Privacy Policy

Pep God ("we", "us") operates an AI-powered educational and research information platform about peptide science. We are not a healthcare provider and do not collect medical records. This policy explains what personal data we process, why, and the rights you have over it.

• Account data — name, email address, hashed password (bcrypt — we can never read your password), optional avatar, account creation date.
• Content you create — chat questions and AI responses, saved protocol vault entries, calculator inputs processed transiently, starred research papers.
• Subscription data — your plan tier, question usage counts, and billing status. Card numbers are handled exclusively by Stripe and never touch our servers.
• Security data — login timestamps, an anonymized (hashed, non-reversible) IP fingerprint, and browser/device type for your security dashboard.
• Usage analytics — anonymous page views and feature usage to improve the product. You can opt out in Privacy Controls.

• To operate your account, chats, tools, and subscription.
• To send transactional emails (receipts, password resets) and — only with your consent — product updates and research digests.
• To secure the platform (rate limiting, fraud prevention, login auditing).
• To improve features using aggregated, de-identified usage patterns.

We never sell your personal data to anyone.

When you use the chat or AI tools, your questions are sent to large-language-model providers (e.g., OpenAI-compatible services) to generate a response. These requests are made server-side, are not used to build advertising profiles, and are subject to the providers' enterprise data terms. Do not include sensitive personal or health information in your prompts.

All payments are processed by Stripe. We receive only your subscription status, plan, and a Stripe customer reference — never your full card details. Stripe's handling of your payment data is governed by the Stripe Privacy Policy.

We use minimal browser storage: a login token, your UI preferences (sidebar, accessibility settings), and an anonymous visitor identifier for analytics. Optional analytics (e.g., Google Analytics) may set cookies; you can opt out of analytics tracking in Privacy Controls, and your browser's Do-Not-Track / cookie settings are respected for third-party scripts.

• Chat history — auto-deleted after 30 days by default. You control this window (30/90/365 days, or never) and can delete any or all chats instantly.
• Account data — kept while your account is active.
• After deletion — everything is permanently erased immediately, except a minimal legally-required record (email, Stripe customer reference, deletion date) retained for payment-dispute and fraud-prevention obligations.

Regardless of where you live (GDPR, CCPA, or otherwise), we give every user the same rights, self-serve and instantly:

• Access — see everything we store in My Data.
• Portability — download a complete JSON export.
• Erasure — delete individual chats, all chats, or your entire account.
• Consent control — toggle marketing, research updates, and analytics at any time.

Passwords are hashed with bcrypt, transport is encrypted with TLS, optional two-factor authentication (TOTP) is available to all users, admin functions require 2FA, login attempts are rate-limited, and security-relevant events are logged to your personal Security Dashboard.

Pep God is intended for adults (18+). We do not knowingly collect data from minors. If you believe a minor has created an account, contact us and we will delete it.

We may update this policy as the platform evolves. Material changes will be announced in-app. Continued use after changes constitutes acceptance.

Privacy questions or requests: support@pepgod.ai