Privacy Policy
Pepta is built privacy-first. The short version: your dose history, weights, side effects, and notes live on your device. There is no Pepta account, no Pepta server that receives your health data, and no analytics that can identify you. This page explains what that means in detail and what we do collect.
1. What Pepta stores on your device
Pepta stores the following information locally inside the app, encrypted at rest by the operating system:
- The medications you've added (e.g. Tirzepatide, Semaglutide), their cadence, and your default dose.
- Each dose you log: timestamp, medication, dose amount, injection site, and any notes you add.
- Each weight you log: timestamp and value.
- Optional side-effect logs you create.
- Your reminder schedule and notification preferences.
- Pen and vial inventory data (doses remaining, expiration date) if you choose to track them.
- App settings such as units (lb / kg), default range for the chart, and theme.
This data is stored inside the App's private sandbox on your device. On modern iOS and Android devices the app sandbox is encrypted at rest by the operating system's full-disk encryption when a passcode is set. Pepta does not transmit this data to its own servers (we don't run any servers that receive your health data) or to any third party.
2. What Pepta does not do
- Pepta does not require an account, email, or phone number to use the app.
- Pepta does not upload your dose history, weights, or side-effects to any server.
- Pepta does not include third-party advertising SDKs, tracking pixels, or fingerprinting libraries.
- Pepta does not sell your data. There is no data to sell because we do not collect identifiable health data to begin with.
- Pepta does not share your data with insurers, pharmacies, or pharmaceutical companies.
3. Anonymous, aggregate diagnostics
Like most apps, Pepta uses Apple's and Google's standard crash and performance reporting (App Store Connect Crash Reports / Google Play Console Vitals) so we can fix bugs. These reports contain things like the device model, OS version, and the line of code that crashed. They do not contain your dose history, weights, or any other health data, and they do not contain anything that identifies you. If you have crash reporting disabled at the OS level, Pepta will not receive these reports either.
4. Optional integrations you control
Pepta only talks to other services if you turn them on:
- Local notifications. Pepta schedules reminders directly with your operating system. The reminders are scheduled and fired entirely on-device; they do not pass through Pepta's servers.
- iOS share sheet / Android share intent. When you tap "Share clinician PDF," the PDF is generated on-device and handed to the operating system's native share sheet so you can choose where it goes (Messages, Mail, Files, AirDrop, etc.). Pepta does not see or upload the PDF.
- In-app purchases (optional). If you subscribe to Pepta+, the transaction itself is handled by Apple's App Store or Google Play — Pepta never sees your name, email, address, or payment method. To validate your subscription on this device and any other device you sign into with the same Apple ID or Google account, we use RevenueCat. See section 5 below for the full RevenueCat disclosure.
5. Subscription processor (RevenueCat)
Pepta uses RevenueCat, Inc. — a US-based subscription-management service — to validate whether your device is entitled to Pepta+ features. We use RevenueCat only when you tap the Pepta+ paywall, start a trial, complete a purchase, or tap "Restore Purchases." Free users who never open the paywall do not cause any RevenueCat data to be sent.
When RevenueCat is contacted, it receives:
- An anonymous app user ID (a random UUID generated on your device — not your name, email, or Apple ID).
- The transaction your store (Apple or Google) just completed: product identifier, price, currency, transaction ID, and timestamp.
- Device-level identifiers needed for fraud prevention (the device's vendor identifier on iOS, an equivalent identifier on Android), the app and OS version, and your country code.
- Your IP address, which RevenueCat retains briefly for fraud-detection and abuse-prevention purposes.
RevenueCat does not receive: your name, email address, payment method, dose history, weight, side-effect data, medications, or any other information you log inside Pepta. We never call any RevenueCat method that would associate your subscription with your real identity — your RevenueCat user ID stays anonymous.
RevenueCat's processing is governed by their own privacy policy and DPA. If you are an EEA, UK, or California resident exercising rights under GDPR or CCPA, RevenueCat acts as a sub-processor for the limited purposes described above; Pepta, LLC is the controller of the relationship.
6. Device backups
Your Pepta data is included in your phone's standard system backup if you have backups enabled — iCloud Backup on iOS, or your Google account backup on Android. This is the same way every app's local data is backed up by the operating system. Pepta does not have its own cloud sync. If you want a copy of your data, use Settings → Export data inside the app to generate a portable JSON file you control.
7. Children's privacy
Pepta is not designed for children under 13 and is not directed to them. Pepta does not knowingly collect information from children.
8. Your rights
Because your data lives on your device, you already have full control. Specifically you can:
- Export everything. Settings → Export data writes a JSON file to the iOS share sheet with every dose, weight, medication, and setting.
- Import on a new device. Settings → Import data restores from a previously exported JSON file.
- Delete everything. Settings → Erase all data wipes Pepta's storage on the device. Deleting the app from your phone also removes all of its data.
Residents of California (CCPA), the EEA / UK (GDPR), and other regions with similar laws have additional rights under those laws — including the right to access, correct, and delete personal data. Because Pepta does not collect or store identifiable health data on our servers, the simplest way to exercise these rights is the in-app export and erase tools described above. If you have a question we cannot resolve through the app, contact us at the address below.
9. Changes to this policy
If we update this policy, we'll change the "Last updated" date at the top and announce the change in-app for material changes. Continued use of the app after a material change means you accept the updated policy.
10. Contact
Questions about this policy or about how Pepta handles data: hi@peptaapp.com.
See also: Terms of Service.