Privacy

PepCycle is operated by Bigyiatch, located in Germany. For privacy questions or requests, contact pepcycle@bigyiatch.dev. For GDPR purposes, Bigyiatch is the operator responsible for PepCycle.

PepCycle is a personal tracking tool for products, doses, protocols, inventory, and reminders. It does not provide medical advice, diagnosis, or treatment recommendations.

PepCycle stores the information needed to provide the app's features. This may include:

• Your account email address and login method (email/password or Google sign-in)
• Basic Google account information, such as your email address and name, if you sign in with Google
• Profile details you set, such as a display name and optional avatar image
• Product entries: name, product type (lyophilized, oil-based, or oral), container details, active ingredients, carrier oils, and remaining quantity
• Dose log entries: dose amount, unit, type-specific consumption, timestamp, and optional notes
• Protocol schedules: product, dose, schedule type, titration steps, cycles, and start/end dates
• Product and container history: reconstitution, container-opening, depletion, and adjustment records
• Inventory items: product stock and supplies such as BAC water, syringes, oil vials, and oral containers, with optional vendor or batch details you choose to record
• Reminders and notifications: scheduled reminders, in-app notifications, and delivery history
• Lab Tracking data, if you enable it: lab reports, marker results, report-specific reference ranges, notes, and pending connector imports waiting for your review
• Push notification subscription details, if you enable browser push notifications
• Telegram notification settings, if you configure Telegram notifications
• Feedback submissions, if you send feedback through the app
• Application preferences: syringe type, theme, notification settings, quiet hours, inventory thresholds, dashboard customization, and product ordering
• Technical records needed for security, account management, support, rate limiting, and abuse prevention

Some information you choose to enter into PepCycle may be health-related, including Lab Tracking records and product tracking records. PepCycle processes this information only to provide the tracking, scheduling, inventory, reminder, lab review, and account features you use. It does not interpret, validate, or endorse what you enter.

• PepCycle does not sell your data.
• PepCycle does not use your app data for advertising.
• PepCycle does not share your app data with third parties for marketing purposes.
• PepCycle does not use tracking cookies, advertising pixels, or analytics scripts.

Lab Tracking is optional and may store sensitive health data. If you enable it, PepCycle stores lab report metadata, marker results, units, report-specific reference ranges, result notes, and pending connector imports that you have not confirmed yet.

The AI Connector can create a pending Lab Tracking import for in-app review. It does not silently create final lab reports or final marker results. You can confirm or cancel a pending connector import in PepCycle.

No file upload storage is included in the current Lab Tracking feature. If you provide a source document to an AI client, that source document remains with the AI client unless a future in-app upload feature is explicitly added.

Account registration, login, email confirmation, password reset, and session management are handled by Supabase Auth. You can sign in with an email address and password, or with Google.

If you sign in with email and password, Supabase Auth stores your email address and a password hash. PepCycle does not store your plain-text password. PepCycle sends account emails — such as confirmation and password-reset links — to your email address.

If you sign in with Google, PepCycle receives the basic Google account information needed to create and manage your account, such as your email address and name. PepCycle does not receive or store your Google password. Google's own privacy policy applies to the Google sign-in process.

When you sign in, a session token is stored in your browser's local storage so you can stay signed in. Signing out or clearing your browser's local storage ends the local session.

Application data is stored in a PostgreSQL database hosted by Supabase. Row-level security policies are designed so that each user can access only their own records. The operator may access the database for support, maintenance, debugging, security, legal compliance, abuse prevention, or account assistance; administrative access is limited to what is necessary to operate PepCycle.

The Supabase project is configured in the EU region — Frankfurt, Germany (eu-central-1). Supabase may also process limited infrastructure, security, backup, logging, and support data as needed to provide its hosted services. Supabase's own privacy practices apply to that infrastructure-level processing — see supabase.com/privacy.

Push notifications are optional. If you enable browser push notifications, your browser creates a push subscription. PepCycle stores this subscription so it can send reminders and alerts to your browser or device.

