1. Data controller
The controller is Rivage Labs, publisher of PeptideScanner (sole proprietorship (French entrepreneur individuel)). Full identity and address: Legal notice.
Personal data questions: contact [at] peptidescanner.app
2. Data we collect
| Category | Data | Required |
|---|---|---|
| Account | E-mail address if you add one (sign-in by one-time code, no password); otherwise an anonymous account identifier linked to your phone | Identifier: yes · e-mail: no |
| Profile | First name, age range, profile (optional), height, weight, goals (weight, hydration), indicative monthly budget, units, language, how you heard about us | No |
| Warning | Date and version of your acceptance of the warning (18+, terms, health data) | Yes |
| Protocols | Peptide or supplement, amount you enter, form, label content, brand, stock, dates, frequency, times, notes | No |
| Doses and notes | Date, time, slot, related protocol, site, feelings and notes you write | No |
| Weight | Date, value, note | No |
| Vials and pens | Quantities, reconstitution, storage, cost you enter | No |
| Reminders | Reminders and alerts you create | No |
| Subscription | Subscription status and purchase identifier sent by Apple or Google (no bank data) | Subscribers only |
| Technical | IP address and connection information kept in server logs | Yes (technical) |
The app contains no analytics tool, no advertising and no tracker. It does not use Apple’s advertising identifier and does not track you across other apps.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Create and run your logbook and account | Performance of the contract (Terms of Use) |
| Record and display your protocols, doses, weight, stock and notes | Your explicit consent (health data, see §4) |
| Manage the subscription | Performance of the contract |
| Send sign-in codes and account e-mails | Performance of the contract |
| Security and technical logs | Legitimate interest |
| Answer your support requests | Legitimate interest |
4. Health data
Information about your protocols, doses, notes and weight is health data under the GDPR. It is processed only with your explicit consent, given by ticking the box on the warning screen when you first open the app. You can withdraw this consent at any time by deleting your data or your account.
- It is never sold and never used for advertising or commercial purposes.
- It is never shared with an employer, an insurer or a health organization.
- Each user can only access their own data (access rules enforced by the database).
This data is not a medical record. PeptideScanner is not a medical device.
5. Recipients and processors
Your data is only accessible to the publisher and to the service providers strictly needed to run the app:
- Supabase: database and accounts;
- Resend: sending sign-in codes and account e-mails (receives only your e-mail address and the message);
- RevenueCat: subscription status (receives an account identifier and the purchase information sent by Apple or Google, never your health data);
- Apple and Google: app distribution and subscription payments, under their own policies;
- OVH: e-mail hosting for contact [at] peptidescanner.app (OVH SAS, 2 rue Kellermann, 59100 Roubaix, France); receives the e-mails you send us;
- authorities, only upon a legal request.
The website peptidescanner.app is hosted by Vercel; it uses no cookies and no analytics.
6. Hosting and transfers
The database is hosted by Supabase in the following region: West EU, Paris (France). Some providers (Supabase, Resend, RevenueCat, Apple, Google, Vercel) are established in the United States; any transfer is covered by the safeguards provided by the GDPR (European Commission standard contractual clauses or the EU–US Data Privacy Framework).
7. Retention
| Data | Period |
|---|---|
| Account and tracking data | As long as the account exists |
| After “Delete my account” | Immediate erasure from the database; technical backup copies disappear within 30 days at most |
| Technical logs | 90 days at most |
| Support e-mails | Up to 3 years after our last exchange |
Payment and invoicing records for subscriptions are kept by Apple or Google, not by us.
8. Your rights
You have the rights of access, rectification, erasure, portability, restriction and objection, and the right to withdraw your consent at any time. Several of them are available directly in the app:
- Export your data: Profile → Export my data (JSON or CSV file);
- Delete your tracking data: Profile → Delete all my data;
- Delete your account: Profile → Delete my account (see Account deletion).
For any other request: contact [at] peptidescanner.app (reply within 30 days). You may also lodge a complaint with the French data protection authority (CNIL, cnil.fr) or the authority of your country.
9. Data kept on your phone
The app stores a few settings on your phone (language, light or dark theme, reminder settings, a copy of your preferences) and your sign-in session. Progress photos and hydration tracking stay only on your phone: they are never sent to our servers. Deleting the app erases them.
Reminders are scheduled locally by your phone, with your permission; no external notification service is used. By default they show the product name; you can turn on discreet mode to hide it on the lock screen. Home-screen widgets read a summary saved on your phone only.
10. Security
Traffic between the app and the server is encrypted (HTTPS). Data is encrypted at rest by the host and protected by per-user access rules. No secret key is stored in the app. You can lock the app with Face ID.
If a data breach is likely to put your rights and freedoms at risk, we notify the CNIL within 72 hours of discovering it and inform you directly as soon as possible, in line with articles 33 and 34 of the GDPR.
11. Children
The app is reserved for people aged 18 or over. We do not knowingly collect data about minors; if you believe a minor has created a logbook, contact us and we will delete it.
12. Changes and contact
If this policy changes significantly, you will be informed in the app. Questions about your data: contact [at] peptidescanner.app, subject “[GDPR]” followed by your request.