Pepmaxing Privacy Policy

Last updated October 3, 2026. This notice explains how LastGenApps LLC, a Wyoming limited liability company and the company behind Pepmaxing (“we”, “us”, “our”), processes personal information when you use the Pepmaxing iOS application (the “App”) — its protocol and dose tracking, injection-site rotation, reconstitution calculator, level estimates, nutrition and meal scanning, progress photos, body scan, research library and assistant — and the pepmaxing.health website. Our Consumer Health Data Privacy Policy adds detail and rights specific to health data.

Summary

Who we are

LastGenApps LLC publishes the App and this website and is the controller of the personal information described here. For any privacy question, request or complaint, email contact@pepmaxing.health. We answer from that address and, where a law sets a deadline, within it.

Information we collect

Everything below is created by you, in the App, or generated by the App from what you enter. We do not buy data about you and we do not collect anything from other apps on your device.

Account

When you sign in with Apple or Google we receive an account identifier and an email address, which may be Apple’s private relay address, plus the sign-in method and timestamps. Account and authentication records are stored with Supabase. We never receive your Apple ID or Google password. Sign in with Apple lets you hide your real email; we honour that.

Profile and onboarding

Your name or nickname, goals, experience level, motivation and obstacles, the compounds you are interested in, biological sex, age, height, weight, preferred units, notification preferences, an avatar choice and a referral code. We use these to set the App up around your protocol, to compute things like body-mass index and protein targets, and to scale body-scan measurements. Height, weight, sex and age are health-related; see the Consumer Health Data Privacy Policy.

Protocol and dose data

Protocols you create (compound, dose, unit, administration route, schedule, cycle, vial size and reconstitution volume, start date, notes), every dose you log or skip with its time and any dose override, injection sites, streaks, vial inventory and the estimated remaining doses. Custom compounds you add and peptides you save from the library are stored too.

Health observations

Weight, body-fat percentage, lean mass, waist circumference, mood, energy, sleep and other entries you add, with their dates and notes; weekly weigh-in and check-in preferences. Body-scan results are written here as entries labelled “Body scan”.

Body scan

The body scan records a short silent video of you turning in front of the camera. On your iPhone, Apple’s Vision framework reduces about twenty-four frames to an outline, body joints and a viewing angle, and a statistical human body model is fitted to them. What we store in your account is the result: circumferences, estimated weight and body fat, posture angles, a quality score and the small set of shape parameters that let the App draw your body. The video, the frames and the fitted mesh stay in the App’s private storage on the device and are deleted when you delete the scan or the App. The scan does not use facial recognition, does not create a face or body template that could identify you, and is not a biometric identifier.

Progress photos

Photos you choose to take or import as progress photos are uploaded to private, account-scoped storage that only your account can open. They are never shown to other users, never sent to an AI provider, and never used for advertising or model training. We recommend cropping out your face; the App does not require it to be visible.

Nutrition and food

Meals and water you log, foods you search for, barcodes you scan, nutrition targets, and the corrections you make to AI-estimated portions (item, estimated grams, your correction, whether you removed the item). Portion corrections are linked to your account and used to calibrate estimates. Search terms and barcodes that miss our own database are recorded without any account identifier, together with the number of results, so we can improve the food database; they cannot be traced back to you.

Photos sent for analysis

When you photograph a plate or a Nutrition Facts panel, a downsized copy of that photo is sent through our server to OpenAI to name the foods and estimate portions, or to read the printed values. We keep a count of these requests per account (kind, tokens used, time) to enforce a daily limit; we do not store the photo. See AI and automated processing.

Assistant conversations

Questions you ask the in-app assistant and its answers are stored in your account so the conversation history follows you across devices. The assistant itself runs on your device and answers from our research library and your own data; your messages are not sent to any AI provider.

Feedback and support

Messages you send from the App’s feedback form (with the App version) and emails you send us, including your email address and anything you attach.

Subscription and referral information

When paid plans are offered, purchases are made through Apple’s App Store. We receive entitlement information — plan, status, renewal or trial dates, an anonymised transaction identifier — but never your payment card or Apple payment credentials. Referral codes you share and redemptions are recorded to attribute referrals.

Device and diagnostic information

The App includes crash reporting (Sentry). When the App crashes or hits an unexpected error, it sends the device model, OS version, App version, the technical stack trace and your opaque account identifier — never health data, names, emails or the content of what you typed — so we can fix the fault. Our servers keep ordinary technical logs (IP address, request timestamps, user-agent) for security and debugging, retained briefly.

