Legal

Privacy Policy

Effective date: October 1, 2026

Unified Sense, Dal Rupnik s.p. ("us", "we", or "our") operates the Polypep app and the getpolypep.com website (together, the "Service").

This page informs you of our policies regarding the collection, use, and disclosure of personal data when you use the Service, and the choices you have associated with that data. We use your data to provide and improve the Service. By using the Service, you agree to the collection and use of information in accordance with this policy.

Polypep works without an account

Polypep is local-first. Everything you log — doses, vials and stock, biomarkers, custom protocols and peptides, and your profile — is written to a database on your own device. You can install the app, log doses, and use the peptide catalogue without ever creating an account, and in that state the app holds no personal data on our servers.

Some things do leave the device. Creating an account turns on private sync; publishing a protocol shares that recipe; using the AI features sends the request that answers you; starting a support chat sends what you write; buying a subscription is handled by the store; the app reports anonymous diagnostics; only if you allow it, the app shares install and subscription events with Meta to measure our ads; and on iPhone and iPad, an install that came from one of our ads is counted through Apple's anonymous install count. Each is described below.

Accounts and private sync

If you create an account, we hold the email address you sign up with, the display name and handle you choose, and an avatar image if you upload one.

While you are signed in, your personal records sync privately between your own devices so an iPhone and an iPad show the same data. This covers doses, stock, biomarkers, custom protocols and peptides, and profile settings. Those records are stored in collections that are readable and writable only by the account that owns them. They are not published, not shared with other users, and not used to build a profile of you.

Signing out stops the sync and leaves everything on the device untouched. Terminating your account disables account activity immediately and schedules permanent deletion after 24 hours. It erases local data on the device you terminate from — doses, stock, biomarkers, custom protocols and peptides, side effects, journal entries and photos, Coach history, and your profile — and then deletes the account and its synced records from our servers. Signing in during the 24-hour grace period cancels deletion, and your synced records return; Coach history erased from the device does not, because it is never stored in the cloud. Once deletion begins, it cannot be undone. Export anything you want to keep first. The control is under You → Data → Terminate account.

Anonymous installs

So that a protocol can show how many people are following it even when the reader is signed out, the app creates an anonymous, per-install session with our backend. It carries no email, no name, and no contact details, and it exists only to keep one install from being counted twice. If you later sign in, that anonymous session is migrated onto your account.

Community features

If you publish a protocol, only the recipe is published — the compounds, doses, timing, and duration — together with the profile name and handle you chose. Your own dose log, stock, and biomarkers are never published. Follower counts, active and completed counts, and reviews you write are visible to other users by design. You can unpublish a protocol at any time.

Health data

With your permission, Polypep reads a small set of measurements from Apple Health — such as sleep, resting heart rate, heart-rate variability, and weight — and can write a few values back. You grant and revoke this in iOS Settings, per data type, and the app works without it.

• Health data is never sold, never shared with data brokers, and never used for advertising. Polypep shows no ads, and health data is never included in the anonymous diagnostics or the optional ad measurement described below.
• It stays on your device unless you sign in or ask the assistant about it. With an account and private sync active, biomarker values sync to your own owner-only collection so your other devices can show them, exactly like the rest of your records. Separately, if you ask the assistant a question about your biomarkers, the values needed to answer are sent to the AI provider as part of that request. You control this under You → Preferences → Coach: switch the biomarker tool off and it is never offered to the model at all.
• It is not used to make decisions about you. Polypep charts what you record; it does not diagnose or advise.

AI features

Polypep includes AI-assisted features that send data to a third-party model. Vial scanning and Coach are off unless the build you are running enables them and you choose to use them. Automatic translation processes only text another user has published or shared with you.

• Vial label scanning. If you photograph a vial label to fill in a stock entry, that image is sent for analysis and the extracted text is returned to the app.
• Coach. If you ask the assistant a question, your message and the conversation so far are sent for a reply. Coach's tools run locally on your device, but the information a tool returns — for example a summary of your recent doses — is placed into the next prompt in order to answer you, and therefore leaves the device too. Every tool is governed by permissions you control: reads can be switched off, and writes are set to never, ask, or automatic, defaulting to ask. A tool you have disabled is never offered to the model at all.
• Automatic translation. Protocol names, descriptions, and custom-peptide prose that another user publishes or shares with you may be sent for translation into your app language. Your own private protocols, peptides, dose log, stock, and biomarkers are not sent for translation.

These requests go to a third-party AI provider through a gateway we operate. They are used to produce your result, not to train models on your data. If you would rather send nothing, leave the AI features off and use the rest of the app normally.

