Privacy Policy
Effective date: [EFFECTIVE DATE]
This Privacy Policy describes how The Formularie ("we," "us," or "our") collects, uses, stores, and protects information from users ("you") of The Vial — Peptide Calculator mobile application and the website at theformularie.com (collectively, the "Service").
By using the Service, you consent to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.
1. Who we are
The Service is operated by The Formularie, a New Mexico entity, with mailing address:
[MAILING ADDRESS]
Privacy questions and data-subject requests: [SUPPORT EMAIL]
2. Information we collect
2.1 Information you provide directly
- Account information: name, email address, password (stored as a salted hash by our authentication provider — we never see your plaintext password)
- Profile information: display name, optional saved shipping and billing addresses, optional saved phone number
- Payment information: card brand and last 4 digits (full card numbers are tokenized and stored only by Stripe; we never store full card numbers on our servers)
- Order information: items purchased, quantities, prices, shipping selection, promotional codes applied, order status
- Health-tracking data you choose to log: peptide protocol details (peptide name, dose, frequency, schedule), outcome logs (weight, mood, energy, sleep quality, symptoms), reminders you create, notes you attach to log entries
- AI-feature inputs: when you use Pro AI features (Personalized Insights, Smart Education, Half-Life Visualization, Goal-Based Protocols, Protocol Intelligence, Unit Intelligence), short text summaries of your protocol and outcome data are sent to our AI provider for processing
2.2 Information collected automatically
- Device information: device type, operating system version, app version, language preference
- Usage information: which screens you visit, which features you use, errors and crashes
- Authentication tokens: refresh tokens issued by our authentication provider, optionally stored in your device's secure keychain when you enable biometric sign-in
- Push notification token: an anonymous identifier provided by Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM) when you enable reminder notifications
2.3 Biometric data
When you enable biometric sign-in (Face ID, Touch ID, or fingerprint), we do not see or store your biometric data. Biometric matching happens entirely on your device. We store only an encrypted token in your device's secure keychain, which is unlocked by a successful biometric match. The token can be cleared at any time via the in-app Privacy Vault.
2.4 Information we do NOT collect
- We do not collect precise location data
- We do not access your contacts, photos, microphone, or camera
- We do not run any third-party advertising or analytics SDKs that track you across other apps or websites
- We do not sell or rent your personal information
3. How we use your information
We use information for the following purposes:
- Provide the Service: authenticate you, store your protocols and logs, calculate doses and reconstitution volumes, render charts, send reminders you scheduled
- Process orders: receive payment via Stripe, ship peptide products to your address, communicate order status
- Generate AI features (Pro): send short text summaries of your data to our AI provider to produce educational explanations, schedule analyses, and personalized insights
- Communicate with you: order receipts, password-reset emails, support replies
- Improve the Service: aggregate, anonymized analysis of feature usage and crash reports
- Comply with legal obligations: respond to lawful requests from law enforcement, prevent fraud, enforce our Terms of Service
We do not use your information for cross-app tracking, behavioral advertising, or sale to data brokers.
4. Third parties we share information with
We share specific subsets of your data with the following service providers, each bound by confidentiality and data-protection obligations.
| Provider | Data shared | Purpose |
|---|---|---|
| Supabase | Account, profile, orders, protocols, outcome logs, encrypted vault payloads | Primary backend database, authentication, file storage |
| Stripe | Payment information, billing address, order amount | Payment processing |
| Anthropic (Claude) | Short text summaries of protocols / outcomes when you use AI features | AI-generated educational text and insights |
| Google (if Google sign-in) | Email address, name, profile picture | OAuth sign-in |
| Apple (if Face ID / Apple Sign-in) | Biometric matching is on-device only; we receive only your verified identifier | Authentication |
| APNs / FCM | Anonymous push token, notification payload | Deliver reminders you scheduled |
We do not share your peptide protocols, outcome logs, symptoms, weight, mood, or sleep data with any party other than the service providers listed above, and only as necessary to provide the Service.
We may disclose information to comply with legal process, prevent fraud or harm, or in connection with a corporate transaction (merger, acquisition, asset sale), in which case we will notify you and give you the opportunity to delete your data before transfer.
