Dead Pixel Studio (“we”, “us”, or “our”) builds mobile applications for personal health tracking, notably Peptide Stack (marketed as Peptide AI) and Peptide Journal, together with the website at peptide-stack.app (collectively, the “Services”). This Privacy Policy explains what we collect, why, how it is stored, who else may see it, and the choices you have.

We designed the Services around a simple principle: your journal, dose, injection, body, mood, sleep, and photo data stay on your device or in your personal iCloud account, and are never transmitted to us. The sections below explain the narrow exceptions.

1. The very short version

We do not sell, rent, or share your personal data with advertisers, data brokers, or marketing networks. Ever.
We do not know who you are. The Services do not require an account, an email address, a phone number, or a login.
Your journal entries, doses, protocols, injection sites, body measurements, side effects, photographs, and other content you create in the Services are stored locally on your device and (optionally) synchronised to your personal iCloud via Apple’s CloudKit. We cannot read that data.
We collect a small amount of anonymous product-analytics data (screen views, feature interactions) via TelemetryDeck so we can improve the Services. No identifiers, no journal content.
Subscription entitlements are verified through the App Store and RevenueCat. Neither we nor RevenueCat receive payment details — those stay with Apple.
You are the controller of your data. You can delete everything by uninstalling the Services and, if enabled, deleting the iCloud container from iOS Settings → iCloud → Manage Storage.

2. Information we do not collect

The Services do not collect the following:

your name, email address, phone number, or postal address;
a persistent user identifier tied to your identity;
your Apple ID;
your IDFA (Identifier for Advertisers);
your precise or coarse location;
your journal content, photos, notes, doses, injection sites, or body measurements;
your contacts, calendar, health data, or motion data;
fingerprints, browsing history, or any tracking data.

The Services do not use tracking technologies as defined by Apple’s App Tracking Transparency framework. You will not be shown an ATT prompt because there is nothing to track.

3. Information stored on your device

The Services store the following on your device using Apple’s SwiftData / Core Data / iCloud CloudKit APIs:

Journal, protocol, and dose data you create, including entries, tags, mood, sleep, energy, side effects, injection sites, weight, waist, hip, thigh, calf, and other body measurements, and any photographs you attach.
Preferences such as measurement units, language, appearance, notification settings, and rating-prompt state.
Cached subscription state so the app knows whether you have Pro access when it launches offline.

If iCloud is enabled on your device, this data is replicated across your Apple devices via Apple’s CloudKit private database, which uses end-to-end encryption controlled by your Apple ID. We do not have any access to this database.

4. Analytics (TelemetryDeck)

We use TelemetryDeck for privacy-first product analytics. TelemetryDeck receives:

a short signal name (for example Screen.Home, paywall_open, journal_entry_saved);
optional non-identifying string parameters (for example surface: ai_tab);
your device model, operating-system version, app version, and locale;
an anonymised, one-way-hashed installation identifier that we cannot reverse.

TelemetryDeck does not receive your Apple ID, IDFA, IP address, journal content, medication or compound names, doses, injection sites, photographs, or any other personal data. Signals are transmitted over TLS to servers operated by TelemetryDeck in the European Union.

5. Subscriptions (Apple & RevenueCat)

Paid subscriptions are sold, billed, and refunded by Apple through the App Store under Apple’s Terms of Sale and Privacy Policy. We use RevenueCat to verify entitlements. RevenueCat receives Apple receipt metadata and a pseudonymous RevenueCat App User ID that is not linked to your identity. RevenueCat processes this data as a processor on our behalf, in the United States, subject to appropriate contractual safeguards.

Neither RevenueCat nor Dead Pixel Studio ever receives your credit-card number, PayPal account, or Apple Pay device account number. Those remain solely with Apple.

6. AI features

Peptide Journal generates summaries and reflections using Apple’s Foundation Models framework (Apple Intelligence). All processing happens on your device. Your journal content is not transmitted anywhere.

Peptide Stack offers an optional Second-opinion feature that lets you send a redacted, symbolic summary of your active protocol to a large-language-model provider (Anthropic’s Claude or OpenAI’s ChatGPT). This feature fires only when you explicitly request it. The payload contains compound names and generic timing, but no identifying information and no journal content. Providers process the payload subject to their own privacy policies (Anthropic, OpenAI).

7. Notifications

The Services may schedule local notifications on your device (for example, reminders you configure). Local notifications never leave your device. We do not currently send remote push notifications.

8. Cookies and the Website

Our marketing website at peptide-stack.app uses only strictly-necessary cookies and does not run any advertising, retargeting, or cross-site tracking. Static assets are served through a content-delivery network, which may briefly record request-level metadata (IP address, user-agent) for security and abuse-prevention purposes; this data is not linked to a user profile.

9. Children

The Services are not directed to, and we do not knowingly collect data from, individuals under the age of 17. If you believe a minor has provided information to us, please contact us at info@deadpixel-studio.com and we will take appropriate action.

10. Legal basis and your rights (GDPR / UK GDPR)

Where the EU General Data Protection Regulation or the UK GDPR applies to you, the legal bases on which we process the limited data described above are:

Legitimate interests (Article 6(1)(f) GDPR) for anonymised product analytics, to keep the Services stable and useful;
Contract (Article 6(1)(b) GDPR) for delivering the Services and honouring subscription entitlements;
Legal obligation (Article 6(1)(c) GDPR) where retention of transaction records is required.

You have the right, subject to statutory limits, to request access to your data, correction, deletion, restriction, and portability, and to object to processing. Because the Services do not collect a personal identifier we can use to look up your data, most of these rights are exercised on-device by editing or deleting the data yourself, or by uninstalling the Services and (if used) deleting the iCloud container. For anything else, write to info@deadpixel-studio.com. You also have the right to lodge a complaint with your local supervisory authority.

11. California residents (CCPA/CPRA)

We do not “sell” or “share” personal information as those terms are defined by the California Consumer Privacy Act (as amended by the CPRA), and we have not done so in the preceding twelve (12) months. California residents may exercise the rights described in Section 10; requests can be sent to info@deadpixel-studio.com. We will not discriminate against you for exercising your rights.

12. International data transfers

TelemetryDeck servers are located in the European Union. Apple and RevenueCat are US-headquartered and may process metadata in the United States and other countries. Where personal data is transferred outside the European Economic Area or the United Kingdom, appropriate safeguards apply, including the European Commission’s Standard Contractual Clauses.

13. Data retention

Data stored on your device or in your personal iCloud stays as long as you keep it. Delete an entry, delete the app, or delete the iCloud container to remove it.
Anonymous analytics signals are retained by TelemetryDeck for up to 180 days for trend analysis and are then aggregated or deleted.
Apple and RevenueCat retain subscription-transaction metadata in accordance with their own policies and applicable accounting requirements.

14. Security

We take reasonable technical and organisational measures to protect the limited data we process, including transport encryption (TLS), minimisation, and vendor due diligence. However, no method of transmission or storage is perfectly secure. You are responsible for the physical security of your device and for keeping your operating system up to date.

15. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be signalled in-app or on the Website, and the Effective date above will be revised. Continued use of the Services after the updated Policy takes effect constitutes acceptance of the changes.

16. Contact

Dead Pixel Studio
Berlin, Germany
info@deadpixel-studio.com