Support chat

If you start a conversation from Help & Support, the messages you write are sent to a third-party support-messaging provider so we can read and reply to them. A support contact is created for your install the first time you send something; it carries no email address and no name unless you type one into a message. Nothing else from the app is attached — we do not see your dose log, stock, or biomarkers unless you describe them yourself. You can clear the link between your install and those conversations from the chat's history screen.

Purchases

Subscriptions are sold through the app store you bought from, and entitlements are managed on our side by a third-party subscription provider. We receive the fact that a subscription is active and which tier it is. We never see your card number, billing address, or any other payment details — those stay with the store.

If you allow ad measurement, the subscription provider also forwards trial and subscription events to Meta, as described next. For that the app gives it the install identifier Meta's software creates, never your advertising identifier. If you do not allow it, or turn it off later, that identifier is removed and it forwards nothing.

Ad measurement (optional)

We advertise Polypep on Meta's platforms, such as Facebook and Instagram. To learn which of those ads bring people to Polypep, the app can share a small set of events with Meta. This is off unless you choose it. The first time you open Polypep, iPhone and iPad show Apple's tracking prompt. Allowing it turns ad measurement on; choosing Ask App Not to Track leaves it off. Android shows a short prompt with two choices, Allow and Not now. Declining changes nothing else: every feature, trial, and purchase works the same.

If you allow it, the following is shared with Meta:

• Install and app-open events — that Polypep was installed and opened, with the app version, your IP address, and basic device details such as model, operating system, and language.
• Identifiers — an install identifier that Meta's software creates for Polypep on your device, and your device advertising identifier. Meta's software sends both with the install and app-open events, and on iPhone and iPad it only runs when you also allow tracking in Apple's prompt. Our subscription provider never receives your advertising identifier.
• Subscription events — when a trial or subscription starts or renews, our subscription provider forwards the event to Meta with its price and currency, a pseudonymous account identifier (a hashed form of the identifier the subscription provider uses for you, which is your Polypep account id once you sign in), and the install identifier above.
• Ad information — Meta connects these events to the ad you saw or tapped, and may derive your approximate location from your IP address.

Never shared with Meta: your doses, peptides, protocols, stock, notes, journal entries, side effects, biomarkers, Apple Health data, email address, or name. The part of the app that talks to Meta can only report installs and app opens; there is no path for your records to reach it.

Who receives it. Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. We and Meta Platforms Ireland Limited are joint controllers for collecting this data in the app and transmitting it to Meta. What Meta does with it afterwards, including how long it keeps it and any transfer outside the European Economic Area, is Meta's responsibility as an independent controller and is described in Meta's Privacy Policy.

Purpose and legal basis. Measuring which of our ads bring people to Polypep, based on your consent (Article 6(1)(a) GDPR, and Article 9(2)(a) GDPR to the extent that using a peptide-tracking app could itself reveal something about your health).

Changing your mind. Turn ad measurement off at any time under You → Preferences (on iPad, Settings → Preferences). Sharing stops from that moment: Meta's software is halted and, from the next launch, not started at all, and the install identifier is removed from your subscription account, so later renewals are no longer forwarded. If this device was also signed in to another Polypep account while you allowed it, that account's copy is removed the next time it signs in here. On iPhone and iPad you can also withdraw tracking permission in iOS Settings → Privacy & Security → Tracking. Withdrawing does not recall what was already shared; to have Meta delete it, use Meta's own privacy controls, or contact us and we will pass your request on. Polypep on a Mac never shares anything with Meta.

Apple's anonymous install count (iPhone and iPad)

Separately from the choice above, and whether or not you allow tracking, Polypep on iPhone and iPad uses Apple's SKAdNetwork. If you installed Polypep after seeing one of our ads, your iPhone or iPad later sends the ad network that showed it, such as Meta, a report signed by Apple, after a delay of a day or more. The report says only that an install came from one of that network's ads: it contains no advertising identifier, no account or device identifier, and nothing from the app. Like any connection, it reaches the ad network from your device's internet connection. We only ever see totals in the ad network's reports, never anything about you. Polypep on Android or on a Mac does not use it.

Legal basis. Our legitimate interest in knowing which of our ads lead to installs (Article 6(1)(f) GDPR), using Apple's method, which is designed so that no one can tell who installed.

Anonymous diagnostics

Polypep reports crashes and a small set of product-usage events so we can fix what breaks and see which features are used. Both are anonymous, and deliberately so.