5. AI features and your data
When you use a Pro AI feature, we send the AI provider a short text digest of the relevant data — for example, "Last 14 days: weight down 1.2 lbs, sleep 7.1h average, peptide A at 0.5 mg twice daily." We do not send raw logs, full medical history, or any field we don't need for the specific request.
The AI provider processes the request to produce text output and does not retain your data for model training. You can disable individual AI features in the in-app settings; if all AI features are disabled, no data is sent to the AI provider.
6. Data retention
- Account data: retained while your account is active. Upon deletion request, removed within 30 days from active systems and within 90 days from backups.
- Order records: retained for 7 years for tax and accounting purposes, even after account deletion. Personally identifying fields (name, email, address) may be redacted earlier upon request, leaving only anonymized order metadata.
- Payment records: retained by Stripe under their retention policies (typically 7 years). We retain only the last-4 / brand display values.
- Outcome logs and protocols: deleted with your account.
- Encrypted vault payloads: deleted with your account.
- Crash reports and aggregate analytics: retained in anonymized form indefinitely.
7. Your rights
Depending on your location, you may have the following rights regarding your personal data:
- Access: request a copy of the personal data we hold about you
- Correction: ask us to correct inaccurate data
- Deletion: ask us to delete your account and personal data (subject to retention obligations in section 6)
- Portability: ask us to provide your data in a machine-readable format
- Objection / restriction: object to or restrict certain processing
- Withdraw consent: where we rely on consent (such as AI features and push notifications), you can withdraw it any time in app settings
To exercise these rights, email [SUPPORT EMAIL] from the email address associated with your account. We will respond within 30 days.
If you are in the European Economic Area, United Kingdom, or Switzerland, you also have the right to lodge a complaint with your national data-protection authority. If you are in California, you have additional rights under the California Consumer Privacy Act (CCPA) including the right to opt out of "sales" of personal information — we do not sell personal information.
8. Security
We use industry-standard measures to protect your data:
- In transit: all communications between the app, our backend, and third-party processors use HTTPS / TLS 1.2+
- At rest: account passwords are stored as salted hashes by our authentication provider. Sensitive on-device data (saved biometric tokens, in-flight protocols, applied promo codes) is encrypted with AES-GCM using a device-specific key stored in iOS Keychain / Android Keystore
- Database: row-level security ensures each authenticated user can only access their own data; admin access is gated by allowlist + multi-factor authentication
- Payment data: tokenized end-to-end via Stripe; full card numbers never reach our servers
No method of transmission or storage is 100% secure. If you suspect your account has been compromised, change your password immediately and email [SUPPORT EMAIL].
9. International data transfers
The Service is operated from the United States. If you access the Service from outside the US, your information will be transferred to and processed in the US. By using the Service, you consent to this transfer.
For users in jurisdictions with data-export restrictions (such as the European Economic Area), our service providers (Supabase, Stripe, Anthropic) operate under standard contractual clauses or equivalent transfer mechanisms.
10. Children's privacy
The Service is not directed at children under 18 years of age, and we do not knowingly collect personal information from children. If you are under 18, please do not use the Service. If you believe a child has provided personal information to us, contact [SUPPORT EMAIL] and we will delete the information promptly.
11. Cookies and tracking
The mobile app does not use browser cookies. It stores small amounts of data locally on your device (using AsyncStorage and the iOS Keychain / Android Keystore) for sign-in state, theme preferences, and your protocol / outcome logs.
The website at theformularie.com uses minimal essential cookies for site functionality; we do not run third-party advertising or analytics cookies.
12. Changes to this policy
We may update this policy from time to time. When we make material changes, we will update the "Effective date" at the top and notify you in-app, by email, or both at least 14 days before the new policy takes effect. Continued use of the Service after the new policy takes effect constitutes acceptance.
13. Contact us
For privacy questions, data-subject requests, or to report a concern:
Email: [SUPPORT EMAIL]
Mail: The Formularie, [MAILING ADDRESS]
We aim to respond to all privacy inquiries within 30 days.