Who this notice covers
This notice describes how the Peptide Plug website and web app at peptide-plug-app.com handle information. Peptide Plug is operated by Nick Dillon. Mailing address: Peptide Plug, 156 W. Michigan Ave, Unit #345, Jackson, MI 49201. Contact and privacy email: peptideplugapp@gmail.com.
Peptide Plug is an organizational and tracking tool. It does not diagnose, treat or prescribe, and it does not sell, dispense or source any compound.
What is collected and why
| Information | When | Where it goes |
|---|---|---|
| Account details: email address, password (handled by the sign-in service, never visible to Peptide Plug), first name and optional last name | When you create or update an account | Supabase Auth |
| Tracker data you enter: schedules, doses and dose outcomes, inventory and vial costs, calculator values, notes, side-effect tags, check-ins, measurements, optional lab profile (birth date, sex at birth, hormone context) and settings | When you use the app while signed in | Supabase database, saved as one record per account (peptide_tracker_state), plus a copy cached in your browser |
| Lab results you enter | When you add them | Supabase database (lab_results) |
| Progress photos you upload | Only if you upload one | A private Supabase Storage bucket (progress-photos). Photos are shown through signed links that expire after one hour. |
| Email sign-ups on free tool pages: your email address and which page you signed up on | Only if you submit the form | Supabase database (lead_signups). The unsubscribe page marks an address as unsubscribed. Follow-up emails to these sign-ups are sent from peptideplugapp@gmail.com through Gmail, and each one includes an unsubscribe link. Account emails, such as sign-up confirmation and password reset, are sent by Supabase Auth. |
| First-party usage events: event name (page view, login, sign-up, checkout start), a random ID for the browser tab, your account ID if signed in, page path, referring website, and the plan chosen at checkout | On peptide-plug-app.com only | Supabase database (site_analytics_events) |
| HeyCatch analytics: Page views and page exits; clicks, form submissions and field changes, recorded as the page address and the button, link or field involved (its label or button text and its HTML name or ID), but not what you type into a field or which option you choose; repeated rapid clicks; and browser details. Because button text is recorded, clicking an in-app button that shows one of your entries, such as an injection site or a side-effect tag, can send that label. When you are signed in, also your account ID, email address, plan and sign-up date. Session recording is switched off in our code. | On peptide-plug-app.com only (not on preview or test sites) | HeyCatch. The script is loaded from esm.sh. HeyCatch also receives your IP address with each event and stores the events with PostHog in the US. In HeyCatch’s live settings for our site (checked October 23, 2026), heatmaps, web vitals, error capture, dead-click tracking, surveys and session recording are all off. HeyCatch’s own service providers, including PostHog for storage and OpenRouter for its AI analysis features, are listed at heycatch.ai/subprocessors. |
| Error reports and feedback: error type and message, the page, your browser's user-agent string and app version, and any feedback text you send | When signed in and an error occurs, or when you send feedback | Supabase database (app_error_logs) |
| Phone notifications: your browser's push subscription, time zone, user-agent string and the times of your scheduled reminders. Notification text is generic ("You have a scheduled dose reminder.") and does not name a compound. | Only if you turn on phone notifications | Supabase (push service function), delivered through your browser's push service (for example Google, Apple or Mozilla, depending on your browser) |
| Payments: card and billing details | If you upgrade to Pro | Stripe handles checkout and the billing portal. Peptide Plug receives your subscription status, not your card number. |
| Technical request data such as IP address and browser type | Whenever a page or file loads | Netlify (hosting and site performance monitoring), jsDelivr (sign-in library), esm.sh (analytics library) and Supabase, as part of serving each request |
Fonts are hosted on peptide-plug-app.com itself. Provider reports (PDF) are created in your browser and downloaded to your device; they are not uploaded. Social-media icons are plain links and load nothing from those sites.
Health information
The tracker can hold health-related details you choose to enter. Peptide Plug does not sell personal or health information and does not use it for targeted advertising. We honor access and deletion requests from users in any state.
