PeptidePal · SignalWorks Labs Inc.
Privacy Policy
1. Who we are
PeptidePal is made by SignalWorks Labs Inc., a British Columbia, Canada corporation (incorporation BC1592144, business number 712254432BC0001, D-U-N-S 243367205). SignalWorks Labs Inc. is responsible for your personal information and is the company you deal with on every app store. In this policy, “we” and “us” mean SignalWorks Labs Inc.
Privacy Officer, SignalWorks Labs Inc. — palpeptide@gmail.com. Email this address with any privacy question, request or complaint. It is also our general support address.
This policy covers the PeptidePal mobile app and the account services behind it. PeptidePal is offered in all countries where the app stores make it available.
2. Your account and the information you enter
To create an account, you give us your email address and a password. Firebase Authentication (a Google service) handles sign-in. We do not store your password with your profile. We also keep an account ID, the date you joined, a display name if you add one, the version of the Terms you accepted and your marketing email choice.
PeptidePal saves what you enter to your account. Depending on the features you use, this can include peptide names, protocols and schedules, doses and times, vial and pen inventory, supplements, notes, body measurements, symptoms and side effects, lab results and progress photos. Photos and images are stored in Firebase Storage. This information can reveal sensitive facts about your health.
We use it only to run the app for you: to save and show your records, calculate summaries, schedule the reminders you ask for and keep your account in sync across your devices. The app also keeps a copy on your device so it works offline.
3. Apple Health / HealthKit
Apple Health is optional. In Settings → Apple Health, the app explains what it will read. Nothing is read until you tap Connect Apple Health and allow access in Apple’s permission screen. The app asks to read steps, heart rate, resting heart rate, heart rate variability (HRV), sleep, active energy burned and VO2 max. You choose which of these to allow. The app does not write any data to Apple Health.
The app reads the measurements you allow so it can show sleep, heart and activity trends next to your dose records. It saves those measurements, with their dates, units, source and daily summaries, to your PeptidePal account. This means the data is stored on our servers, not only on your phone, so it is there when you sign in on another device.
Apple Health data is never part of usage statistics or error reports. We do not send it to AI providers. We do not sell it, use it for advertising or marketing, or share it with data brokers. Google Firebase stores it for us as our service provider.
In Settings → Apple Health, Disconnect stops future syncing and asks whether to keep or delete the data already synced. You can also tap Delete Synced Data at any time. Deleting needs an internet connection, and the app tells you if it fails. To stop all access on your phone, also turn off PeptidePal’s access in Apple Health.
Delete Synced Data removes the copy in your PeptidePal account. It does not delete anything in Apple Health itself or any copy you exported. Deleting your account also deletes this data.
4. Consumer Health Data Privacy Policy
This section is our Consumer Health Data Privacy Policy, including for residents of Washington State and Nevada. It adds to the Apple Health section above. We do not ask for a separate health-data consent. You decide what health information to enter, and the app reads Apple Health only after you tap Connect and allow it in Apple’s permission screen.
What we collect and where it comes from: the information you enter about peptides, doses, protocols, inventory, supplements, measurements, symptoms, lab results and photos; the Apple Health measurements you allow; and summaries the app calculates from them. It comes from you, from Apple Health if you connect it, and from the app’s own calculations. If you join a household, you also receive information about the vials other members share with you.
Why we use it: only to provide the tracking, history, trends, inventory, reminders and syncing you use. Who receives it: Google Firebase, which stores and processes it for us; and other members of your household, but only for vials you choose to share. Apple Health data is never shared with household members. If you turn on calendar export, reminders or widgets, some details appear in those places, as described in section 8.
We do not sell consumer health data. We do not share it for targeted advertising. We do not collect your location.
Your choices: to stop Apple Health access, disconnect it and turn off access in Apple Health. To delete the synced copy, use Delete Synced Data. To ask for a copy, a correction or deletion of other health data, or to withdraw your consent, email palpeptide@gmail.com with the subject “Health Data Privacy Request”. If we refuse your request, you can appeal by emailing us with the subject “Privacy Appeal”. We answer requests and appeals as explained in section 14. Withdrawing consent may stop a feature from working. We will not use your health data for anything else as a result.
