Privacy Policy

1. Information We Collect

1.1 Information you provide

• Account information — when you sign in with Apple or Google, we receive your name and email address (or the private relay address Apple provides). You may also set a display name/username and profile photo.
• Profile & biometrics — age, height, weight, biological sex, wellness goals, and peptide experience level, entered during onboarding to personalize your experience and dose calculations.
• Protocol data — the peptides you track, doses, injection sites, dosing schedules, reconstitution details, and logged doses.
• Wellness data — daily check-ins (energy, mood, sleep quality, recovery, appetite, libido, focus, side effects) and weight entries.
• Scan photos & analysis — face and body photos you choose to capture or upload for AI-assisted biometric analysis, along with the analysis results derived from them.
• AI assistant conversations — the messages, questions, and any images you send to the in-app AI assistant.
• Community content — posts, comments, votes, and any reports you submit in the community.
• Support communications — information you provide when you contact us.

1.2 Information collected automatically

• Device & usage data — device type, operating system, app version, and diagnostic/crash information used to keep the App stable and secure.
• Push notification token — a device identifier used to deliver dose reminders and other notifications you enable.
• Subscription status — whether you hold an active subscription, provided through our in-app purchase provider and the App Store.

1.3 Information from third parties

• Sign-in providers — Apple and Google provide limited profile information (name, email) when you use their sign-in services.
• Apple Health (HealthKit) — with your explicit permission, health metrics you choose to share (see Section 5).

2. How We Use Your Information

We use the information we collect to:

• Provide, personalize, and operate the App — including protocol tracking, dose reminders, reconstitution calculations, wellness trends, scan analysis, and the AI assistant;
• Generate personalized recommendations and insights based on the goals and data you provide;
• Deliver notifications you enable, such as dose and check-in reminders;
• Operate community features and enforce our content and safety policies;
• Process subscriptions and manage entitlements;
• Maintain the security, integrity, and reliability of the App, and detect and prevent abuse;
• Respond to your support requests; and
• Comply with legal obligations.

We do not use your health, biometric, protocol, wellness, or HealthKit data for advertising, and we do not sell your personal information.

3. AI Features, Scan Photos & Third-Party Processing

Pep Talk uses third-party artificial intelligence services to power certain features. This section describes exactly which data is sent, to whom, and for how long it is kept.

3.1 Face scans

When you capture or upload a face scan, the photo is transmitted to AILabApi (ailabapi.com) for descriptive skin analysis — attributes such as skin type, acne, pigmentation, and wrinkles.

3.2 Body scans

When you capture or upload a body scan, the photos from that scan are transmitted to Google's Gemini API (paid tier) to generate a visual before/after comparison. A body-scan request may include up to three photos: your front photo, your side photo, and — when a previous body scan exists — that prior scan's photo, so Gemini can compare directly against your earlier result.

3.3 What is and is not sent

Only the raw photos are transmitted. Pep Talk does not create, derive, or store biometric templates, face embeddings, faceprints, or any identity-matching data, and performs no facial recognition or identification. Face-scan analysis is purely descriptive and is performed on a single image at a time. Body-scan analysis compares your current scan photos against a prior body scan photo when one exists, solely to produce a visual before/after comparison.

3.4 How scan photos are stored and shared

• Scan photos are stored in a private Supabase Storage bucket, access-restricted to your own account through row-level security. They are never stored at a public URL.
• Pep Talk's backend retrieves your photo using short-lived, per-request access (either a signed URL valid for 120 seconds, or a direct server-side download), then sends the image data directly to the vendor within that single request. Vendors are never given a URL to the storage bucket, standing access, or access to any other user's files.

3.5 Vendor retention

• AILabApi — deletes the original uploaded file immediately after processing. If a result image URL is returned, that image is deleted within 24 hours.
• Google Gemini (paid tier) — Pep Talk uses the paid tier of the Gemini API, under which Google contractually does not use submitted prompts or images to train its models. (This commitment is specific to the paid tier and differs from the free tier's data-use terms.)

3.6 AI assistant

Messages and any images you send to the in-app AI research assistant are transmitted to Google (Gemini) to generate a response and to screen content for safety. This processing is necessary to provide the feature. AI-generated outputs may be inaccurate or incomplete and are for informational and educational purposes only; they are not medical advice.

