Legal

Privacy Policy

Effective date: August 18, 2026

Unified Sense, Dal Rupnik s.p. ("us", "we", or "our") operates the Polypep app and the getpolypep.com website (together, the "Service").

This page informs you of our policies regarding the collection, use, and disclosure of personal data when you use the Service, and the choices you have associated with that data. We use your data to provide and improve the Service. By using the Service, you agree to the collection and use of information in accordance with this policy.

Polypep works without an account

Polypep is local-first. Everything you log — doses, vials and stock, biomarkers, custom protocols and peptides, and your profile — is written to a database on your own device. You can install the app, log doses, and use the peptide catalogue without ever creating an account, and in that state the app holds no personal data on our servers.

Two optional features change that, and only if you choose them: creating an account, and turning on the AI features described below.

Accounts and private sync

If you create an account, we hold the email address you sign up with, the display name and handle you choose, and an avatar image if you upload one.

While you are signed in, your personal records sync privately between your own devices so an iPhone and an iPad show the same data. This covers doses, stock, biomarkers, custom protocols and peptides, and profile settings. Those records are stored in collections that are readable and writable only by the account that owns them. They are not published, not shared with other users, and not used to build a profile of you.

Signing out stops the sync. Deleting your account removes the account and its synced records from our servers; the copy on your device is yours to keep or delete.

Anonymous installs

So that a protocol can show how many people are following it even when the reader is signed out, the app creates an anonymous, per-install session with our backend. It carries no email, no name, and no contact details, and it exists only to keep one install from being counted twice. If you later sign in, that anonymous session is migrated onto your account.

Community features

If you publish a protocol, only the recipe is published — the compounds, doses, timing, and duration — together with the profile name and handle you chose. Your own dose log, stock, and biomarkers are never published. Follower counts, active and completed counts, and reviews you write are visible to other users by design. You can unpublish a protocol at any time.

Health data

With your permission, Polypep reads a small set of measurements from Apple Health — such as sleep, resting heart rate, heart-rate variability, and weight — and can write a few values back. You grant and revoke this in iOS Settings, per data type, and the app works without it.

• Health data is never sold, shared with data brokers, or used for advertising. We do not run advertising in Polypep at all.
• It stays on your device unless you sign in. If you have an account and private sync is active, biomarker values sync to your own owner-only collection so your other devices can show them, exactly like the rest of your records.
• It is not used to make decisions about you. Polypep charts what you record; it does not diagnose or advise.

AI features

Polypep includes two optional features that send data to a third-party model. Both are off unless the build you are running enables them and you choose to use them.

• Vial label scanning. If you photograph a vial label to fill in a stock entry, that image is sent for analysis and the extracted text is returned to the app.
• Coach. If you ask the assistant a question, your message and the conversation so far are sent for a reply. Coach's tools run locally on your device, but the information a tool returns — for example a summary of your recent doses — is placed into the next prompt in order to answer you, and therefore leaves the device too. Every tool is governed by permissions you control: reads can be switched off, and writes are set to never, ask, or automatic, defaulting to ask. A tool you have disabled is never offered to the model at all.

These requests go to Google's Gemini models through a Cloudflare AI Gateway that we operate. They are used to produce your result, not to train models on your data. If you would rather send nothing, leave the AI features off and use the rest of the app normally.

Purchases

Subscriptions are sold through the Apple App Store and, where offered, Google Play, and are managed on our side by RevenueCat. We receive the fact that a subscription is active and which tier it is. We never see your card number, billing address, or any other payment details — those stay with the store.

No advertising, no analytics, no crash reporting

Polypep contains no advertising SDK, no analytics SDK, and no crash-reporting SDK. We do not track you across apps or websites, we do not build advertising profiles, and we do not sell or share your data with data brokers. The getpolypep.com website is a static page that sets no cookies and runs no tracking scripts.

Types of data collected

Personal data

If you create an account we may hold:

• Email address
• Display name and handle
• Avatar image, if you upload one
• The personal records described above, synced to your own account

We do not ask for your phone number, postal address, or date of birth.

Usage data

When the app contacts our backend, the server records ordinary request information — IP address, timestamp, and the endpoint called — in its logs, as any server does. These logs are used to operate and secure the Service and are not combined into a behavioural profile.

Use of data

We use the collected data to:

• Provide and maintain the Service
• Sync your own records between your own devices
• Operate community features you choose to take part in
• Provide customer care and support
• Detect, prevent, and address technical issues and abuse

Legal basis for processing

Under the EU General Data Protection Regulation (GDPR), we process your personal data on the following legal bases:

• Performance of a contract — where processing is necessary to provide the Service you have requested, such as syncing your records or answering a support request.
• Legitimate interests — where processing is necessary for our legitimate interests in operating, securing, and improving the Service, provided these interests are not overridden by your rights.
• Consent — where you have given consent for a specific purpose, such as granting Health access or using the AI features. You may withdraw consent at any time.
• Compliance with a legal obligation — where we are required to process data to comply with applicable law.

Data retention

We retain your personal data only for as long as is necessary for the purposes set out in this Privacy Policy, to comply with our legal obligations, resolve disputes, and enforce our agreements. Synced records are retained while your account exists and are deleted when you delete your account. Server logs are retained for a short period for security and diagnostics.

Transfer of data

Our backend runs on servers in Frankfurt, Germany, inside the European Economic Area. Your information, including personal data, may be transferred to and maintained on computers located outside your state, province, or country, where data protection laws may differ from those in your jurisdiction.

Where personal data is transferred outside the European Economic Area — for example to Cloudflare and Google in connection with the AI features, or to RevenueCat and Apple in connection with purchases — we rely on appropriate safeguards such as the Standard Contractual Clauses approved by the European Commission, or applicable adequacy decisions, to ensure an equivalent level of protection.

