Privacy Policy

Effective date: July 2026

This Privacy Policy explains how PEP Social, LLC ("PEP Social", "we", "us", or "our"), based in Virginia, USA, collects, uses, discloses, and protects your personal information when you use our mobile app, our website at pepsocialapp.com, and related services (together, the "Service"). It also describes the rights and choices available to you. By using the Service, you agree to this Policy. If you do not agree, please do not use the Service.

Definitions

To help make this Policy clear, the following terms have the meanings below:

• Personal Information — information that identifies, relates to, or could reasonably be linked to you, such as your email address, username, or the content you create.
• Sensitive Information — a subset of Personal Information that warrants additional protection, such as your date of birth, gender, and any health-related details you choose to enter (for example, your goals, protocols, or tracker entries).
• Service Providers — third-party companies that process information on our behalf and only to provide their service to us (see Section 3).
• AI Assistant — the in-app assistant that processes the messages you send it through our AI provider to generate a response (see Section 4).

1. Personal information we collect

A. Information you provide directly

• Account information: your email address, username, display name/handle, and password (stored only as a secure hash — we never see your actual password).
• Profile information: optional details you add such as a bio, profile photo/avatar, and your goals.
• Private profile fields: your date of birth, gender, and (if you choose) phone number. These are stored in a private, owner-only area and are visible only to you — never shown to other users.
• Content you create: posts, captions, photos and images you upload, peptide references, ratings, comments, likes, saves, and the accounts you follow.
• Tracker data: doses, vials/supply, and schedules you log in the in-app protocol tracker.
• AI assistant messages: the questions and messages you send to the in-app AI assistant.
• Communications: messages, feedback, and support requests you send to us.
• Purchase information: if you subscribe to premium, your purchase is handled by the Apple App Store. We receive confirmation of your subscription status — not your full payment card details.

B. Information collected automatically

• Authentication & device data: limited technical data needed to operate and secure the Service, such as session tokens, device and operating-system type, app version, the IP address you connect from, and basic security/diagnostic logs.
• Cookies & local storage: our mobile app uses secure local storage and similar technologies to maintain your session and preferences. Our website uses only essential cookies required for its operation. We do not use advertising cookies or cross-site tracking cookies.

C. Information from third parties

• Infrastructure providers that help us run the Service (see Section 3).
• The Apple App Store confirming your subscription status when you purchase premium.
• Other users — for example, when they interact with or mention content you posted.

D. Sensitive & health-related information

Because PEP Social is focused on peptides, some information you choose to share (such as your goals, protocols, or progress) may be considered health-related or sensitive. PEP Social is not a healthcare provider, and we collect health-related information only because you voluntarily choose to enter or share it. We use this information solely to provide the features of the app — not to diagnose, treat, or provide medical care of any kind. We treat your private profile fields and tracker data as sensitive, restrict access to you, and never sell them. Anything you choose to publish in a public post, photo, rating, or comment will be visible to other users — so please don't share anything you aren't comfortable making public.

E. Aggregated & de-identified information

We may create aggregated or de-identified information (which cannot reasonably identify you) and use it for any lawful purpose, such as understanding feature usage and improving the Service. We do not attempt to re-identify it.

2. How we use personal information

• To provide and operate the Service — your feed, profile, trending, tracker, AI assistant, follows, saves, and notifications.
• To create and authenticate your account and keep it secure.
• To send essential account emails (sign-in codes, password resets, and security or service notices) through our email provider. We do not send marketing emails without your consent.
• To generate responses from the AI assistant (see Section 4).
• To maintain safety, prevent fraud and abuse, and enforce our Terms of Use.
• To respond to your requests, comments, and support inquiries.
• To improve and debug the Service, using aggregated or de-identified data where practical.
• To comply with our legal obligations and respond to lawful requests.

3. How we disclose personal information

We do not sell your personal information and we do not share it for cross-context behavioral advertising. We disclose information only as follows:

• Service providers (processors) who process data on our behalf, only to provide their service to us:
  • Supabase — database, authentication, and secure file storage.
  • Resend — transactional emails.
  • OpenAI — processing AI assistant conversations.
• The Apple App Store — subscription processing and purchase verification.
• Other users — content you post publicly (posts, photos, ratings, comments, public profile fields) is shown to other users by design.
• Legal and safety — to comply with applicable law, respond to lawful requests, enforce our Terms, or protect the rights, safety, and property of PEP Social, our users, or the public.
• Business transfers — if we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, with this Policy continuing to apply.
• With your direction or consent — when you ask us to share information or otherwise agree.

4. The AI assistant

The in-app AI assistant processes the messages you submit through OpenAI to generate a response, which is then returned to you. Your conversations are processed solely to provide this functionality. PEP Social does not use your AI conversations to train its own AI models. OpenAI acts as a service provider and processes your messages under its own privacy practices. AI responses may occasionally be inaccurate or incomplete and are not a substitute for professional medical, legal, financial, or other advice — you should not rely on the AI assistant for such advice, and you should verify important information independently. Please avoid submitting highly sensitive information to the AI assistant.