• No identity, ever. We do not create a person profile, and we never attach your email, name, account id, or device advertising identifier to diagnostics. Nothing we receive can be traced back to you by us or by the providers.
• No health or protocol content. Peptide names, doses, notes, biomarker values, and even the addresses of the screens you visit are stripped before anything is sent, because those addresses can carry a peptide id. Events carry only a short list of categorical fields — which screen, which action, success or failure, a count.
• No session recording, no screenshots, no keystrokes, no automatic capture of what you tap, and no network request logging.
• Diagnostics are never used for advertising, cross-app or cross-site tracking, or advertising profiles, and your data is never sold or shared with data brokers. Ad measurement and Apple's anonymous install count, described above, are separate; ad measurement is off unless you choose it. Your approximate location is not derived from your IP address, which is discarded rather than stored against the event.

Crash reports contain the error and the code path that produced it, plus the app version and device model — the ordinary contents of a stack trace. Both providers process this on our behalf, in the roles described under Service providers below.

The getpolypep.com website runs no analytics and no tracking scripts. Our content delivery network sets one strictly-necessary cookie for bot protection; it is not used to track or profile you.

Types of data collected

Personal data

If you create an account we may hold:

• Email address
• Display name and handle
• Avatar image, if you upload one
• The personal records described above, synced to your own account

We do not ask for your phone number, postal address, or date of birth.

Usage and diagnostic data

When the app contacts our backend, the server records ordinary request information — IP address, timestamp, and the endpoint called — in its logs, as any server does. These logs are used to operate and secure the Service and are not combined into a behavioural profile.

Separately, the app reports the anonymous crash reports and product-usage events described above. These carry no identifier of any kind and are not linked to your account, to the server logs, or to each other across sessions.

Use of data

We use the collected data to:

• Provide and maintain the Service
• Sync your own records between your own devices
• Operate community features you choose to take part in
• Provide customer care and support
• Detect, prevent, and address technical issues and abuse
• Measure which of our ads bring people to Polypep: in detail only if you allow it, and on iPhone and iPad through Apple's anonymous install count

Legal basis for processing

Under the EU General Data Protection Regulation (GDPR), we process your personal data on the following legal bases:

• Performance of a contract — where processing is necessary to provide the Service you have requested, such as syncing your records or answering a support request.
• Legitimate interests — where processing is necessary for our legitimate interests in operating, securing, and improving the Service, and in counting which of our ads lead to installs through Apple's anonymous install count, provided these interests are not overridden by your rights.
• Consent — where you have given consent for a specific purpose, such as granting Health access, using the AI features, or allowing ad measurement. You may withdraw consent at any time.
• Compliance with a legal obligation — where we are required to process data to comply with applicable law.

Data retention

We retain your personal data only for as long as is necessary for the purposes set out in this Privacy Policy, to comply with our legal obligations, resolve disputes, and enforce our agreements. Synced records are retained while your account exists and are deleted when you delete your account. Server logs are retained for a short period for security and diagnostics.

Transfer of data

Our backend runs on servers in Frankfurt, Germany, inside the European Economic Area. Your information, including personal data, may be transferred to and maintained on computers located outside your state, province, or country, where data protection laws may differ from those in your jurisdiction.

Some of our service providers are established outside the European Economic Area. This applies to the optional AI features, to purchases and subscription management, to support messaging, and to the anonymous crash-reporting and analytics providers. Where personal data is transferred outside the EEA we rely on appropriate safeguards such as the Standard Contractual Clauses approved by the European Commission, or applicable adequacy decisions, to ensure an equivalent level of protection. Our own backend, and the personal records synced to it, stay in Frankfurt, Germany.

We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy.

Disclosure of data

Legal requirements

We may disclose your personal data in the good-faith belief that such action is necessary to:

• Comply with a legal obligation
• Protect and defend our rights or property
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the personal safety of users of the Service or the public
• Protect against legal liability

Security of data

Traffic between the app and our backend is encrypted in transit. Synced records are stored with permissions that grant access only to the account that owns them. No method of transmission over the Internet, or method of electronic storage, is 100% secure, so while we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security.

Your rights under the GDPR

If you are located in the European Economic Area, you have the following rights in relation to your personal data:

• Right of access — to request a copy of the personal data we hold about you.
• Right to rectification — to request that inaccurate or incomplete data be corrected.
• Right to erasure ("right to be forgotten") — to request deletion of your personal data. The app can delete your account directly.
• Right to restriction of processing — to request that we limit how we use your data.
• Right to data portability — to receive your data in a structured, commonly used, machine-readable format.
• Right to object — to object to processing based on our legitimate interests.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time.
• Right to lodge a complaint with a supervisory authority. In Slovenia, this is the Informacijski pooblaščenec (www.ip-rs.si).

To exercise any of these rights, contact us.

