Privacy Policy

At Pepglow, we believe your personal health and tracking data belongs to you. This Privacy Policy outlines how the Pepglow application collects, uses, and safeguards your information.

1. On-Device Storage & Encryption

Pepglow is built on an offline-first architecture. All core tracking metrics—including your dose history, compound names, injection site rotations, body weight entries, macronutrient intakes, side effects, reminders, and progress photos—are stored locally in an encrypted database directly on your iOS device. We do not operate server-side databases for these tracking logs, meaning your records stay on your device.

2. Apple HealthKit Integration

You can optionally enable bi-directional integration with Apple Health (HealthKit). If granted permission, Pepglow can:

• Read steps, active energy, and sleep duration to display in your lifestyle cockpit.
• Write logged weight, water intake, and nutritional macronutrients directly to Apple Health on your device.

HealthKit data is processed strictly on-device. We never transmit HealthKit data to third-party services or remote servers.

3. AI Assistant (Pep Bot) Data Flow

Pep Bot is an optional educational assistant. Before utilizing Pep Bot, you are presented with an AI data-sharing consent prompt. If you choose to send a message:

• Only your prompt text and limited app context (current compound name and last-dose timestamp) are transmitted.
• The payload is routed through a secure, privacy-preserving proxy hosted on Cloudflare Workers, which keeps OpenRouter keys server-side.
• The request is sent to OpenRouter to generate responses from large language models.
• No identifying variables (such as names, emails, contacts, or location details) are ever sent. OpenRouter does not retain personal records for tracking purposes.

4. Identifiers

For AI rate limiting, abuse prevention, and RevenueCat subscription entitlement verification, the app utilizes a randomly generated installation UUID. This identifier is not linked to your identity or contacts.

5. Permanent Data Deletion

Because there is no remote server-side account, you can erase your data instantly. In the app's Settings, tapping "Delete All Data" permanently and immediately deletes all local database records, encrypted progress photos, check-in reminders, and consent forms from your device. Data previously synced to Apple Health remains under your control in the iOS Health app.

6. Third-Party Services

We use the following third-party integrations to run standard app capabilities:

• RevenueCat for processing App Store subscriptions and tracking entitlement states.
• Cloudflare for secure routing proxy.
• OpenRouter for generating AI educational coaching responses.

7. Contact Us

If you have any questions or feedback regarding our privacy practices, please contact us at support@peptracker.app.