Privacy Policy for Pepta

Effective date: June 27, 2026

Last updated: June 27, 2026

Introduction

This Privacy Policy explains how POPFAME LLC, powered by Boltzman LLC technology and operating Pepta under the Boltzman Lab brand ("Pepta," "we," "us," or "our"), handles personal information when you use the Pepta iOS app, backend services, website pages, and related features (together, the "Service").

Pepta is a wellness tracker for GLP-1 and peptide journeys. It helps users organize compounds, dose schedules, injections, nutrition, hydration, side effects, activity, weight, body measurements, progress photos, research notes, and progress over time. Pepta is not a medical device, and nothing in the Service is medical advice, diagnosis, treatment, or emergency support.

We tried to write this in plain language. If anything is unclear, contact us at dev@boltzman.ai.

Data We Collect

We collect information you provide, information created as you use the Service, and technical information needed to run the app and backend.

Account information

When you create or access an account, we may collect:

• Your name, display name, or profile photo if provided by you or a sign-in provider
• Your email address and whether it is verified
• Authentication identifiers from Sign in with Apple or Google Sign-In
• Linked sign-in provider metadata and account creation dates
• Your subscription entitlement status
• Records that you accepted the current Terms and Privacy Policy versions

Onboarding, profile, and settings information

To personalize Pepta, we may collect:

• Age or date of birth, sex, and optional gender identity
• Height, current weight, goal weight, preferred units, and goal pace
• Activity level, training status, and body-composition goals
• Your biggest concern, such as muscle loss, side effects, stalling, rebound, energy, or face fullness
• Medication status, dose-unit preferences, timezone, journey start date, and side effect baseline
• Account settings, notification preferences, and app choices you select

Medication, peptide, and tracker data

Pepta is built around tracking your journey. Depending on the features you use, we may store:

• Compounds, medication catalog selections, custom compound names, route, half-life, planned dose, concentration, start date, status, notes, and cycles
• Dose schedules, frequency, next dose timing, dose logs, dose amounts, units, injection sites, timestamps, and notes
• Relative medication level estimates generated from your compound, schedule, and dose history
• Meal logs from meal scan, product scan, barcode, voice, search, or manual entry, including food name, serving size, calories, protein, carbs, fat, fiber, timestamps, notes, product lookup metadata, and source
• Water, protein, fiber, activity, steps, workout minutes, and resistance-training logs
• Weight logs, body measurements, body-fat entries, face-fullness ratings, side effect logs, severity, and related notes
• Progress summaries, muscle-retention summaries, insight records, and deterministic signals used to generate those insights
• Research library items and app-generated summaries shown to you

Camera, Microphone, Photos, and Uploaded Files

If you choose to use camera, photo library, microphone, avatar, meal scan, product scan, barcode, voice meal, or progress-photo features, Pepta may process:

• Meal photos and image metadata needed to analyze and save a meal scan
• Product label photos, visible label text, barcode numbers, brand or product names, and public nutrition lookup results used to estimate packaged foods
• Audio recordings and transcripts used to turn spoken meal entries into logs
• Progress photos, including body or face progress-photo records you upload
• Face-fullness ratings you manually enter with progress or measurement data
• Profile photo or avatar images

Uploaded images are stored using private cloud object storage, currently Amazon S3, and are shown back to you through short-lived signed URLs. Pepta does not use these photos for advertising and does not create facial recognition templates or faceprints.

Payment and subscription information

Pepta subscriptions are processed by Apple and managed through RevenueCat. We do not receive or store your full credit card number. From Apple and RevenueCat, we may receive:

• Subscription status, such as free, active, canceled, past due, refunded, or expired
• Product identifiers, entitlement identifiers, renewal state, cancellation state, expiration dates, and transaction-related identifiers
• RevenueCat customer identifiers that help connect a purchase to your Pepta account
• Webhook events used to update your entitlement

Technical and diagnostic information

When you use Pepta or contact our servers, we may collect:

• Device type, operating system, app version, and platform information
• IP address, request paths, timestamps, and server logs
• Authentication and session metadata
• Error, crash, performance, fraud-prevention, and abuse-prevention data
• Rate-limit and security signals

Notifications

If you turn on reminders or notifications, Pepta may use device notification permissions and, where supported, push notification infrastructure to send dose reminders, logging nudges, progress prompts, or account messages. You can turn notifications off in the App or in iOS Settings.

If you separately turn on AI-personalized Pep push notes, Pepta may use recent logs, dose timing, nutrition totals, goals, and trend context to write notification wording. This AI notification personalization is optional and can be turned off without disabling ordinary reminders.

Apple Health / HealthKit Data

HealthKit is not currently connected in the Pepta production backend and current app code. The Apple Health onboarding screen is a deferred integration placeholder and does not currently collect Apple Health data from your device.

If we enable Apple Health / HealthKit in a future version, access will be optional and controlled by iOS permissions. You will be able to grant or revoke permission through Apple Health or iOS Settings. If enabled, Pepta would use HealthKit data only for app functionality, such as showing weight or activity trends you choose to sync.

• We do not sell HealthKit data.
• We do not use HealthKit data for advertising or marketing.
• We do not share HealthKit data with data brokers.

