Privacy Policy
Peptide Dose Tracker (peptidedosetracker.com)
Effective date: October 12, 2026
Last updated: October 12, 2026
Short version
- Your tracker data stays in your browser by default. We do not receive it.
- Calculators run in your browser. What you type into them is not sent to us.
- Cloud sync is not available yet. When it is, it stays off until you turn it on and accept a separate consent screen.
- We use no advertising pixels or ad networks, and we do not sell your data.
- Payments are handled by Stripe. We never send tracker data to Stripe.
- You must be 18 or older and in the United States.
- We are based in Poland, so the EU General Data Protection Regulation (GDPR) applies to how we handle your data, wherever you live. Section 12 has the details.
Our Consumer Health Data Privacy Policy explains in detail how we handle health-related data and your rights over it.
1. Who we are
Peptide Dose Tracker (the "service": this website, the calculators, the web tracker and Pro) is operated by Uladzislau Yasinski, a sole proprietor (NIP 5273049048), ul. Michała Kleofasa Ogińskiego 11 lok. 9, 03-318 Warsaw, Poland ("we", "us"). We are the controller of the personal data described here. Contact: [email protected] (privacy requests) or [email protected] (support).
2. What stays in your browser
When you use the tracker without sync, we store your vials, schedules, injection log, notes and settings in your browser (IndexedDB and local storage) on your device. This data is not sent to our servers. Because of this:
- we cannot see it, recover it or delete it for you;
- clearing site data, private browsing, a browser update or a lost device can erase it, so use Export and Backup file regularly;
- anyone with access to your unlocked device and browser may be able to see it. You can erase it under Settings, Erase this device.
Calculator inputs and results are processed in your browser and are not transmitted to us.
3. What we collect
| Data | When | Why | Kept for |
|---|---|---|---|
| Email address and sign-in method (magic link or Google) | You create an account (needed for sync and Pro) | Sign you in, send receipts and notices | While your account exists, then deleted within one month of account deletion |
| Subscription data: plan, status, Stripe customer ID, renewal date, billing country and ZIP code for tax | You subscribe or buy | Provide Pro, taxes, refunds, disputes | As long as tax and accounting rules require (generally 5 to 7 years) |
| Synced tracker data, encrypted | You turn on sync and consent | Show your data on your devices | Until you delete it or turn sync off and delete the copy; 60 days after Pro ends, then deleted |
| Reminder schedule and delivery address | You turn on email or push reminders | Send reminders | Until you turn them off |
| Server logs: IP address, browser, pages, timestamps | You visit | Security, abuse prevention, fixing errors | 30 days |
| Support messages | You write to us | Answer you | 24 months after the conversation ends |
| Usage events | Public pages (visitors in the United States): automatically, without a persistent ID. Tracker: only if you opt in | Understand which pages and features are used | See section 6 |
| Consent and preference records: what you agreed to, when, and which version of the text you saw | You create an account or change a privacy setting | Prove and honor your choices | While your account exists |
| Email delivery records: message type, send time, delivered, bounced or complained | We email you | Check that sign-in, billing and reminder emails arrive, and honor opt-outs | 90 days. Opt-out and bounce records are kept until you ask us to remove them |
We do not collect your name unless you give it to us, your contact list, your precise location or an advertising ID. We do not receive substance names, amounts or notes unless you turn on sync, and then only in encrypted form.
4. Cloud sync (optional, Pro)
Cloud sync is not available in the current version. The rest of this section describes how it will work when we release it, and we will not collect any tracker data for sync before you turn it on and accept the consent screen.
Sync is off by default. Before it turns on, a screen explains what is uploaded, why, who can see it and how to withdraw, and you must choose to turn it on. See the Consumer Health Data Privacy Policy for rights, retention and deletion, including from backups.
5. Payments and digital products
Payments are processed by Stripe. Our contract is with Stripe Payments Europe, Limited (Ireland), and Stripe, LLC in the United States receives your payment data. We receive your email, plan, payment status, card brand and last four digits, and billing country and ZIP code (used by Stripe Tax). We do not receive your full card number. Stripe acts as a processor for us and also as an independent controller for fraud prevention and legal compliance, under the Stripe Privacy Policy (opens in a new tab). Product names, descriptions and metadata we send to Stripe are generic, and the name that appears on your card statement is a short neutral abbreviation. We never send substance names, amounts, notes or other tracker data to Stripe. You can update your card, see invoices and cancel in the Stripe Customer Portal, linked from Settings and from every receipt.
Printable PDFs are delivered by download link to the email used at checkout.
6. Analytics, cookies and similar technologies
- Public pages and calculators: for visitors in the United States we use PostHog, hosted in its EU cloud in Frankfurt, Germany, to count page views and clicks on marked buttons. It runs in memory mode without cookies or a persistent ID, does not record sessions or form fields, and we configure it not to store IP addresses. It never receives numbers you type into calculators. For visitors elsewhere, and for anyone whose browser sends a Global Privacy Control or Do Not Track signal, this analytics is off.