What is stored in your browser
| Key | Purpose |
|---|---|
sb-…-auth-token | Keeps you signed in (Supabase sign-in session) |
peptideTrackerData_v1_<account ID> | Local copy of your tracker data for faster loading and limited offline recovery |
pp_age_verified | Remembers that you confirmed you are 18 or older |
pp_theme, pp_force_mobile_shell, peptide_plug_swipe_hint_seen, pp_mobile_profile_complete, peptide_plug_first_name, dismissed_announcement_… | Display preferences and small interface states |
peptide_plug_heycatch_pending_signup | Short-lived marker so a new sign-up is counted once after email confirmation |
| Session-only keys (tab ID for usage events, protocol-import hand-off, return page after sign-in) | Cleared when the tab closes |
| Service-worker cache | Stores the app's own files so it loads quickly and works offline. It does not store your account data. |
| HeyCatch analytics storage | The analytics script sets a cookie on peptide-plug-app.com whose name starts with ph_ and ends with _posthog. It holds a random visitor ID used by the PostHog code bundled in the HeyCatch SDK (observed in our own headless test with demo data). The same script also keeps this visitor ID and its analytics settings in your browser’s local storage and session storage under the same name. The cookie lasts up to 365 days. |
Your choices
- Any account can download a full JSON backup from Settings at any time, and Pro accounts can also export CSV files of their log, inventory and cost forecast. Any account can request a copy of its data by emailing peptideplugapp@gmail.com from the account email address.
- Reset tracker data from Settings. This keeps your login.
- Delete your account from Settings (Delete Account), or email peptideplugapp@gmail.com from your account email address. Deleting from Settings also cancels an active Stripe subscription.
- Unsubscribe from tool-page email sign-ups on the unsubscribe page.
- Phone notifications can be turned off in Settings or in your browser.
Retention: we keep account data while your account is open. When you delete your account in Settings, or ask us to by email, we delete the account and its synced tracker data, lab results, progress photos and notification settings within 30 days, except where the law requires us to keep something. Copies in our database provider’s backups roll off within 30 days after that. Some records are kept after an account is deleted: a record of the deletion request (account ID, email address, dates and status), so we can show the request was handled; payment records held by Stripe; error reports and feedback messages you sent; and our own usage events. Error reports, feedback and usage events do not yet have an automatic deletion schedule; error reports, feedback and usage events are unlinked from the account when it is deleted. Email sign-ups are kept until you ask us to delete them; unsubscribing stops the emails and marks the address as unsubscribed. HeyCatch keeps analytics events, including the account ID and email address sent while you were signed in, while our HeyCatch account is active, and deletes or anonymizes them within 2 months after our HeyCatch account ends. Deleting your Peptide Plug account does not remove those events automatically; email us and we will ask HeyCatch to delete them.
Privacy rights requests (access, correction, deletion and others under applicable law): email peptideplugapp@gmail.com from your account email address. We will reply within 48 hours and complete verified requests within 45 days. We honor access and deletion requests from users in any state.
Security
The site is served only over HTTPS. Synced data is stored with Supabase, where database access rules limit each signed-in account to its own records, and progress photos are kept in a private storage bucket. One Peptide Plug administrator can access account data through the app’s admin tools. Those tools show account details, subscription status, usage counts, email sign-ups, error reports and feedback, and can export, reset or delete an account’s data. Our hosting, database, analytics and payment providers’ dashboards, and the developer and automated tools we use to maintain the service, can also technically access stored data; we limit that access to operating, securing and supporting the service. No online service can guarantee absolute security. Users will be notified of qualifying incidents as required by applicable law.
Age limit
Peptide Plug is intended for adults 18 and older. The site asks visitors to confirm they are 18 or older, and sign-up requires the same confirmation. We do not knowingly collect data from anyone under 18 and will delete any such account we identify.
Changes and governing law
Last updated: October 23, 2026. Governing law: the State of Michigan, with disputes resolved in the state or federal courts located in Michigan. Material changes will be announced by email to account holders and with a notice in the app, before they take effect.