Summary
This privacy policy for VidZenith L.L.C‑FZ (“VidZenith”, “we”, “us”), the maker and seller of PepPin, explains how we handle personal information when you use PepPin — the app for logging and tracking peptide and GLP‑1 protocols on iPhone (App Store) and on Android (Google Play), including its Library, Chat, optional meal estimates, Apple Health connection and subscriptions — and the peppin.health website. Where iPhone and Android differ, this policy says so.
On iPhone, your records live on your iPhone and, if you turn on Sync with iCloud, in your own private iCloud storage, which we cannot read. On Android, they live on your phone and, if your phone backs up apps, in your own Android backup. We do not maintain a long-term copy of your tracking records. On iPhone, Chat and optional meal estimates send the content needed for your request through our server to Anthropic, our AI provider, only after you agree. Our server does not store Chat messages or raw meal photos or descriptions; it temporarily keeps a checked meal estimate and request hashes for up to 15 minutes so retries do not make another model call. Your name and email are not sent with meal estimates. Apple Health data is read on your iPhone and is never added to these AI requests or stored on our server or in iCloud. We do not sell your data, we show no ads, and we use no advertising or analytics trackers. PepPin is for adults aged 18 and over.
Information We Collect
Profile. During onboarding you can enter your first name, age, biological sex, body weight, goals and how familiar you are with peptides. PepPin uses this to set up the app and, on iPhone, to personalize Chat.
Protocol and logs. The compounds and protocols you track, doses, schedules, the times you log a dose, injection sites, skipped doses, vial inventory, reconstitution calculator inputs, check‑ins, notes and streaks.
Measurements, food and lab reports. Measurements you log, such as weight, waist, body fat and lean mass; the food you log, such as protein, fibre, water, carbohydrates, fat and energy; and lab reports (bloodwork) you add. Lab reports are read on your phone. If you scan a barcode or a nutrition label to log food, the scan is read on your phone; for a barcode, only the barcode number is looked up in Open Food Facts, a public food database.
Progress photos. Photos you add stay on your phone. On iPhone they are copied to your iCloud only if you turn on Sync photos to iCloud. On Android, when you take one, your camera app takes the picture and hands it to PepPin; PepPin asks for no camera or photo‑library permission.
Meal estimates (iPhone). If you choose Snap your plate or Say it and agree to the meal-estimate consent screen, PepPin sends your selected meal photo, any note you add, or the words you say or type about the meal through our server to Anthropic. Speech is transcribed on your iPhone; the audio is not sent to PepPin’s server or Anthropic. The request also includes a pseudonymous account ID, a random request ID, your time zone, consent version and Pro status for authentication and usage limits; those account and subscription details are not included in the model prompt. See How Meal Estimates Work.
Chat (iPhone). Your questions, the replies, your chat history, and the memory Chat saves to personalize replies. Voice questions are turned into text on your iPhone. See How Chat Works. Chat is not yet available on Android; until it is, the Android app sends no Chat messages.
Apple Health data (iPhone). PepPin asks for Apple Health access only when you tap Connect Apple Health — during onboarding, on the Body tab, or in Profile › Apple Health — and Apple then shows its own permission sheet, where you choose each type. If you tap Not now, nothing is asked and nothing is read. With your permission, PepPin reads weight, waist, body fat, lean mass, sleep, steps, resting heart rate, and the food values protein, fibre, water, carbohydrates, fat and energy. It can write the weight, waist and food entries you log in PepPin back to Apple Health. Other apps and devices, such as Oura, Whoop, Garmin or Withings, reach PepPin only through Apple Health, if you have connected them to Apple Health yourself; PepPin does not connect to them directly. Apple Health data is read and shown on your iPhone. It is never stored on our server or in iCloud, and never used for advertising, marketing or data mining. It is never sent to Chat, even with Include health data on. You can change each type at any time in iOS Settings › Health › Data Access & Devices › PepPin.
Health Connect (Android). The current Android release does not connect to Health Connect and asks for no Health Connect permissions. If a later release offers it, we will update this policy first and ask for your permission in the app, type by type.
Account information. On iPhone, daily tracking works without an account. You need an account for Chat, meal estimates and to keep Pro linked to you, and you create one with Sign in with Apple or Sign in with Google. On Android, you sign in with Google (through Android Credential Manager) to keep your records in your account on the phone. The name and email address you share stay on your phone and, on iPhone, in your iCloud; they never reach our servers. Our server and RevenueCat identify your account only by a pseudonymous identifier (a hashed account ID), which is the same on iPhone and Android for the same Google account. We never receive your Apple or Google password, and we do not request access to any other Google data (such as Gmail, Drive or Contacts). We do not use information received from Google for advertising, for selling to anyone, or for training AI models. PepPin’s use of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.