Product analytics and session replay

To understand which parts of the App are used, where people get stuck and why they stop using it, the App sends product analytics to PostHog: which screens are opened, which features are used (for example “a dose was logged”, “a meal was scanned”, “the paywall was shown”), device model, OS and App version, and your opaque account identifier. These events describe that something happened, not what: they carry no dose amounts, compound names tied to you, weights, measurements, meals, photos, chat text, names or email addresses. Your IP address is discarded on arrival and not stored.

Some sessions are also recorded as a session replay — a reconstruction of what was on screen as you moved through the App. Before anything leaves your device, every text field and every image is masked (shown as a blank box), so a replay shows the layout you saw and where you tapped, never what you typed, your photos or the camera. Replays are kept for 30 days and are only viewed by us to fix problems and improve the App. You can turn analytics and replay off at any time in the App under Settings → Your data → Share usage analytics; the switch takes effect immediately.

The App includes no advertising or attribution SDKs and does not track you across other companies’ apps or websites.

What stays on your device

• Body-scan videos, frames and the fitted 3D mesh (the App’s private documents folder).
• The assistant’s processing: it runs on-device.
• Meal and label photos: they are transmitted for one analysis and not stored anywhere by us.
• Reminder scheduling: all notifications are scheduled locally on the phone; we operate no push server and hold no push tokens.

Everything else you enter is stored locally and mirrored to your account so that a new device, or a reinstall, restores it.

How we use information

We use personal information to create and secure your account; provide protocol, dose, injection-site, vial, level-estimate, health, nutrition, photo, body-scan, library and assistant features; synchronise your data across your devices; calculate estimates and targets from published formulas and trial data; personalise the App; enforce fair-use limits on AI analysis; calibrate portion estimates; provide support; administer subscriptions and referrals; prevent abuse and fraud; debug and secure the service; and comply with legal obligations. We do not use your information to make decisions with legal or similarly significant effects about you.

Legal bases (EEA and UK)

Where the GDPR or UK GDPR applies, we rely on: performance of a contract to provide the App you signed up for; your explicit consent for health data, which is special-category data — you give it by entering health information into the App and can withdraw it by deleting the data or your account; legitimate interests in securing the service, preventing abuse and improving the food database with de-identified search terms; and legal obligations where they apply. Where we rely on legitimate interests we have balanced them against your rights.

AI and automated processing

Meal and label analysis. Our current provider is OpenAI. The request contains the downsized photo and our instructions; it does not contain your name, email, account identifier, protocols or health entries. Under OpenAI’s API terms, content sent through the API is not used to train OpenAI’s models; OpenAI may retain API inputs and outputs for up to 30 days to monitor for abuse, then deletes them, subject to legal requirements. We store the result only if you log it, and always as an estimate that you can review and correct before anything is logged.

The assistant is not a large language model. It answers from our curated research library and your own data, on your device. It is designed never to recommend a dose, titration, cycle or protocol.

Ahead projections are calculations from published clinical-trial averages, shown as ranges with their source. They are not predictions about you, and no model learns from your data to make them.

If we change providers or materially change what is sent, we will update this notice before the change takes effect.

Service providers and other recipients

We do not use advertising or attribution providers in the App; PostHog receives only the product events and masked replays described above, Superwall only the events needed to show and test subscription offers, RevenueCat only purchase information, and none of them receives health data. We may also disclose information when required by law, to investigate abuse or security incidents, to protect rights and safety, or as part of a corporate transaction, subject to safeguards and to this policy continuing to apply.

No sale, no advertising, no tracking

• We do not sell personal information and do not exchange consumer health data for money or anything of value.
• We do not “share” personal information for cross-context behavioural advertising as California law defines it, and we do not engage in targeted advertising.
• The App does not request Apple’s App Tracking Transparency permission because it does not track you across apps or websites, and it does not collect the advertising identifier (IDFA).
• The App contains no advertising, no third-party analytics and no third-party pixels.
• Because we do nothing to opt out of, we have no “Do Not Sell or Share” toggle; you can still contact us to confirm this in writing for your account.

Device permissions and notifications

Camera — used for the body scan, barcodes, Nutrition Facts labels and progress photos, only while you use those features. Photo library — only when you choose to import a photo or video. Notifications — optional dose reminders, missed-dose follow-ups, streak and weekly summaries, vial-running-low, protein and weigh-in reminders, all scheduled on the device; their content is chosen so that a locked-screen preview does not reveal your compound unless you allow it in settings. Apple Health — not yet integrated; when it is, we will read only the types you authorise, never use HealthKit data for advertising, marketing or data mining, never sell it, and update this notice and the Consumer Health Data Privacy Policy first.