4. How We Share Information

We do not sell your personal information. We share information only as described below:

• Service providers (sub-processors) — we use trusted vendors to run the App: Supabase (cloud database, authentication, file storage), Google (Gemini API, paid tier — AI assistant, body scan comparison, and content safety screening), AILabApi (face scan skin analysis), Expo (push notifications and app services), RevenueCat and Superwall (subscription management), Apple and Google (authentication, in-app purchases, Apple Health integration), and error-monitoring tools used to diagnose crashes. These providers process data only to provide services to us. See Section 3 for exactly what scan data each AI vendor receives and how long they keep it.
• Community content — posts, comments, and votes you submit are visible to other users of the App by design (see Section 8).
• Legal & safety — we may disclose information if required by law, to enforce our terms, or to protect the rights, safety, and security of our users, the public, or Pep Talk.
• Business transfers — if we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to this Policy.

5. Apple Health (HealthKit) Data

If you connect Apple Health, Pep Talk requests permission to read certain HealthKit metrics you choose to share — which may include steps, heart rate, sleep, body weight, and active energy — to display them alongside your protocol and wellness trends.

• We access HealthKit data only after you grant permission, and only the categories you approve.
• We use HealthKit data solely to provide health and wellness features within the App.
• We will never use HealthKit data for advertising or marketing, and we will never sell it or share it with third parties for those purposes.
• You can review and revoke Pep Talk's access at any time in the Apple Health app or iOS Settings.

Our use of HealthKit data complies with Apple's HealthKit requirements and applicable App Store guidelines.

6. Data Retention

We retain your information for as long as your account is active or as needed to provide the App. When you delete your account, we delete or de-identify your personal data associated with that account, except where we are required to retain certain records to comply with legal obligations, resolve disputes, or enforce our agreements. Aggregated or de-identified data that can no longer be linked to you may be retained.

Scan photos. When you delete your account, both your scan records and the original photo files are permanently deleted from our storage. You can also delete an individual scan at any time from within the App.

7. Data Security

We use administrative, technical, and organizational safeguards designed to protect your information, including encryption in transit, access controls, and row-level security on our backend so that your data is accessible only to you and authorized processing. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Community & Public Content

Content you post to the community — including posts, comments, images, and votes — is visible to other users and is not private. Please do not share sensitive personal or health information you wish to keep confidential. You can delete your own content, report content that violates our policies, and block other users. We reserve the right to remove content and restrict accounts that violate our Terms of Service.

9. Your Rights & Choices

• Access & correction — you can view and update most of your information directly in the App.
• Deletion — you can delete your account from within the App, which removes your associated personal data as described in Section 6.
• Notifications — you can control push notifications in the App and in your device settings.
• Health data — you can revoke Apple Health permissions at any time in the Health app or iOS Settings.
• Requests — you may contact us at hello@trypeptalk.com to exercise any applicable rights.

10. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, to request access to or deletion of your personal information, to correct inaccurate information, and to not be discriminated against for exercising these rights. We do not sell or share your personal information as those terms are defined under California law. To exercise your rights, contact us at hello@trypeptalk.com.

11. International Users & GDPR

If you access Pep Talk from outside the United States, your information may be processed in the United States and other countries. Where the EU/UK GDPR applies, our legal bases for processing include your consent (for health data, AI features, and HealthKit), performance of our contract with you (to provide the App), and our legitimate interests (to secure and improve the App). You have the right to access, correct, delete, restrict, or object to processing of your personal data, and to data portability. To exercise these rights, contact us at hello@trypeptalk.com.

12. Children's Privacy

Pep Talk is intended only for adults aged 18 and older. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from a person under 18, we will delete it. If you believe a minor has provided us information, contact us at hello@trypeptalk.com.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide additional notice within the App. Your continued use of Pep Talk after an update means you accept the revised Policy.

14. Contact Us

If you have questions about this Privacy Policy or your data, contact us at:

Gradient Descent Labs — a division of Gradient Descent LLC
Email: hello@trypeptalk.com