Purchases. On iPhone, subscriptions are bought through Apple’s In‑App Purchase. Pro is not yet available on Android, so the Android app offers no purchases today; when Pro comes to Android, it will be sold through Google Play Billing, with RevenueCat checking purchases. Apple or Google handles the payment; we never see your card details. RevenueCat validates purchases and tells us whether you have Pro. It receives your pseudonymous account ID, your device model and operating system version, and your purchase and subscription status.
Server requests. When the app contacts our server — for Pro status, Chat, meal estimates and account deletion — the server processes your IP address to limit abuse. It keeps no Chat questions or answers and no raw meal photos or descriptions. It keeps your pseudonymous account ID, Chat and meal usage counts, whether you have Pro, and short-lived request references so retries are not counted twice. For meal estimates, the checked result and request hashes are kept for up to 15 minutes. Server logs record the AI model used, token counts, response time, cost and operational error identifiers, but not your photo, meal words, food names or account ID. Logs are kept for up to 30 days.
Diagnostics. On iPhone, if you have opted in to share analytics with app developers in iOS Settings, Apple gives us aggregated crash reports and usage statistics. On Android, Google Play gives us aggregated crash and performance reports (Android vitals) from phones whose owners have agreed to share usage and diagnostics with Google. PepPin contains no third‑party advertising or analytics tools.
Notifications. Dose reminders are scheduled on your phone, on iPhone and on Android. If we send push notifications on iPhone, Apple gives us a device token, which we use only to deliver them. The Android app uses no push notifications; its reminders never leave your phone.
Website and Waitlist
peppin.health is served through Cloudflare, which processes IP addresses and request data to deliver the site, protect it from abuse and block spam sign‑ups. If you join the waitlist (for example, to hear when PepPin is on Google Play), we collect your email address and the link you arrived from (for example Instagram or TikTok). MailerLite, our email tool, stores it and sends you a confirmation email; we use it only to email you about PepPin’s launch and updates. Every email has an unsubscribe link. The website uses no advertising cookies or trackers. Links to the App Store and Google Play take you to Apple’s and Google’s own sites, under their privacy policies.
How We Use Information
We use the information above to run PepPin — your protocol, reminders, calculator, inventory, measurements, food log and Library; to personalize the app and Chat; to generate Chat replies and meal estimates you request; to manage your account and Pro; to apply fair‑use limits and prevent abuse; to answer support requests; to send waitlist emails you signed up for; and to comply with the law and enforce our Terms of Use. We do not use your information to train AI models.
How Chat Works
Before your first Chat question, PepPin shows you what will be sent and asks you to agree. Chat is on iPhone only for now; it is not yet available on Android. Without Pro, you get 3 free Chat messages in total; with Pro, Chat has a daily limit.
Sent with each Chat question. Your question and the recent messages in that chat; your first name, goals, experience, age and sex (if you gave them); your protocols, recent doses and injection sites, streak and stock; the memory Chat has saved; your response settings; and your time zone.
Health data in Chat. Only if you turn on Include health data (it starts off), Chat may also include the measurements you typed in PepPin and the last week’s check‑in scores and symptoms. Apple Health data is never sent — no Apple Health weight, sleep, steps, resting heart rate or nutrition. Your food log is never sent. Your protocols and stock are included either way, and anything you type into a question is sent.
Never sent. Apple Health data, progress photos, lab reports (bloodwork), notes, your food log and your email address.
Our AI provider. Questions go through our server, hosted by Cloudflare, to our AI provider, Anthropic, PBC, whose Claude models generate the reply. Anthropic uses them only to provide the reply and does not use them to train its models. It deletes them within 30 days, unless they are flagged for breaking its usage policy (then it may keep them for up to 2 years) or the law requires it to keep them longer.
Retention. Chat messages are not stored on our server. The AI provider handles them only to generate the reply, under its agreement with us, for the limited period described above.
You can turn off Include health data, or all AI features, at any time in Profile › Privacy & data. Your chat history and memory are stored on your iPhone and, if Sync with iCloud is on, in your iCloud. Please do not put other people’s personal information into Chat. Replies are generated automatically and can be wrong; they are not medical advice — see our Terms of Use.
How Meal Estimates Work
Meal estimates are optional on iPhone. Before the first estimate, a dedicated consent screen explains what is sent and names Anthropic, the AI company that makes Claude. Tap Agree and continue to use the feature. Tap Not now, or dismiss the screen, to send nothing. The same permission covers a meal photo and a meal described with Say it.