Retention

• Account data (profile, protocols, doses, health entries, meals, body-scan results, conversations, portion corrections, AI-usage counts, feedback) is kept while your account exists and is deleted when you delete your account.
• Progress photos are kept until you delete the photo or your account.
• Deleted data leaves our live database immediately and our provider’s backups within 30 days.
• Body-scan videos and frames live only on your device and go when you delete the scan or the App.
• Meal and label photos are not stored by us; OpenAI may hold them up to 30 days as described above.
• De-identified food-search terms carry no account identifier and are kept to improve the database.
• Server logs are kept for a short, rolling period for security and debugging.
• Subscription, referral, consent, support, security and legal records may be kept as long as we need them for accounting, dispute resolution, fraud prevention or legal compliance.

Security and international transfers

Data travels over TLS; every table and storage bucket is protected by row-level security so that an account can read only its own rows and files; server functions verify your session before acting; secrets never ship inside the App; and access to production is limited to the people who operate it. No security measure is perfect. If a breach affects your personal information, we will notify you and the relevant authorities as applicable law requires, without undue delay.

Our providers process information in the United States and may do so in other countries. Where the law of your country requires it, we use recognised safeguards for those transfers, such as the European Commission’s standard contractual clauses.

Minors

Pepmaxing is for adults aged 18 and over. We do not knowingly permit anyone under 18 to register and do not knowingly collect information from them. If you believe a minor has provided personal information, email us and we will delete it.

Your privacy rights

Depending on where you live you may have the right to access your personal information and receive a copy in a portable format; to correct it; to delete it; to restrict or object to certain processing; to withdraw consent at any time without affecting earlier processing; not to be discriminated against for exercising your rights; and to appeal if we decline a request. These rights can be subject to legal exceptions and to identity verification.

How to exercise them. Most of it is in the App: every entry can be edited or deleted, and Settings → Delete account removes everything (see Data deletion). For a copy of your data, or anything else, email contact@pepmaxing.health from the address on your account; we will verify it is you and respond within 30 days (45 for California requests, extendable once as the law allows). An authorised agent may act for you with your written permission. If you are unhappy with our answer you may appeal by replying to it, and you may complain to your data-protection authority — in the EEA, the authority of your country of residence; in the UK, the Information Commissioner’s Office.

Regional disclosures

California

In the past twelve months we have collected the categories listed under Information we collect: identifiers, account and profile information, health information (sensitive personal information), commercial information (subscriptions, referrals), visual information (progress photos, and photos processed for analysis), and inferences the App computes for you (estimates and projections). Sources: you, and the App’s own computations. Purposes: those listed under How we use information. We disclose them for business purposes only to the processors in Service providers. We do not sell or share personal information, have not done so in the past twelve months, and have no actual knowledge of selling or sharing the personal information of consumers under 16. We use sensitive personal information only to provide the features you use, not to infer characteristics about you for other purposes. We offer no financial incentives for data. You have the rights listed above, including to limit our use of sensitive personal information (contact us), and “Shine the Light” disclosures on request.

Washington, Nevada and Connecticut consumer health data

Our Consumer Health Data Privacy Policy describes the categories of consumer health data we collect, why, with whom they are shared, and how to exercise your rights, including the right to withdraw consent and to have your consumer health data deleted.

Illinois and other biometric laws

We do not collect biometric identifiers or biometric information. The body scan produces measurements and shape parameters, not a scan of face, hand or body geometry that could be used to identify you, and the video never leaves your device.

EEA, UK and Switzerland

The legal bases above apply. Health data is processed on the basis of your explicit consent. You may lodge a complaint with your supervisory authority; we would appreciate the chance to address your concern first.

Account and data deletion

Settings → Delete account removes your authentication record, profile, protocols and dose logs, health entries, meals, body-scan results, assistant conversations, portion corrections, AI-usage counts, feedback and progress photos, and the App then clears its local data including body-scan videos. Deletion reaches our provider’s backups within 30 days. It does not remove de-identified food-search terms (they carry nothing that could identify you), records we must keep for legal or accounting reasons, or information held by Apple, Google or OpenAI under their own policies.

Deleting your account does not cancel an App Store subscription: manage that in iOS Settings → your name → Subscriptions. See Refunds. Full steps are on the Data deletion page.

This website

pepmaxing.health sets no cookies and runs no analytics, advertising pixels, session recording or third-party embeds. Fonts, videos and the interactive body model are served from our own domain, so a page view is a request to our host and nothing else; our host keeps ordinary request logs briefly for security. Because there is nothing to opt out of, we have no cookie banner and treat a Global Privacy Control signal as already satisfied. If you email us from the site, we process your message and address to reply.

Changes and contact

We may update this notice as the App or the law changes. We will post the revised notice here with a new date and, for material changes, tell you in the App before they take effect. Questions, requests, appeals and complaints: contact@pepmaxing.health.