How We Use Data

We use the information described above to:

• Create accounts, authenticate users, and keep users signed in
• Provide and operate tracker features, logs, progress views, and account settings
• Calculate deterministic targets and estimates, including nutrition targets, hydration targets, medication-level estimates, streaks, and muscle-retention summaries
• Analyze meal photos, audio, transcripts, and food text when you request meal intelligence features
• Generate wellness insights, companion-style tracker notes, and plain-language explanations
• Store and serve private uploads through signed URLs
• Process subscriptions, restores, entitlements, and RevenueCat webhooks
• Send reminders and notifications you have enabled
• Provide support, respond to privacy requests, debug issues, prevent abuse, and improve reliability
• Comply with legal, security, accounting, and fraud-prevention obligations

AI Features, Product Lookup, and Providers

Pepta uses AI and food-data providers for things like:

• Meal photo analysis
• Packaged-product label extraction and barcode lookup
• Meal voice transcription and cleanup
• Typed or spoken food-to-nutrition parsing
• Meal scan notes and companion-style tracker copy
• Insight prose around deterministic signals already computed by Pepta
• Optional AI-personalized Pep push notification wording, if you turn that setting on

When you use one of these features, we send relevant context to the provider needed for that feature. This may include a meal image, product label image, barcode, visible label text, audio file, transcript, food text, nutrition target, daily or weekly protein context, dose timing, recent logs, biggest concern, goals, or other tracker context needed for that feature. Product scans may use Together AI to read a product label, Open Food Facts to look up public nutrition data, and OpenAI to structure nutrition results or perform fallback web lookup. We try to send only what is needed for the specific feature, not your entire account.

Before the mobile app sends meal photos, audio, transcripts, meal search text, product label photos, barcode text, or tracker context to AI or food-data providers for processing, Pepta shows an in-app disclosure and asks you to continue with AI features. AI-personalized push notification wording has its own separate in-app setting and server-side consent record. We do not allow OpenAI or Together AI to use your data to train their general models. AI output can be inaccurate or incomplete, so you should review and edit results before saving or relying on them. If you do not want data sent to AI or food-data providers, choose manual logging or avoid AI-powered features such as meal scans, product scans, barcode lookup, voice parsing, food text parsing, and generated insight copy. Core manual tracking features do not require AI providers.

Photos and User Content

Meal photos, progress photos, avatars, and related user content are stored on cloud infrastructure, currently AWS S3 for files and MongoDB Atlas for database records. Private images are returned to the app using short-lived signed URLs. We do not use your photos or uploads for advertising.

You can delete your account from within Pepta. When account deletion runs, Pepta attempts to delete known uploaded image objects tied to your account before removing the corresponding database records. Backup copies, security logs, provider records, or operational records may persist for a limited period where needed for legal, security, or operational reasons.

Subscriptions and Payments

Apple handles payment processing for App Store purchases. RevenueCat helps us manage subscription state, renewals, restores, and entitlements. You can manage or cancel subscriptions through your Apple ID account settings. We do not receive or store your full payment card information.

How We Share Data

We share personal information only as needed with:

• Service providers that help us operate Pepta, including Apple, Google, RevenueCat, OpenAI, Together AI, Open Food Facts, Amazon Web Services, MongoDB Atlas, Render, Expo and app infrastructure providers, and support or email providers.
• Legal and safety reasons. We may share data if required by law, valid legal process, or to protect the rights, property, safety, or security of users, the public, POPFAME LLC, or Boltzman LLC technology.
• Business transfers. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction.

We do not sell personal information. We do not share personal data for cross-app tracking purposes. We do not use health or wellness entries for third-party advertising.

Data Export and Account Deletion

You have several ways to control your information in Pepta:

• Access and edit. You can view and edit many profile settings and logs inside the App.
• Export. Pepta includes an export report feature that creates a JSON summary of your loaded home, track, and progress data. The export excludes raw private image URLs and strips stored meal photo keys from meal logs.
• Delete account. You can delete your account in the App. Account deletion removes your account, profile, medication records, schedules, logs, scans, progress records, insights, retention summaries, subscription webhook records linked to your account, and known uploaded image objects, subject to limited backup, legal, security, and provider-retention exceptions.
• Permissions. You can choose whether to grant camera, photo library, microphone, and notification permissions, and you can revoke those permissions in iOS Settings.
• Subscriptions. You can manage or cancel App Store subscriptions through your Apple ID account settings.
• Privacy requests. You can contact dev@boltzman.ai with privacy questions or requests.

Depending on where you live, you may have additional privacy rights, such as rights to access, correct, delete, or receive a copy of your personal information, or to object to certain processing. We may ask you to verify your identity before we act on a request.

Data Retention

We keep account data and tracker data while your account is active or as needed to provide the Service. If you delete your account or request deletion, we delete or de-identify personal data within a reasonable period except where we need to retain information for legal, security, accounting, dispute-resolution, or fraud-prevention reasons.

Backups, logs, provider records, and operational records may persist for a limited time before they are overwritten or deleted in the normal course.

Security

We use reasonable technical and organizational safeguards designed to protect your information, including authenticated access, private cloud storage, encryption in transit, rate limits, and short-lived signed URLs for private images. No system is perfectly secure, and we cannot guarantee absolute security.

Children

Pepta is intended for adults. We do not knowingly collect personal information from children under 13, or under the age where local law requires parental consent. If you believe a child has provided us with personal information, contact dev@boltzman.ai and we will review and delete it as appropriate.

International Transfers

Pepta is operated from the United States, and your information may be processed in the United States and other places where our providers operate. If you access the Service from outside the United States, your information may be transferred to and processed in countries that may have data protection rules different from those in your country.

Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update this page and may notify you through the App, by email, or by another reasonable method. The Effective date at the top tells you when the current version went into effect.

Contact Us

If you have questions, requests, or concerns about this Privacy Policy or your information:

Email: dev@boltzman.ai

Company: POPFAME LLC, powered by Boltzman LLC technology

App: Pepta (Bundle ID: ai.boltzman.peptaapp)

Related document: Terms of Use