- Tracker: analytics is off unless you turn on "Help improve the tracker" in Settings and give your explicit consent. If on, it receives only names of actions (for example "vial saved") and a random anonymous ID. It never receives values, names, notes or amounts, and you can turn it off at any time.
- Cookies and site storage: we set only essential items: a sign-in session cookie if you have an account, security tokens, and your privacy choices. Local storage and IndexedDB hold your settings and tracker data on your device, because you asked the tracker to keep them. You can block or delete cookies and site data in your browser settings; the tracker then cannot keep your log. Stripe may set its own cookies on stripe.com pages for fraud prevention during checkout.
- No advertising: we use no advertising cookies, pixels, retargeting or data brokers on any page.
- Do Not Track and Global Privacy Control: we do not sell or share personal data for targeted advertising, so there is nothing to opt out of, and we respect these signals by turning page analytics off and not tracking across sites. The Privacy choices link in the footer lets you turn page analytics off on request.
7. Email and notifications
We send sign-in links, receipts, subscription and renewal notices, reminders you turn on, and security messages. We do not send marketing email unless you opt in. Reminder emails and push notifications use fixed generic wording, for example "Reminder: 1 item due", and never include substance names, amounts, sites or notes. Push notifications travel through your browser vendor's push service.
8. Who receives data
We use service providers that process data only for us under written contracts:
- cloud infrastructure and database provider (accounts; sync storage when sync is available);
- Resend (Plus Five Five, Inc., United States), transactional email;
- Vercel Inc. (United States), website hosting;
- PostHog Inc. (analytics as described above, stored in Germany; the company is in the United States);
- Stripe (Stripe Payments Europe, Limited in Ireland, and Stripe, LLC in the United States), payments;
- Google LLC (United States), optional Google sign-in and support email. Google also acts as an independent controller when you sign in with Google.
We do not sell personal data and we do not share it for advertising. We may disclose data when required by valid legal process, in the way EU and Polish law allow (for a request from a court or authority in the United States, usually through a mutual legal assistance treaty), to protect the service from fraud or abuse, or to a successor in a merger or sale of the business that takes over this policy. Details for health-related data are in the Consumer Health Data Privacy Policy.
9. Where data is processed
The service is offered to people in the United States only. We operate from Poland, in the European Union. Our providers process data mainly in the United States, and PostHog stores analytics data in Germany. Section 12 explains the safeguards that cover transfers from the European Union to the United States.
10. Security
We use encryption in transit (TLS), end-to-end encryption of synced tracker content, access limits, and reasonable administrative, technical and physical practices. No system is completely secure, and we cannot guarantee that data will never be accessed without authorization. Keep your sync key and your device secure. If a breach affects your health information, we will notify you as described in the Consumer Health Data Privacy Policy.
11. Your choices and rights
You can access, export, correct or delete the data we hold about you, turn off sync, turn off analytics and close your account in Settings or by emailing [email protected]. We apply the rights described in the Consumer Health Data Privacy Policy and in section 12 to everyone, including residents of Washington, Nevada and Connecticut, and we answer requests within one month. If you disagree with our decision, you may appeal as described in the Consumer Health Data Privacy Policy. We do not discriminate against you for using these rights.
12. Additional information under the EU GDPR
We are established in Poland, so the EU General Data Protection Regulation (GDPR) applies to the personal data we process, wherever the people concerned live. We apply it to everyone who uses the service. This section gives the information the GDPR requires. If it conflicts with another section of this policy, this section controls for GDPR purposes.
Controller. Uladzislau Yasinski, a sole proprietor (NIP 5273049048), ul. Michała Kleofasa Ogińskiego 11 lok. 9, 03-318 Warsaw, Poland. Contact: [email protected]. We are not required to appoint a data protection officer and have not appointed one. Because we are established in the EU, we have no EU representative.
Health-related data and explicit consent. A tool for tracking injections can show information about a person's health, even if the person never types a medication name into it. We therefore treat your account, subscription, reminder and tracker-usage data as data concerning health (a special category under Article 9 GDPR) and ask for your explicit consent on separate screens: when you create an account, when you turn on reminders, when you turn on analytics in the tracker, and before cloud sync. These screens are not part of the Terms. You can withdraw consent at any time in Settings, Privacy, as easily as you gave it. Withdrawal does not affect processing done before it. If you withdraw consent for your account, we close the account. Tracker entries that stay in your browser are not processed by us.
