Privacy policy

Peptarget is a private log for a peptide protocol, body measurements, training, bloodwork and recovery data. It is built for a small circle of people who know each other. There is no advertising, no analytics, no trackers, and nothing you enter is sold, shared or used for anything other than showing it back to you.

What we store

• Your account: email address and a password hash (or a sign-in link). Optionally a display name and timezone.
• What you enter: compounds, doses, injection sites, side-effect tags, notes, body measurements, progress photos, workouts, nutrition, lab results and journal entries.
• WHOOP data, only if you connect WHOOP (see below).

Data is stored with Supabase (Postgres and object storage) in Singapore. Every row is tied to your account and protected by row-level security, so no other user of Peptarget can read it. Progress photos live in a private bucket and are served through short-lived signed links.

WHOOP

Connecting WHOOP is optional. If you do, Peptarget asks WHOOP for read-only access to your recovery, cycles (strain), sleep, workouts, basic profile and body measurements, plus offline access so it can refresh in the background. We pull those records and keep one summarised row per day (recovery score, HRV, resting heart rate, SpO2, skin temperature, strain, sleep stages and performance) so they can be shown next to your doses. The raw WHOOP records for each day are kept alongside for accuracy.

Your WHOOP access and refresh tokens are stored server-side in a table that browser sessions cannot read; they are used only to fetch your own data. You can disconnect WHOOP at any time from the WHOOP tab. Disconnecting revokes the token with WHOOP and deletes it here. Already-synced days stay in your account until you delete them or your account. Peptarget is not affiliated with WHOOP.

What we do not do

• No third-party analytics, ad pixels or tracking scripts.
• No selling, renting or sharing of your data with anyone.
• No medical advice. Peptarget records what you tell it; it does not recommend doses.
• No access by other users. Sharing anything is a deliberate action on your part (for example printing a report).

Your control

• Export: every table as CSV, and a printable report, from Settings and Insights.
• Delete: “Delete everything” in Settings removes your photos, all rows and the account itself in one step.
• Reminders: the optional calendar feed contains your schedule (compound names, doses, times). Treat its link like a password; ask us to rotate it if it leaks.

Cookies

Only the session cookie that keeps you signed in, plus a short-lived cookie during the WHOOP sign-in to prevent request forgery.

Retention

Data stays for as long as your account exists. Deleting the account deletes everything immediately; backups roll off within 30 days.

Contact

Questions or deletion requests: oliver@investlandbali.com.