Privacy Policy

Effective date: 4 July 2026

Data controller: PanDepYiak, contact info@pepledgerapp.com.

Summary of Key Points

This summary highlights the most important points; the full sections below give complete detail.

What we process: Health and dosing information you choose to log (mood, energy, sleep, libido, markers, doses, cycles, bloodwork, body metrics, inventory), an optional profile name and photo, your account email address, and your security preferences. This is sensitive personal data and we treat it accordingly.

Where it lives: PepLedger requires an account (email and password). Your logged data is stored in our secure backend database (Supabase), encrypted in transit, and synced across your devices when you are signed in. Apple Health data is the exception — it is read on-device only and never uploaded.

Third parties: We do not collect information about you from third parties. Data leaves our systems only for the services needed to run the app: our backend provider (Supabase), Apple / RevenueCat for subscription billing, and — only if you choose to use it — an AI provider to answer AI Assistant questions.

Selling: We never sell or share your personal data for advertising, and we do not profile you.

Your rights: You can view and edit your data in the app, obtain a copy at any time with Export My Data, and permanently delete everything — including all server-side data — via Settings > Delete Account.

Contact: PanDepYiak — info@pepledgerapp.com.

1. Who We Are

This Privacy Policy explains how PepLedger ("the app", "we", "us") collects, uses, and protects your information. The data controller responsible for your personal data is PanDepYiak. You can reach us at info@pepledgerapp.com for any privacy-related question or request.

PepLedger requires you to create an account (email and password) to use the app, so your data can be securely stored and synced across your devices. PepLedger is a personal logging and tracking tool. It is not a medical device and does not provide medical advice.

2. Data We Process and Where It Is Stored

When you are signed in, the following data is stored in our secure backend database (Supabase), encrypted in transit, and synced across your devices:

• Profile details you enter (such as name and streak data)
• Dose logs, cycle protocols, schedule entries and reminders
• Health and wellness entries (such as mood, energy, sleep, libido and any markers you record)
• Bloodwork entries (biomarker values, units, and reference ranges you record)
• Body metrics you log
• Inventory items you track

The following are stored only on your device and are never uploaded:

• An optional profile photo you choose from your photo library, and any progress photos attached to body metrics
• Your security preferences, including an optional app-lock PIN and biometric unlock setting

Apple Health (optional): If you choose to connect Apple Health, PepLedger reads your weight, sleep, and activity data on-device solely to display trends inside the app. Health data is never stored in the app's database, uploaded to our servers, or synced to the cloud, and the app never writes anything back to Apple Health.

This information is sensitive. Because it relates to your health, we treat it as a special category of personal data and never share it without your action.

3. Account & Authentication

PepLedger uses Supabase Auth to manage accounts. When you sign up, an account is created with your email address and a password (stored by Supabase in securely hashed form — we never see or store your plain-text password). Your account is used to securely store your logged data in our backend and sync it across your devices, and to link your subscription status to you.

You can permanently delete your account at any time via Settings > Delete Account. This immediately and permanently deletes your account and all associated data from our servers — including all logs, entries, profile details, and sync records. This action cannot be undone.

4. AI Assistant

PepLedger includes an optional AI Assistant, used only if you choose to type a question into it. When you send a message, the text of your question is transmitted to a third-party AI provider (Anthropic) through a secure processing proxy (the Rork toolkit) to generate a response. To protect you:

• We do not attach your name, profile photo, or stored health logs to these requests — only the text you type is sent
• Please avoid including directly identifying information in your questions
• Your questions are processed to return an answer and are subject to the AI provider's own data handling terms

If you never use the AI Assistant, no data is ever sent to the AI provider.

5. Subscriptions & Payment

PepLedger offers subscriptions processed through Apple's App Store. Billing is handled entirely by Apple; we use RevenueCat to check and manage your entitlement status. PepLedger never receives or stores your payment card details — Apple and RevenueCat handle all billing information. RevenueCat receives a user identifier (linked to your account) and device information necessary to determine your subscription status.

You can manage or cancel your subscription at any time through your Apple ID settings, and restore previous purchases from within the app.