Purposes and legal bases.
| Purpose | Data | Legal basis |
|---|---|---|
| Create and run your account, sign you in, send sign-in codes | Email address, sign-in method, security records | Contract (Article 6(1)(b)); explicit consent (Article 9(2)(a)), asked when you create the account |
| Subscription, payment, receipts, refunds, taxes and accounting | Plan, status, Stripe customer ID, billing country and ZIP code, card brand and last four digits, invoices | Contract (6(1)(b)); legal obligation for tax and accounting records (6(1)(c)); explicit consent (9(2)(a)) as above |
| Reminders you turn on | Reminder days and times, email address or push address | Contract (6(1)(b)); explicit consent (9(2)(a)), asked when you turn reminders on |
| Cloud sync, when available | Encrypted tracker content, reminder times | Explicit consent (6(1)(a) and 9(2)(a)) on the sync consent screen |
| Analytics in the tracker | Names of actions, random ID | Consent (6(1)(a)) and explicit consent (9(2)(a)); off unless you turn it on |
| Anonymous statistics on public pages, for visitors in the United States | Page, clicked button, referrer domain, browser type; no persistent ID and no IP address stored | Legitimate interests (6(1)(f)): learning which guides and calculators people use so that we can improve them |
| Security, abuse prevention and fixing errors | IP address, browser, pages, timestamps | Legitimate interests (6(1)(f)): protecting the service and its users |
| Support | Your messages | Contract (6(1)(b)) or legitimate interests (6(1)(f)): answering you. If you include health details, we use them only to answer you |
| Optional product emails | Email address | Consent (6(1)(a)), only if you opt in |
| Proving and honoring your choices | Consent, preference and opt-out records | Legal obligation (6(1)(c) and Article 7(1)); legitimate interests (6(1)(f)) |
| Legal claims and legal duties | Records relevant to a claim or a duty | Legal obligation (6(1)(c)); legitimate interests (6(1)(f)); for health-related data, establishment, exercise or defense of legal claims (9(2)(f)) |
Where your data comes from. Besides what you give us, we receive your email address (and your name, if you share it) from Google if you sign in with Google, and payment status, card brand and last four digits, and billing country and ZIP code from Stripe.
Providing data. Your email address is required to create an account and to buy Pro. Without it we cannot provide those features. Everything else is optional, and the calculators and the tracker on your device work without an account.
How long we keep data. See the table in section 3. Where the law sets the period, such as for tax and accounting records, we keep the data for as long as the law requires and delete it afterward.
Your rights. Under the GDPR you have the right to:
- get confirmation of whether we process your data, access it and receive a copy (Article 15);
- have inaccurate data corrected (Article 16);
- have your data erased (Article 17);
- restrict how we use it (Article 18);
- receive the data you gave us in a structured, commonly used, machine-readable format and have it sent to another controller where technically feasible (Article 20);
- object to processing based on legitimate interests, and at any time to direct marketing (Article 21);
- withdraw consent at any time (Article 7(3)).
We do not make decisions about you based solely on automated processing, including profiling (Article 22). To use a right, go to Settings, Privacy or email [email protected]. We answer free of charge, without undue delay and within one month of receiving your request. If a request is complex or we receive many, we may extend this once by up to 45 days and tell you why within the first month. We may ask you to confirm your identity. If we do not act on a request, we tell you why and about your right to complain. If a request is manifestly unfounded or excessive, we may charge a reasonable fee or decline, and we will explain why.
International transfers. We are established in the EU, and our providers listed in section 8 mainly process data in the United States. The European Commission has decided that the United States ensures an adequate level of protection for personal data transferred to organizations certified under the EU-U.S. Data Privacy Framework (Implementing Decision (EU) 2023/1795). Where a provider is certified, we rely on that decision. Our contracts with providers also include the Standard Contractual Clauses adopted by the Commission (Implementing Decision (EU) 2021/914), which apply as a fallback if a certification lapses or the decision stops applying. Stripe Payments Europe, Limited is in Ireland, and PostHog stores analytics data in Germany. You can ask for a copy of the safeguards at [email protected]. Tracker entries that stay in your browser are not transferred.
Complaints. You have the right to lodge a complaint with a data protection supervisory authority and to go to court. Because we are established in Poland, the authority competent for us is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland, https://uodo.gov.pl/en . We would appreciate the chance to address your concern first at [email protected].
Personal data breaches. If a breach is likely to result in a risk to you, we notify UODO without undue delay and, where feasible, within 72 hours. If it is likely to result in a high risk to you, we also tell you without undue delay. We keep a record of every breach. The Consumer Health Data Privacy Policy describes our additional notice commitments for health information in the United States.
13. Age and location
The service is for adults 18 and older in the United States. We do not knowingly collect data from anyone under 18, and we delete it if we learn we have. Email [email protected] if you believe a minor has used the service.
14. Changes
We will post changes here with a new "Last updated" date. We will tell signed-in users by email about material changes, and we will ask for consent again where the law requires.
15. Contact
Uladzislau Yasinski, Peptide Dose Tracker, ul. Michała Kleofasa Ogińskiego 11 lok. 9, 03-318 Warsaw, Poland. Privacy: [email protected]. Support: [email protected].