancer, pregnancy, breastfeeding or trying to conceive, and pancreatitis or severe gut disease. They are stored in your account and decide which warnings you see. You can change them on your profile. Older versions of the site also asked for age range, sex, weight, height, body fat, waist size, 0-10 ratings, lab values and a research mode setting. Nothing on the site uses them now. If you gave any, they stay in your account until you clear them on your profile.
  • Protocol data: The peptides, doses, schedules and notes in your protocols, each scheduled dose, and each dose you log: done or skipped, the time, the injection site, any note you add, and any check-in you record, such as pain, energy, sleep, weight or side effects. Also your supplies: vial sizes, how much is left, spare vials, and any batch, lot, storage or expiry notes you type. This is health-related information (see below).
  • Saved peptides: The peptides you save to My research stay in this browser. If you are signed in and turn on sync, we also store them with your account (see "Saved Peptides" below).
  • Reminders and calendar feeds: If you turn on reminders, we store your browser's push subscription (an address at your browser's push service and the keys used to encrypt messages for it) and the browser description your browser sends. If you set up a calendar feed, we create a private feed address and note when it was last fetched.
  • Votes: If you are signed in, a vote is stored with your account. If not, we store a keyed one-way code made from your network address and the item, only to stop repeat votes. The address itself is not stored.
  • Messages you send us: From the contact form or feedback button, we store your message, the page you sent it from, any source link, and your name and email if you give them. If you are signed in, the message is linked to your account. To limit spam, we also store a keyed one-way code made from your network address.
  • Usage data: We keep this to a minimum. Google Analytics and similar tools measure visits and usage across the site so we can see how pages are used: pages visited, device type, general location and which tools get used. On account pages, such as /protocol, /profile, /onboarding, /settings, /inventory, /schedule, /share and /my-research, they only count page visits and button use, such as a tap on Log. They never receive your account details, health answers, doses, the contents of your logs, or which peptides are on your account. We also count some feature use, such as calculator use and site searches, in our own database. Those records carry no account ID.

Saved Peptides (My Research)

You can save peptides to My research to compare them later.

  • Not signed in: The list stays in this browser on this device. We count each save in our own database without an account ID.
  • Signed in: The list still stays in this browser unless you turn on sync. We ask for your OK before the first sync. With it, we store each saved peptide and the date you saved it with your account, so the list shows on every device where you sign in.
  • Analytics: On My research, analytics tools only count page visits and button use. They never receive which peptides you saved.
  • Your control: You can remove a saved peptide at any time. "Stop syncing" on My research deletes the copy in your account and withdraws your OK. The list on this device stays. Deleting your account also deletes the synced copy.
  • Signing out: If you sign out, or a different account signs in on this browser, the peptides synced to your account are removed from this browser. They stay in your account.

Health-Related Data

Your health answers, protocols, dose logs, supplies and saved peptides are health-related information. Here's how we handle them:

  • Stored in our database (Supabase). Database access rules keep other users from reading them, except protocols you publish or share by link.
  • Free to use. Your logs and saved lists are never sold, and not shared except where you choose (below).
  • Not sent to analytics tools. On the planner, tracker, My research, profile and other account pages, those tools only count page visits and button use, such as a tap on Log.
  • Sent only where you choose. A calendar feed you set up lists your scheduled doses, amounts, mixing details, injection sites, whether you marked each dose done or skipped, and low-supply reminders if you track supplies. Your calendar app fetches it from us, and anyone with the feed address can read it, so treat it like a password.
  • A dose reminder names the peptide and the dose, so anyone who can see your screen can read it. A missed-dose notice does not name the peptide.
  • You can delete it at any time by deleting your account on the /settings page. "Stop syncing" deletes a synced saved list on its own.

Peptide Schedule is not a healthcare provider and is not covered by HIPAA. Some state laws give you extra rights over health data. Our Consumer Health Data Privacy Policy explains them.

Protocol Pages (Public Profile Content)

Anything published on an educational profile is public because its owner chose to publish it. That includes the bio, the protocols, and any contact email the owner displays. Anyone who opens the page can see it.

We exclude profile pages from search engine indexing. That is not the same as privacy. Anyone with the link can still open the page and share it.

Handle availability checks, the automated content rule checks that run when a page is published, and any takedown decisions are processed as part of providing this feature. Protocol Pages collect no new categories of visitor data, and there is no messaging feature on Peptide Schedule.