5. Household sharing
If you create or join a household, the household stores who its members are, their display names and their roles. When you share a vial, members can see its name, how much is left, its schedule and dose details, and when it was last used. Only share a vial if you are comfortable with your household seeing it.
Deleting your account does not delete other members’ own records. If you own a household that has other members, you must transfer ownership or remove the other members before you can delete your account.
6. Usage statistics (on by default)
Usage statistics are on by default for everyone, in every country, and the app does not ask first. You can turn them off at any time in Settings → Share usage statistics. If you turned them off before, they stay off. Usage events are linked to your account ID. They are not anonymous.
Usage events record what you do in the app, such as opening a screen, finishing a setup step, or logging, editing or undoing an entry. An event can show that something happened (for example, that you logged a dose). It does not include your notes, peptide or product names, dose amounts, health measurements, photos or error messages. Each event also records your account ID, a session ID, the time, your time zone, your device platform and the app version.
We use usage statistics to understand how the app is used and to improve it. Each night, we build daily summary reports from the accounts that have statistics on. The reports contain counts only, not account IDs, and we hide small groups. Only SignalWorks Labs Inc. can see usage events and reports. Before you have an account, the sign-in and sign-up screens also record a few steps (first open, screen viewed, sign-up started, sign-up or sign-in completed). These use a random install ID, the platform, the app version and a time rounded to the minute. The setting cannot control these steps because you have no account yet.
Usage events are deleted automatically 13 months after they are recorded. Deleting your account deletes them sooner. The daily summary reports contain no personal information, and we keep them.
Turning statistics off stops new usage events right away, even when you are offline, and leaves you out of future reports. It does not delete events already recorded. Those are deleted when they reach 13 months, or when you delete your account. Turning statistics off does not change how the rest of the app works.
7. Purchases and RevenueCat
Subscriptions are sold through the Apple App Store or Google Play, and managed with RevenueCat. The app identifies you to RevenueCat with your account ID and also sends your email address and display name if you have one. RevenueCat and the store process your purchase, product and subscription status so the app can unlock paid features and restore purchases. You never enter card details in PeptidePal.
When you delete your account, we ask RevenueCat to delete your customer record. This does not cancel your subscription and does not delete the records Apple or Google keep about your purchase. RevenueCat and the stores may keep transaction records they need for tax, fraud or legal reasons.
8. Notifications, calendars, widgets and device features
If you turn on reminders, your device schedules them. We do not send push notifications from our servers. A reminder can show a peptide name or dose details, and it can appear on your lock screen. If you turn on calendar sync, calendar events can include peptide names, times and notes. Your calendar provider may sync those events to its own servers.
Widgets and Siri shortcuts can show peptide names and dose details outside the app. You control these features, your notification settings and what shows on your lock screen in your device settings.
The app checks Expo’s update service for app updates. That check sends technical details such as the app version and platform, not your records.
Deleting data in PeptidePal does not remove calendar events, screenshots, shared files or other copies you made outside the app. Remove those yourself.
9. Error reports and alerts
The app sends error reports automatically, even if usage statistics are off, so we can find and fix problems. An error report contains a fixed error type, the time, whether the app crashed, the platform, the app version and the build. It does not include your account ID, error messages, your notes or any health information. Error reports are deleted automatically after 90 days.
We send ourselves alerts through Discord about events such as new sign-ups, subscriptions and errors. These alerts contain event types and counts. They do not include your name, email address or health information.
Earlier versions of PeptidePal had AI and voice features. Those features have been removed. Our records about their use are deleted automatically after 90 days.
10. Service providers and other disclosures
We use these service providers: Google Firebase and Google Cloud (sign-in, database, file storage and server functions); RevenueCat (subscriptions); Apple and Google (app stores, purchases and device features such as Apple Health); Discord (internal alerts without personal details); and Expo (app updates). If you turn on calendar sync, your calendar provider receives those events. Our providers may only use your information to provide their services to us.