Push notifications may include information from your account, such as product names, dose amounts, inventory or container alerts, and reminder times. Delivery uses the Web Push protocol and may involve your browser provider, device provider, or push service provider. You can revoke push permissions at any time from your browser or device settings, or from the Notifications section of the Settings page.

Telegram notifications are optional. If you configure a Telegram notification destination, the following information is stored:

• Your Telegram bot token — stored so server-side processes can send notifications, and never returned to the client after saving.
• Your Telegram chat ID (partially masked in the UI)
• An optional thread ID for forum/topic groups
• Timestamps of the last test message and last delivery

Telegram notifications are sent from the application server to the Telegram Bot API. Message content may include product names, scheduled dose amounts, reminder times, and inventory-related information. Once a message is sent to Telegram, Telegram's own privacy policy applies — see telegram.org/privacy. You are responsible for the Telegram chat, group, or topic you connect to PepCycle.

Signed-in users may submit feedback, bug reports, or feature requests through the in-app feedback form at /feedback. Submissions may include:

• Your account user ID and registered email address
• An optional name and email you enter in the form (editable, may differ from your account)
• Selected category, subject, and message text
• App version and the page you were on at the time of submission
• Submission timestamp, status, and rate-limit metadata

Feedback is delivered by email using Resend and is also stored in the database for support, audit, and rate-limiting purposes. Resend's own privacy and data processing terms apply to email delivery — see resend.com/legal/privacy-policy. The feedback form is rate-limited to one submission per hour per account.

PepCycle uses browser localStorage for:

• Your theme preference (light / dark / system)
• Your Supabase session token (for staying signed in)

PepCycle does not use local storage for advertising, tracking, or analytics, and loads no third-party scripts that collect your data.

PepCycle keeps your account data for as long as your account exists. You can delete your account and associated app data at any time from Settings → Account. Account deletion removes your active PepCycle account data — including products, protocols, inventory, history, dose logs, Lab Tracking records, pending connector imports, notifications, Telegram settings, push subscriptions, and feedback — from the application database, and removes your authentication account. You can also delete Lab Tracking data separately from Settings without deleting the rest of your account.

Deletion may not remove data that has already been sent to third-party services, such as Telegram messages, feedback emails, or browser/device and provider logs. Limited backup, security, legal, or abuse-prevention records may remain for a limited period where required or permitted by law.

PepCycle processes account, app, and technical data to provide the service you request, maintain security, prevent abuse, respond to support requests, and comply with legal obligations.

Where you choose to enter health-related information, PepCycle processes that information only to provide the tracking, scheduling, inventory, reminder, and account features you use. Where required by law, PepCycle relies on your consent to process health-related information that you choose to enter. You can stop this processing by deleting the relevant records or deleting your account.

If you are located in the European Economic Area, you may have the following rights regarding your personal data:

• Right of access — request a copy of the data held about you
• Right to rectification — correct inaccurate data (editable directly in the app)
• Right to erasure — delete your account and all data from Settings
• Right to restriction — request that we limit how your data is processed
• Right to portability — request a data export (contact us)
• Right to object — object to processing (contact us)
• Right to withdraw consent — where processing is based on consent
• Right to complain — lodge a complaint with a supervisory authority

To exercise any of these rights, contact pepcycle@bigyiatch.dev.

PepCycle uses technical and organizational measures designed to protect your data, including hosted database security controls, authentication, row-level access policies, HTTPS, and restricted administrative access. No online service can guarantee perfect security.

You are responsible for keeping your account credentials safe and for controlling access to your email account, Google account, browser, device, and any Telegram destinations you connect.

PepCycle is not intended for children. Do not use PepCycle if you are not legally old enough to use the service in your country, or if you are not allowed to provide the type of data the app stores.

This privacy policy may be updated from time to time. When material changes are made, the "Last updated" date at the top of this page will be revised. Continued use of PepCycle after an updated policy is published means the updated policy applies from that point forward.