Cookies

We use these cookies:

  • Sign-in cookies (Supabase): Required for login. These keep your session active. You can't opt out and still use account features.
  • ps_dev (Peptide Schedule): Holds only the value 1, meaning this device has a saved calculator mix, a saved peptide or a 24-hour plan preview. No peptide, dose or account ID. Your browser sends it only with /protocol pages. It lasts 180 days while a saved mix or peptide exists, otherwise until the preview's 24 hours end.
  • ps_saved (Peptide Schedule): Set when you save a peptide to My research. It holds only the value 1, with no peptide, list or account ID, and page scripts can't read it. It lasts up to 400 days.
  • Analytics cookies (Google Analytics and similar tools): Used across the site to understand how it is used. They hold a random browser ID and are not linked to your account.

Browser storage

Some things are kept only in your own browser, not on our servers:

  • A protocol and dose logs you create before signing up: held locally so they survive a refresh, and copied to your account if you create one.
  • Peptides you save to My research: the list stays in this browser. If you turn on sync, it is also stored with your account, and this browser notes which account it synced with and which peptides that sync included, so a peptide you remove on one device is not added back from another. We count each save in our own database without an account ID.
  • Saved calculator mixes and plan previews: the numbers you entered, a 24-hour plan preview, and plans waiting to open in the planner. They stay on this device.
  • Sign-up and sign-in helpers:the first page of your visit and the referring domain, saved to your account only if you sign up, and the sign-in method you last used (for example "google"). Your email address is not stored this way.
  • Recent searches and display preferences: such as your calendar view and notices you have dismissed.

Clearing your browser data removes all of it. On /protocol, "Clear this device" removes saved mixes, saved peptides and plan previews. Nothing here is used for advertising or shared with anyone.

On browsers that support it, a service worker keeps copies of public pages so the site works offline. It never stores your account pages or the account data loaded from our database.

Third-Party Services

We use these services to run Peptide Schedule:

  • Supabase: Sign-in, database and file hosting. Stores your account, health answers, protocol data, saved peptides you sync and uploaded images, and runs the jobs that send reminders.
  • Vercel: Website hosting. Processes your requests and may log IP addresses.
  • Google and Apple sign-in: If you sign in with Google, we receive your email, name and profile photo link from Google. If you sign in with Apple, we receive the email address Apple shares with us, and your name if Apple shares it.
  • Google Analytics and similar tools: Usage analytics across the site. On account pages they only count page visits and button use, such as a tap on Log. They never receive your account details, health answers, doses, the contents of your logs, or which peptides are on your account.
  • Browser push services: If you turn on reminders, your browser maker's push service delivers them to your device. Messages are encrypted for your browser before they leave our servers.
  • Your calendar app: If you subscribe to a calendar feed, your calendar app fetches it from our servers. What happens to it there is covered by that company's privacy policy.
  • YouTube: On pages with a video, the thumbnail loads from YouTube when the page is viewed. The player loads from YouTube when you press play.
  • AI assistants: The Ask AI buttons open the AI service you pick, with the page link, a question about the page and any question you type. We send nothing to it ourselves.

Each service has its own privacy policy. We recommend reviewing them.

Your Rights and Choices

Wherever you live, you can:

  • Delete your data.Delete your account on the /settings page. It happens right away (see "Data Retention"). You can also ask by email.
  • Correct it. Change your profile, protocols and supplies in your account, or ask by email.
  • Get a copy.Email us and we send you the data your account holds. You can also download a protocol's schedule as a calendar file (.ics) from the planner.
  • Withdraw your OK."Stop syncing" on My research deletes your synced saved list. Turning reminders off on a device deletes that device's push subscription.
  • Ask what we hold and who receives it. Email us and we tell you.

Our Consumer Health Data Privacy Policy covers the extra rights some state laws give you over health data, including appeals.

To make a request, email hello@peptideschedule.com from the address on your account. We'll respond within 30 days.

Data Retention

We keep your account and protocol data as long as your account is active. You can delete your account on the /settings page, and deletion happens right away. It removes your sign-in record, profile and photo, health answers, protocols, scheduled doses, dose logs, supplies, synced saved peptides, reminders, calendar feeds, share links, Protocol Page and any images you uploaded. Votes and messages you sent us stay, with the link to your account removed. A message keeps any name and email you typed into the form. Database backups and the sign-in audit log can keep a copy, including your email, for a limited time after that.

Data Breach Notification

If a data breach affects your personal information, we will tell affected users without unreasonable delay and as the law requires. We will write to the email address on your account.

If the Business Changes Hands

If Peptide Schedule is sold or merged, this policy's limits on your health-related information go with it. A new owner must follow them, or ask for your consent before using that information in a new way.

Age Requirement

Peptide Schedule is for adults 18 and older. We don't knowingly collect data from anyone under 18. If you're under 18, don't create an account.

Changes to This Policy

We'll update this page when our practices change and note the date at the top. For significant changes, we may notify you by email.

Contact

Questions about your data? Email hello@peptideschedule.com.