6. Notifications

If you enable dose or cycle reminders, PepLedger schedules local notifications on your device. These reminders are generated and delivered entirely on your device. We do not operate a push-notification server and do not see your reminder content.

7. Photo Library Access

If you choose to add a profile picture, the app requests access to select a single photo. The selected image is stored locally on your device only — photos are never uploaded to our backend. We do not access your wider photo library.

8. Legal Bases for Processing (GDPR / UK GDPR)

Where the EU or UK GDPR applies, we rely on:

• Performance of our contract with you — creating your account, storing your logged data, and syncing it across devices are necessary to provide the core service (logging, reminders, tracking, subscriptions)
• Your explicit consent — for processing the health-related data you choose to log and for sending questions to the AI Assistant. You can withdraw consent at any time by stopping use of these features and deleting your data or account.

You can edit or delete individual entries, export everything, or delete your account and all server-side data at any time.

9. Your Rights

Depending on your location (including under GDPR, UK GDPR and the CCPA), you may have the right to:

• Access the personal data held about you
• Correct inaccurate data
• Delete your data
• Restrict or object to certain processing
• Data portability
• Withdraw consent at any time

You can exercise most of these directly in the app: edit entries anytime, use Settings > Export My Data to obtain a complete copy, and use Settings > Delete Account to permanently delete your account and all associated data from our servers — immediately, not just from your device. For any further request, contact info@pepledgerapp.com.

We do not sell your personal data, and we do not use it for advertising.

10. Data Retention

We keep your information only as long as you maintain an account with us. Your logs and profile data are retained in our backend so they remain available across devices and sessions. When you delete your account, all of your data is permanently and immediately deleted from our servers. You can also delete individual entries at any time. Simply uninstalling the app does not delete your server-side data — use Delete Account for permanent erasure.

11. Children

PepLedger is intended only for adults of legal age in their jurisdiction. It is not directed at children, and we do not knowingly collect data from anyone under 18.

12. Security

Your data is encrypted in transit between your device and our backend, and access is restricted to your authenticated account — our database enforces per-user access rules so only you can read your own records. On your device, data is kept within protected app storage, with an optional app-lock PIN and biometric unlock. While no method is completely secure, we apply appropriate technical safeguards at every layer.

13. International Transfers

Your data may be stored and processed on servers located outside your country, including outside the EU/UK — this applies to Supabase, RevenueCat, and, if you use the AI Assistant, the AI provider. Where required, such transfers are protected by appropriate safeguards provided by the relevant processors.

14. Third-Party Services

We are not responsible for the privacy practices of third parties. PepLedger does not advertise and does not embed third-party tracking. The third parties involved are:

• Supabase (backend database and authentication)
• Apple / RevenueCat (subscription billing and entitlement management)
• Anthropic via the Rork toolkit proxy (only when you use the AI Assistant)

Any external links referenced in answers are governed by those third parties' own privacy policies.

15. Do-Not-Track

Because there is no finalized industry standard for DNT, we do not respond to DNT signals. This has little practical effect here, since PepLedger does not track your activity across other apps or websites.

16. US State Privacy Rights

If you are a resident of a US state with a comprehensive privacy law, you may have rights to know, access, correct, delete, obtain a copy, and opt out of targeted advertising/sale/profiling. We do not sell or share personal data, do not use it for targeted advertising, and do not profile you. The sensitive category we handle is health data, processed only with your consent to provide the app's features. Exercise access, correction, and copy rights directly in the app (including Export My Data), and deletion via Settings > Delete Account — or contact info@pepledgerapp.com.

17. Other Regional Rights

EEA/UK/Switzerland: you may lodge a complaint with your local supervisory authority.

Australia & New Zealand: we handle data consistent with Australia's Privacy Act 1988 and New Zealand's Privacy Act 2020.

South Africa: you may contact the Information Regulator.

18. Changes

We may update this Privacy Policy from time to time. The effective date indicates when it was last revised. Material changes will be reflected in an updated version within the app.

19. Contact

For any questions, requests, or complaints, contact PanDepYiak at info@pepledgerapp.com. You also have the right to lodge a complaint with your local data protection authority.