We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy.

Disclosure of data

Legal requirements

We may disclose your personal data in the good-faith belief that such action is necessary to:

• Comply with a legal obligation
• Protect and defend our rights or property
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the personal safety of users of the Service or the public
• Protect against legal liability

Security of data

Traffic between the app and our backend is encrypted in transit. Synced records are stored with permissions that grant access only to the account that owns them. No method of transmission over the Internet, or method of electronic storage, is 100% secure, so while we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security.

Your rights under the GDPR

If you are located in the European Economic Area, you have the following rights in relation to your personal data:

• Right of access — to request a copy of the personal data we hold about you.
• Right to rectification — to request that inaccurate or incomplete data be corrected.
• Right to erasure ("right to be forgotten") — to request deletion of your personal data. The app can delete your account directly.
• Right to restriction of processing — to request that we limit how we use your data.
• Right to data portability — to receive your data in a structured, commonly used, machine-readable format.
• Right to object — to object to processing based on our legitimate interests.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time.
• Right to lodge a complaint with a supervisory authority. In Slovenia, this is the Informacijski pooblaščenec (www.ip-rs.si).

To exercise any of these rights, contact us.

Service providers

We employ third-party companies to facilitate the Service, to provide it on our behalf, or to perform Service-related services. These third parties have access to your personal data only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose.

• DigitalOcean — hosts our backend servers in Frankfurt, Germany.
• Cloudflare — serves getpolypep.com and operates the AI gateway that the optional AI features call through.
• Google — provides the Gemini models behind the optional AI features.
• RevenueCat — manages subscription entitlements.
• Apple and, where offered, Google Play — sell the subscription and handle payment.

Links to other sites

Polypep links out to published research, regulatory records, and manufacturer information, and the Service may contain links to other sites we do not operate. If you click a third-party link you will be directed to that third party's site. We strongly advise you to review the privacy policy of every site you visit. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party sites or services.

Children's privacy

The Service does not address anyone under the age of 16 ("Children"). We do not knowingly collect personally identifiable information from anyone under the age of 16. If you are a parent or guardian and you are aware that your child has provided us with personal data, please contact us. If we become aware that we have collected personal data from children without verification of parental consent, we take steps to remove that information from our servers.

Changes to this Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the effective date above. You are advised to review this Privacy Policy periodically. Changes are effective when they are posted on this page.

Terms of Service

Acceptance

By downloading, installing, or using Polypep or the getpolypep.com website, you agree to these Terms of Service. If you do not agree, please do not use them.

Licence to use the app

We grant you a personal, non-exclusive, non-transferable licence to use Polypep for its intended purpose. You agree not to copy, reverse engineer, resell, or otherwise misuse it, except where the law expressly allows it.

Acceptable use

You agree to use Polypep lawfully, and not to use it to harm others, infringe intellectual property, or disrupt our services. Protocols, reviews, and profile content you publish must not present themselves as medical advice, must not promote the sale or supply of controlled or prescription-only substances, and must not misrepresent another person.

Educational content only

Polypep provides educational information and a record of what you enter. It is not a medical device, it does not provide medical advice, diagnosis, or treatment, and it must not be used as a substitute for consultation with a licensed clinician. Many compounds described in the app are research compounds or prescription-only drugs, and their legal status varies by country. Protocols published by other users are user-generated content, not our recommendations, and we do not verify them. You are responsible for what you choose to do, and for complying with the law where you live.

Purchases and payments

Polypep subscriptions are sold through the Apple App Store and, where offered, Google Play. The store you buy through is the merchant of record for that transaction: it sells the licence to you, handles payment and taxes, and its buyer terms apply in addition to these Terms. Prices are shown before you complete a purchase and may include applicable taxes.

Subscriptions

Subscriptions renew automatically until you cancel. You can cancel at any time through the store you bought from. Cancelling stops future renewals and takes effect at the end of the current billing period. Where a free trial is offered, it converts to a paid subscription at the end of the trial unless you cancel before then.

Disclaimer

Polypep is provided on an "as is" and "as available" basis, without warranties of any kind, to the fullest extent permitted by law. We work hard to keep everything running, but we cannot guarantee that it will always be available or completely free of errors, nor that reference content is complete or current.

Limitation of liability

To the fullest extent permitted by law, Unified Sense will not be liable for any indirect or consequential loss arising from your use of Polypep. Nothing in these Terms limits the rights you have as a consumer that cannot be excluded under applicable law, or our liability for death or personal injury caused by our negligence.

Governing law

These Terms are governed by the laws of Slovenia, without affecting any mandatory consumer protections of the country in which you live.

Changes to these terms

We may update these Terms from time to time. The date at the top of this page shows when they were last changed.

Refunds

Where you bought a subscription decides who handles a refund and which policy applies. Your statutory consumer rights always apply in addition to the policies below.

App Store purchases

Purchases made through the Apple App Store are handled by Apple under the Apple Media Services Terms and Conditions. Refund requests are made to Apple, usually at reportaproblem.apple.com.

Google Play purchases

Purchases made through Google Play are handled by Google under the Google Play Terms of Service, and follow the Google Play refund policy.

Partner privacy policies

The privacy policies of the platform partners mentioned above:

• Apple Privacy Policy
• Google Privacy Policy
• Cloudflare Privacy Policy
• RevenueCat Privacy Policy
• DigitalOcean Privacy Policy

Contact

Questions about this Privacy Policy, our Terms of Service, or the data we hold about you? Get in touch and we will help.

Email [email protected]
Unified Sense, Dal Rupnik s.p., Slovenia