PRIVACY POLICY

1. DATA WE COLLECT

Peptide AI Journal is designed to work locally on your device. The following data stays on your device unless otherwise noted:

• Profile (name, age bracket, goals, experience level)

• Daily check-ins, injection logs, stack history

• Face-scan photos and derived landmark indices

• Progress photos

• Oracle chat history

• Mewing and library activity logs

• Preferences and unlocked achievements

2. DATA WE SEND OFF-DEVICE

• THE ORACLE (AI CHAT) — DATA SENT TO OPENAI. The Oracle is powered by OpenAI, a third-party AI provider. When you send a message, this app transmits the following to OpenAI's API over HTTPS: (a) your typed messages and the history of that chat; (b) your first name; (c) your primary goal and experience level; (d) a summary of your active protocol, including compound names and doses; and (e) the numeric indices from your most recent face scan. Nothing else is sent — no photos, no check-in notes, no progress photos. HOW IT IS COLLECTED: this data is collected from what you type in the chat and from the profile, protocol, and scan entries you created in the App. WHY: solely to let the Oracle answer with context about you. The Oracle is optional and is gated behind an explicit in-app consent screen that lists exactly this data before anything is sent; nothing is transmitted until you agree, and you can use the rest of the App without it. RETENTION AND PROTECTION AT OPENAI: OpenAI processes this data only to generate the response and, per its API data-usage policy in effect at this app's release, does not use API inputs to train its models and retains them only for a short abuse-monitoring window (up to 30 days). OpenAI is contractually bound by its API terms to provide protections for this data that are the same as or equal to those described in this Privacy Policy. Your chat history itself is stored locally on your device and can be cleared anytime via the Oracle menu ("New conversation") or Settings → Delete account & data. Additionally, the optional "Weekly AI Insights" feature (in the weekly recap) sends a text summary of your recent check-ins (energy/mood/sleep ratings), any side effects you logged, dose counts, and your active protocol to OpenAI to surface possible patterns. It is gated behind the same consent as the Oracle and shows an explicit in-app disclosure of exactly what is sent; nothing is transmitted until you tap to generate insights, and OpenAI handles this data under the same terms described above.

• FACE DATA (FACE SCAN). When you use the optional Face Scan feature, the App collects a photograph of your face that you choose to capture or import. We do NOT extract, generate, or store a biometric face template, faceprint, or any data capable of uniquely identifying you. The photo is used solely to compute non-identifying, heuristic "tracking indices" (such as a symmetry or skin-clarity score on a 0–100 scale) and three short lifestyle observations, so you can track changes in your own photos over time. To do this we send a downscaled JPEG (long edge ≤ 1024 px) over HTTPS to OpenAI's multimodal API, which returns structured numeric results plus three short text observations. We store ONLY those numeric results and text observations locally on your device. The original photo is kept ONLY on your device, in your own in-app gallery, and is never uploaded to us or to any party other than the OpenAI request described here. RETENTION: the derived indices and the on-device photo remain on your device until you delete them — individually in the App, via Settings → Delete account & data, or by deleting the App. We operate no servers and retain no copy of your face photo or derived data. OpenAI processes the transmitted image only to generate the response and, per its API data-usage policy in effect at this app's release, does not retain API inputs beyond a short abuse-monitoring window (up to 30 days) and does not use them to train its models. SHARING: face data is shared only with OpenAI as the processing provider for this single request; it is never sold or shared with advertisers or data brokers. OpenAI is contractually bound by its API terms to provide protections for this data that are the same as or equal to those described in this Privacy Policy. Face Scan is optional and gated behind an explicit in-app consent screen that names OpenAI and lists exactly what is sent; nothing is transmitted until you agree, and you can use the rest of the App without Face Scan.

• Progress photos (the weekly tracking gallery) are stored locally only. They are NOT sent anywhere.

• StoreKit in-app purchases are handled by Apple. We receive only the transaction identifier, not your payment details.

• We use Google Firebase (Analytics, Remote Config, and Crashlytics) to understand how the App is used in aggregate, to toggle features remotely, and to receive crash diagnostics. Firebase Analytics may collect: anonymous app-install identifier, device model and OS version, country/region, app events (for example "check-in completed", "paywall viewed"), your subscription status (whether you are on the free tier or an active paid plan), and — only if you grant permission via the iOS tracking prompt — the iOS advertising identifier for attribution. Content such as your profile, photos, Oracle messages, and check-in notes is NEVER sent to Firebase.

3. WHAT WE DO NOT DO

• We do not upload your progress photos to any server.

• We do not store your face scan photos on our servers (we don't have any) — they go directly to OpenAI for analysis and to your own device's gallery.

• We do not sell your data.

• We do not share your data with third-party advertisers or data brokers.

• We do not track you across other apps or websites unless you explicitly grant permission via the iOS tracking prompt, in which case a single advertising identifier is shared with Firebase solely for ad attribution.

4. THIRD-PARTY SERVICE PROVIDERS

We share limited data only with the following service providers, each for the specific purpose listed and never for their own advertising:

• OpenAI — AI processing for the Oracle (chat) and Face Scan. Receives only the data described in Section 2, and only after you accept the in-app consent screen for that feature. Under its API terms, does not use inputs to train its models and retains them only briefly (up to 30 days) for abuse monitoring. Contractually bound to provide protections for this data that are the same as or equal to those in this Policy.

• Google Firebase — Analytics, Remote Config, and Crash Reporting. Receives only the aggregate/diagnostic data described in Section 2 (never your photos, messages, notes, or protocol).

• Apple — In-App Purchases (we receive only a transaction identifier, not payment details) and, if you opt in, aggregate App Analytics.

We do not sell your data and do not share it with any party other than those above.

5. APPLE ANALYTICS

If you opted into "Share with App Developers" in iOS Settings, Apple may share aggregate, anonymized crash and usage data with us. This does not include your content.

6. DELETION

You can delete all your data from the App at any time via Settings → Delete account & data. This permanently removes all locally stored data, including your Oracle chat history. We operate no servers, so there is no server-side copy to delete. Data already transmitted to OpenAI is governed by OpenAI's own retention policy described above (not used for training; retained only briefly for abuse monitoring, up to 30 days).

7. CHILDREN

Peptide AI Journal is for users 18 and older. We do not knowingly collect data from anyone under 18.

8. SECURITY

Local data is stored in iOS-protected application containers. We rely on iOS security features. No method of electronic transmission or storage is 100% secure.

9. INTERNATIONAL USERS

By using the App, you consent to processing of your data in the jurisdiction where our infrastructure (and Apple's / OpenAI's) operates.

10. CHANGES

We will notify you of material changes and require re-acceptance.

11. CONTACT

Privacy questions: aimoneysprint@gmail.com