What is sent. PepPin sends the photo you select, any note you add, or your typed or on-device-transcribed meal description through our Cloudflare-hosted server to Anthropic to estimate the foods and amounts. It does not send speech audio or automatically add your protocols, dose history, Apple Health data, other health records, name or email to the meal prompt. Anything you choose to include in the photo or description is part of that request.
What comes back. The result is an estimate of the foods, portions and nutrients. You can edit every figure, and an estimate becomes a food-log entry only when you choose Save. If you have separately allowed the relevant Apple Health write permissions, saving can also write the food values to Apple Health. Nothing is written there merely because you requested an estimate.
Our temporary records. Our server does not store the raw meal photo, note or description. Under your pseudonymous account ID it keeps one-way hashes of the request, usage counts and the checked estimate, including food names and numbers, for up to 15 minutes from the first request. That lets an identical retry receive the same result without another model call. The temporary estimate and hashes are then deleted; usage counts remain as described under Retention.
Anthropic. Anthropic processes the meal input and generates the estimate under its commercial API terms. This content is not used to train its models. Its standard API policy deletes inputs and outputs within 30 days; content flagged for misuse may be kept for up to 2 years, or longer where required by law. This is separate from PepPin’s shorter server retention. See Anthropic’s commercial data-retention policy.
Your choice. Turn off AI features in Profile › Privacy & data to stop future meal requests. You can still enter food manually or use on-device nutrition-label reading. Revoking permission does not undo a request already processed or delete food entries you chose to save.
Where Your Data Is Stored
On your phone. PepPin keeps your records in the app’s storage on your iPhone or Android phone. On Android they are kept separately for each account signed in on the phone.
In your iCloud (iPhone). If Sync with iCloud is on, PepPin stores your records in the private database of your own iCloud account using Apple’s CloudKit, with encrypted fields. Only your Apple Account can access them; VidZenith cannot read them. Photos are included only if Sync photos to iCloud is on. Apple Health data is never stored in iCloud. You can turn sync off in Profile › Privacy & data, and delete PepPin’s iCloud data in iOS Settings: tap your name, then iCloud › Manage Storage › PepPin.
In your Android backup. If your Android phone backs up apps to your Google Account, Android includes PepPin’s records in that backup so they can come back on a new phone. Android encrypts this backup end to end when your phone has a screen lock (PIN, pattern or password). You can turn app backup off in your phone’s Settings (usually Settings › Google › Backup). There is no iCloud on Android and no sync between iPhone and Android.
On our servers. We do not keep a long-term database of your tracking records. Our Cloudflare-hosted server keeps your pseudonymous account ID, Pro status, Chat and meal usage counts, the limited logs described above, and a checked meal estimate and request hashes for up to 15 minutes. It does not store raw meal photos or descriptions or Chat messages.
Service Providers and Other Recipients
These companies process data for us, on our instructions, and are contractually required to protect it to a standard at least equal to this policy. They may process it in countries other than the one you live in; where the law requires it, we use safeguards such as standard contractual clauses for these transfers.
Apple Inc. App Store delivery, Sign in with Apple, iCloud (CloudKit), Apple Health, In‑App Purchase and push notifications.
Google LLC. Sign in with Google (iPhone and Android); on Android also Google Play (app delivery and aggregated crash reports; Google Play Billing once Pro is available on Android) and Android backup of your PepPin records to your Google Account if you have app backup on; and our support email ([email protected]).
Anthropic, PBC. Our AI provider (Claude). Generates Chat replies and meal estimates from the content you choose to send, as described in How Chat Works and How Meal Estimates Work. These AI features are available on iPhone only for now.
RevenueCat, Inc. Validates App Store subscriptions, and Google Play subscriptions once Pro is available on Android: pseudonymous account ID, device details and purchase status.
Cloudflare, Inc. Hosts our website and server: IP addresses, request data and usage counts.
MailerLite. Waitlist emails: email address and sign‑up source.
Open Food Facts. A public food database. When you scan a barcode, only the barcode number is looked up there.
Others. We may also disclose information if the law requires it, to protect our rights or users’ safety, or as part of a sale or restructuring of our business, in which case this policy continues to apply.
Sale, Advertising and Tracking
We do not sell personal information, share it for advertising, or use it to train AI models. PepPin shows no ads, contains no advertising or analytics trackers, and does not track you across other companies’ apps or websites. Because we don’t track you, our app and website work the same way whether or not your browser sends a Do Not Track signal.
Health Information and Consent
Much of what you enter in PepPin — doses, measurements, food, lab reports, check‑ins, sex, goals and Apple Health metrics — is health information, and some places give it extra legal protection. We use it only to provide PepPin’s features to you, and we never sell it.