The current app does not send your information to any AI provider.
We may also disclose information when the law requires it, to protect someone’s safety or our legal rights, or to deal with a security incident. If we sell or merge our business, your information may move to the new owner. This policy will keep applying to it, unless we tell you about a new policy first.
11. Your choices
Using the app does not mean you agree to everything. Apple Health access, usage statistics and marketing email are separate settings. Changing one does not change the others.
When you sign up, we record which version of the Terms you accepted and your marketing email choice. Accepting the Terms does not turn on marketing email.
Marketing email is off unless you turn it on. If you turn it on, we may send occasional product news and tips. You can turn it off in Settings or unsubscribe from any email.
We do not ask for a separate consent before you enter health information. Entering health information is your choice. The app reads Apple Health only after you connect it and allow access. You can delete health records, disconnect Apple Health or delete your account at any time.
12. How long we keep data, and security
We keep your account and records until you delete them or delete your account. We do not delete inactive accounts. Some data is deleted sooner on a fixed schedule: usage events after 13 months, and error reports after 90 days. Our database provider may keep backup copies, which roll off on their normal schedule.
We protect your data with access rules that let each account reach only its own records. Our providers encrypt data in transit and at rest. Only SignalWorks Labs Inc. has administrative access. No system is perfectly secure, and we cannot promise that your information will never be accessed without permission.
When the app connects to our providers, their servers may log technical details such as your IP address and device type. They use these logs for security and to run their services, and keep them for their own set periods.
13. Deleting your account
To delete your account, open Settings → Delete Account and confirm with your password. We then block new changes, sign you out on every device and delete your account data. This includes your records, your synced Apple Health data, your photos and images, your usage events and your RevenueCat customer record. Most data is removed right away. Some cleanup steps run again over the following days to catch late changes. We delete your data within 30 days of your request. Backups roll off on their normal schedule.
If you own a household that has other members, you must first transfer ownership or remove them. Deleting your account does not delete other people’s records or copies you made outside the app. If you cannot use the app to delete your account, email palpeptide@gmail.com from the address on your account and we will delete it for you.
Deleting your account does not cancel your subscription. Cancel it separately in your App Store or Google Play subscription settings.
After deletion, we keep a short record that the deletion finished. It is deleted automatically after 90 days.
14. Your rights
Email palpeptide@gmail.com to ask for access to or a copy of your personal information, to correct or delete it, to withdraw a choice, or to make a complaint. To protect you, we may ask you to send the request from the email address on your account or to confirm your identity in another way. Do not email us your password or health records we did not ask for. We will answer within 30 days. If the law lets us take longer, we will tell you why.
Depending on where you live, you may have more rights, such as the right to move your data to another service, to limit or object to some uses, to appeal if we refuse a request, and to complain to the privacy or data protection authority where you live.
If you are in the EU or UK, these are our legal bases. Running your account and subscription: our contract with you. Health information you choose to enter or connect: your explicit consent, which you give by entering it or connecting Apple Health, and which you can withdraw by deleting it or your account. Usage statistics: our legitimate interest in understanding and improving the app; you can object at any time by turning off Share usage statistics. Error reports and security: our legitimate interest in keeping the app working and safe. Marketing email: your consent. You have the right to access, correct, erase, restrict, move and object to the use of your data, to withdraw consent, and to complain to your data protection authority.
We store your data in the United States, on Google Cloud (Firebase). Our other providers may process it in the United States or other countries. When data moves outside Canada, the EU or the UK, we rely on our providers’ standard contractual clauses and data protection terms to protect it. Data in another country may be accessible to that country’s courts and authorities.
15. Age limit
PeptidePal is only for people 18 or older. It is not meant for children.
If you think someone under 18 has given us information, email palpeptide@gmail.com and we will delete it.
16. Security incidents and changes to this policy
If a security breach affects your personal information, we will notify you and the authorities as required by law.
If we change this policy, we will post the new version here with a new effective date. If the change is significant, we will tell you in the app or by email before it takes effect. Where the law requires it, we will ask for your consent before using your information in a new way.