5. Your communication & notification choices

• Essential emails (sign-in codes, password resets, security notices) are required to operate your account and cannot be turned off while your account is active.
• In-app notifications can be managed in your device settings and within the app.
• Marketing — we do not send marketing communications without your consent, and you can opt out at any time.

6. International data transfers

PEP Social is operated from the United States, and our service providers may process data in the United States and other countries. If you access the Service from outside these regions, your information may be transferred to, stored in, and processed in a country whose data-protection laws differ from yours. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for these transfers. By using the Service, you understand your information may be processed in these locations.

7. User-generated content

The Service includes public, social features. Posts, photos, ratings, comments, and public profile fields you share are intended to be visible to other users, and you should have no expectation of privacy or confidentiality in that content. You can edit or delete your content at any time; deleting content removes it from the Service, although copies may persist temporarily in backups or caches. See our Terms of Use for more.

8. How we protect your information

We use technical and organizational safeguards designed to protect your information, including encrypted connections (HTTPS/TLS) for data in transit, row-level security so that private data is accessible only to its owner, least-privilege access controls, hashed passwords, secure server-side handling of secrets and API keys, encrypted communications, and limited retention of backups before their secure deletion. No method of transmission or storage is completely secure, and we cannot guarantee absolute security — but protecting your information is a core priority.

9. How long we keep your information

We retain personal information for as long as your account is active and as needed to provide the Service, comply with our legal obligations, resolve disputes, maintain security, and enforce our agreements. You can delete your account at any time directly within the app. When you do, we delete or de-identify the personal information associated with it — generally within 30 days — except where we are required or permitted by law to retain certain records. Aggregated or de-identified information may be retained indefinitely.

10. Your privacy rights

Depending on where you live, you may have some or all of the following rights:

• Access / portability — request a copy of the personal information we hold about you.
• Correction — ask us to correct inaccurate or incomplete information (most fields are editable directly in the app).
• Deletion — ask us to delete your account and associated personal information.
• Objection / restriction — object to or ask us to limit certain processing.
• Withdraw consent — where we rely on consent, withdraw it at any time (this does not affect prior processing).
• Non-discrimination — we will not discriminate against you for exercising your rights.

To exercise any of these, use the in-app controls or email support@pepsocialapp.com. We may need to verify your identity before acting on a request, and you may use an authorized agent where the law permits.

11. Region-specific rights

United States — California (CCPA/CPRA)

If you are a California resident, you have the rights described in Section 10, plus the right to know the categories of personal information we collect and how we use and disclose it. We do not sell your personal information and do not share it for cross-context behavioral advertising. The categories below reflect the information we collect:

To exercise your California rights, email support@pepsocialapp.com. You may also designate an authorized agent, subject to verification.

United States — Virginia (VCDPA)

PEP Social, LLC is based in Virginia. If you are a Virginia resident, the Virginia Consumer Data Protection Act gives you the right to confirm whether we process your personal data and to access it, to correct inaccuracies, to delete it, to obtain a portable copy, and to opt out of targeted advertising, the sale of personal data, and certain profiling. We do not sell personal data or use it for targeted advertising or profiling, so those opt-outs do not apply to our practices. To exercise your rights, email support@pepsocialapp.com. If we decline a request, you may appeal by replying to our response; if an appeal is denied, you may contact the Virginia Attorney General.

Other U.S. states

Residents of other states with comprehensive privacy laws (such as Colorado, Connecticut, Utah, and Texas) have similar rights to access, correct, delete, and obtain a copy of their personal information, and to opt out of sales and targeted advertising. Because we do not sell data or run targeted advertising, those opt-outs do not apply to us. To exercise any available right, email support@pepsocialapp.com.

European Economic Area, United Kingdom & Switzerland (GDPR / UK GDPR)

If you are in the EEA, UK, or Switzerland, PEP Social, LLC is the controller of your personal information. You have the rights in Section 10, and you may lodge a complaint with your local data-protection authority. We rely on the following legal bases:

To exercise your rights or ask about our transfer safeguards, email support@pepsocialapp.com.

Canada

We collect, use, and disclose personal information with your consent (express or implied) unless otherwise permitted by law. You may withdraw consent subject to legal and contractual limits, though this may limit your ability to use the Service. You may access and request correction of your personal information by emailing support@pepsocialapp.com. Quebec residents may also have rights to data portability and de-indexing where required by law.

12. Children

PEP Social is intended for users 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.

13. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will update the "effective date" above and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect means you accept the updated Policy.

14. Contact us

You can contact us regarding your privacy rights, questions, or requests using the details below.

Privacy Contact
PEP Social, LLC
Virginia, United States
support@pepsocialapp.com