On iPhone, separate consent screens appear before Chat and meal estimates send content to Anthropic. Apple Health access requires Apple’s permission sheet; Include health data controls the additional permitted context for Chat; and the AI features switch in Profile › Privacy & data stops future Chat and meal requests. You can take these permissions back at any time. The Android app sends no health information to anyone. Taking consent back stops future use and sharing; it does not delete data you already saved or undo requests already processed. Our Consumer Health Data Notice has more detail.
For other information, we rely on our contract with you (your account and subscription), on our legitimate interests in keeping PepPin secure, applying fair‑use limits and improving it, and on our legal obligations.
Retention
Your records on your phone, in your iCloud and in your Android backup stay until you delete them, delete your account, delete PepPin’s iCloud data or remove the backup. An Android backup is replaced by your phone’s next backup and is otherwise kept and deleted by Google under your Google Account settings.
Our server records (pseudonymous account ID, Pro status and usage counts) stay while your account is active and are deleted when you delete your account, except the counts of free Chat messages and free meal estimates already used, which remain so they cannot be claimed again.
Temporary meal results and their request hashes are deleted from our server up to 15 minutes after the first request. Raw meal photos, notes and descriptions are not stored by our server. Food entries you choose to save stay in your own records until you delete them.
Chat messages are not stored on our server. The AI provider handles them only to generate the reply, under its agreement with us, and deletes them within 30 days, unless they are flagged for breaking its usage policy (up to 2 years) or the law requires longer.
Meal inputs and estimates held by Anthropic follow the same standard API retention period described above: deletion within 30 days, except content flagged for misuse may be retained for up to 2 years, or longer where required by law.
Server logs are kept for up to 30 days.
Waitlist data stays until you unsubscribe or ask us to delete it.
Purchase records. Apple and Google keep their own records of your purchases under their own policies. RevenueCat keeps a purchase record under your pseudonymous account ID until you delete your account. On iPhone, deleting your account asks our server to delete that record from RevenueCat. On Android it is deleted on request, until our server step for Android is live (see Your Privacy Rights).
Your Privacy Rights
Wherever you live, you can ask us what personal information we hold about you, get a copy of it, correct it, delete it, or object to a particular use of it. Email [email protected] and we will respond within 45 days, usually much sooner. We may ask you to confirm your identity first, and we will never treat you differently for exercising these rights. If you disagree with our response, reply to it and a different person will review your request. You can also complain to the data protection authority where you live.
Because your records are on your phone and in your own iCloud or Android backup, and we don’t hold your email, most rights are quickest to use in the app:
Delete your account. Profile › Privacy & data › Delete account, on iPhone or Android. On iPhone this deletes your PepPin data from your iPhone and your private iCloud, then asks our server to delete its records for your account and your purchase record at RevenueCat; if your iPhone is offline, it asks again the next time you open PepPin. On Android it deletes your PepPin records from that phone, and your Android backup stops including them from the phone’s next backup. On Android your RevenueCat purchase record is deleted on request: the app then shows your account ID and offers a ready‑made email to [email protected] with the subject “Delete my purchase record”. This will happen automatically once our server step for Android is live. Apple and Google keep their own purchase records under their own policies. Deleting your account does not cancel a subscription. Our Data Deletion page explains what remains.
Turn off sharing (iPhone). Profile › Privacy & data: Include health data, AI features and Sync with iCloud.
Apple Health. Change or revoke PepPin’s permissions in iOS Settings › Health › Data Access & Devices › PepPin.
Disconnect Apple or Google sign‑in. In iOS Settings, tap your name, then Sign in with Apple; or use your Google Account’s security settings.
Emails. Use the unsubscribe link in any email.
Security
Data travels between the app, our server and our providers over encrypted connections (TLS). Records in your iCloud are stored in encrypted fields and protected by your Apple Account; an Android backup is encrypted by Android when your phone has a screen lock. Our server identifies accounts by a pseudonymous ID and keeps only the limited records described in this policy, including temporary meal estimates. Access to our systems is limited to people who need it to run PepPin, and each is bound by confidentiality. No system is perfectly secure; if a breach affects your data, we will tell you and, where required, the relevant authorities.
Minors
PepPin is for adults aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe a minor is using PepPin, email [email protected] and we will delete what we hold.
Changes and Contact
We may update this policy as PepPin evolves. We will post the new version at peppin.health/privacy with a new “last updated” date, which is also the date it takes effect, and, for significant changes, tell you in the app or by email.
PepPin is made and sold by VidZenith L.L.C‑FZ, Meydan Free Zone, Dubai, United Arab Emirates. Questions about this policy or your data: [email protected].