Service providers

We employ third-party companies to facilitate the Service, to provide it on our behalf, or to perform Service-related services. These third parties have access to your personal data only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose. We describe them by the role they perform:

• Backend hosting — runs our servers, in Frankfurt, Germany.
• Content delivery — serves getpolypep.com and operates the gateway the optional AI features call through.
• AI model provider — produces the answers behind the optional AI features.
• Subscription management — records which entitlement your purchase grants and, only if you allow ad measurement, forwards trial and subscription events to Meta.
• App stores — sell the subscription and handle payment.
• Crash reporting — receives anonymous crash reports.
• Product analytics — receives anonymous product-usage events.
• Support messaging — carries the conversations you start from Help & Support.

Meta is not one of these service providers. If you allow ad measurement, Meta Platforms Ireland Limited receives the events described under Ad measurement as a joint controller with us for their collection and transmission, and as an independent controller for its own processing afterwards.

If you need to know which company performs a given role — for example to exercise a right against it — ask us and we will tell you.

Links to other sites

Polypep links out to published research, regulatory records, and manufacturer information, and the Service may contain links to other sites we do not operate. If you click a third-party link you will be directed to that third party's site. We strongly advise you to review the privacy policy of every site you visit. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party sites or services.

Children's privacy

The Service does not address anyone under the age of 16 ("Children"). We do not knowingly collect personally identifiable information from anyone under the age of 16. If you are a parent or guardian and you are aware that your child has provided us with personal data, please contact us. If we become aware that we have collected personal data from children without verification of parental consent, we take steps to remove that information from our servers.

Changes to this Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the effective date above. You are advised to review this Privacy Policy periodically. Changes are effective when they are posted on this page.

Terms of Service

Acceptance

By downloading, installing, or using Polypep or the getpolypep.com website, you agree to these Terms of Service. If you do not agree, please do not use them.

Licence to use the app

We grant you a personal, non-exclusive, non-transferable licence to use Polypep for its intended purpose. You agree not to copy, reverse engineer, resell, or otherwise misuse it, except where the law expressly allows it.

Acceptable use

You agree to use Polypep lawfully, and not to use it to harm others, infringe intellectual property, or disrupt our services. Protocols, reviews, and profile content you publish must not present themselves as medical advice, must not promote the sale or supply of controlled or prescription-only substances, and must not misrepresent another person. We have no tolerance for objectionable content or abusive users. Report content from the menu on any protocol or profile, or email [email protected], and we remove violating content and the accounts that post it.

Educational content only

Polypep provides educational information and a record of what you enter. It is not a medical device, it does not provide medical advice, diagnosis, or treatment, and it must not be used as a substitute for consultation with a licensed clinician. Many compounds described in the app are research compounds or prescription-only drugs, and their legal status varies by country. Protocols published by other users are user-generated content, not our recommendations, and we do not verify them. You are responsible for what you choose to do, and for complying with the law where you live.

Purchases and payments

Polypep subscriptions are sold through the Apple App Store and, where offered, Google Play. The store you buy through is the merchant of record for that transaction: it sells the licence to you, handles payment and taxes, and its buyer terms apply in addition to these Terms. Prices are shown before you complete a purchase and may include applicable taxes.

Subscriptions

Subscriptions renew automatically until you cancel. You can cancel at any time through the store you bought from. Cancelling stops future renewals and takes effect at the end of the current billing period. Where a free trial is offered, it converts to a paid subscription at the end of the trial unless you cancel before then.

Disclaimer

Polypep is provided on an "as is" and "as available" basis, without warranties of any kind, to the fullest extent permitted by law. We work hard to keep everything running, but we cannot guarantee that it will always be available or completely free of errors, nor that reference content is complete or current.

Limitation of liability

To the fullest extent permitted by law, Unified Sense will not be liable for any indirect or consequential loss arising from your use of Polypep. Nothing in these Terms limits the rights you have as a consumer that cannot be excluded under applicable law, or our liability for death or personal injury caused by our negligence.

Governing law

These Terms are governed by the laws of Slovenia, without affecting any mandatory consumer protections of the country in which you live.

Changes to these terms

We may update these Terms from time to time. The date at the top of this page shows when they were last changed.

Refunds

Where you bought a subscription decides who handles a refund and which policy applies. Your statutory consumer rights always apply in addition to the policies below.

App Store purchases

Purchases made through the Apple App Store are handled by Apple under the Apple Media Services Terms and Conditions. Refund requests are made to Apple, usually at reportaproblem.apple.com.

Google Play purchases

Purchases made through Google Play are handled by Google under the Google Play Terms of Service, and follow the Google Play refund policy.

Contact

Questions about this Privacy Policy, our Terms of Service, or the data we hold about you? Get in touch and we will help.

Email [email protected]
Unified Sense, Dal Rupnik s.p., Slovenia