Privacy Policy

PepKit is owned and operated by Loona LLC ("Loona," "we," "us," or "our"), based in the United States.

This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights and choices.

PepKit is a personal tracking and organizational tool for informational and record-keeping purposes only. We do not provide medical advice or medical services.

Our core principle: We collect only what is necessary to operate the App and website. We do not currently sell your data. We do not currently share your health data for advertising purposes.

By creating an account, using the App, or using the website, you agree to this Privacy Policy.

Health data: Information about your health that you enter into the App, including dose logs, schedules, notes, and similar tracking information.

Website analytics data: Usage data tied to a random browser identifier, not a name or account, that we use to understand site performance and improve features.

Third-party service providers: Companies we work with to operate the App and website, each bound by their own privacy policies and our data processing agreements.

Account Information: Email address (via Apple Sign-In or other authentication providers); authentication provider.

Onboarding Information: Goals and preferences, peptides of interest, experience level.

User-Entered Tracking Data: Peptide inventory and names, dose logs and history, schedule and protocol data, notes and reminders.

Calculator Data: Inputs used in the App or website calculator, including dose, vial amount, and diluent volume, are processed locally and are not transmitted to analytics providers.

Subscription Information: Subscription status and entitlement state. Payment information is not collected or stored by PepKit. All billing is handled by Apple App Store and managed through RevenueCat.

Support Information: When you use the support form, we receive the topic, email address, optional app version, message, submission time, and country code supplied by Cloudflare. Our server sends your hCaptcha challenge token, the PepKit site key, and your IP address to hCaptcha to verify that the submission is not automated. Do not include passwords, payment details, or health records.

Guide Downloads: When you enter an email address to get the beginner guide, we store the address, the page you asked from, the time, the country code supplied by Cloudflare, and whether you ticked the box asking for occasional updates. Your answers to the readiness check are not stored and never leave your browser. Our server sends your hCaptcha challenge token, the PepKit site key, and your IP address to hCaptcha to verify that the submission is not automated.

Analytics & Technical Data: Limited technical data such as device type, OS version, app version, and crash logs. We do not send your personal tracking data to analytics tools.

Website Usage Data: The website uses PostHog to collect page categories, navigation, clicks outside the calculator, named calculator actions that contain no entered values, App Store link use, browser and device metadata, errors, performance measurements, and masked session replays. The website removes query strings, hides typed text and page text, normalizes compound-specific calculator paths, and excludes the calculator interface from automatic interaction capture and replay.

• Provide and operate the App
• Store and sync your data
• Authenticate your account
• Deliver app features (tracking, scheduling, calculator, research library)
• Send optional notifications
• Manage subscriptions
• Improve app performance and features
• Understand website use and fix website errors
• Maintain security
• Respond to support requests

• Sell your personal data
• Share your health data for advertising
• Provide medical advice
• Use your data to make health recommendations
• Store calculator inputs externally
• Share your tracking data with analytics providers
• Send website calculator values or typed text to PostHog

PepKit may use the following service providers:

• Firebase (authentication, storage, crash reporting)
• RevenueCat (subscription management)
• Apple App Store (billing)
• PostHog (website product analytics, error monitoring, and masked session replay)
• hCaptcha (spam prevention for the support form)
• Cloudflare (website delivery, security, and support email delivery)

These providers only process data as necessary to operate the App and website.

PostHog assigns a random browser identifier and may store it in browser storage and a cookie. PepKit does not identify website visitors to PostHog or create PostHog person profiles. See the PostHog Privacy Policy.

hCaptcha may process your IP address, browser and device information, time on the page, and interaction signals to detect spam and abuse. See the hCaptcha Privacy Policy and hCaptcha Terms of Service.

Your data is stored securely using modern cloud infrastructure. Data is encrypted in transit and at rest where supported.

We use industry-standard practices to protect your information, but no system can guarantee absolute security.

You may have the right to access, correct, delete, or export your data, and to withdraw consent for optional features.

To request account deletion or exercise your rights, use the PepKit support form.

We will respond within 30 days.

Your data is stored as long as your account is active.

If you delete your account, your data will be permanently deleted within 30 days. Some limited data may be retained for legal or security purposes.

An address left for the guide is kept until you unsubscribe. Every email we send carries an unsubscribe link. Using it stops all further mail and clears the update consent on the row; we keep the address itself so a later download does not silently add you back.

If PepKit is involved in a merger, acquisition, or sale, your data may be transferred as part of that transaction. We will notify you of any significant changes.

PepKit is intended for users 18 years or older. We do not knowingly collect data from minors.

Loona LLC operates PepKit in the United States. By using the App or website, you consent to your data being processed in the U.S.

We may update this policy from time to time. Continued use of the App or website means you accept the updated policy.