Privacy Policy

Introduction

Peptides Academy is the trade name under which FNA Enterprise LLC, a Florida limited liability company (Florida fictitious name registration G26000059170), operates the Peptides Academy service. In this privacy policy, "FNA Enterprise LLC," "Peptides Academy," "we," "us," or "our" all refer to the same entity. This privacy policy explains how we collect, use, disclose, and safeguard information when you visit our websites (peptidesacademy.co and peptidesacademy.shop), use the Peptides Academy mobile application built with Expo and React Native (the "mobile app"), or otherwise use our services.

Some practices described below apply only to the websites or only to the mobile app. We identify those differences where they matter. By accessing or using our platform, you acknowledge this policy. If you do not agree, please discontinue use of the service.

Information We Collect

Account information

When you create an account, we collect your email address, username, and authentication information. Authentication is handled by Supabase. We do not receive or store your password in plaintext. The mobile app stores its signed-in session token in operating-system protected secure storage so you can remain signed in. You can create an account with an email address and password, or by signing in with Google or with Apple. If you sign in with Apple and choose to hide your email address, Apple gives us a relay address ending in @privaterelay.appleid.com instead of your own; we treat that relay address as your email address.

Profile and community information

Peptides Academy includes community surfaces: a leaderboard, available on our websites and in the mobile app, and a friends list. You can set a display name, a username, and a profile image, either by choosing one of the images bundled with the app or by entering the web address of an image. Your display name, username, profile image, level, XP, current streak, achievement count, completed unit count, and founding-member badge are visible to other signed-in learners on the leaderboard, in member search, and through friend requests and friends lists. A shortened leaderboard is also visible to people who are not signed in: it shows the top ten learners' display names, the first letter of their usernames, and the same XP, level, streak, achievement, unit, and founding-member values. Your email address is never shown to other learners, and other learners cannot find you by email address. There is no messaging between learners. A display name, username, and profile image are optional, you can change them at any time in your profile settings, and deleting your account removes them.

Feedback board

The mobile app has a feedback board where signed-in members can post an idea or a problem, with a title and an optional description, and upvote other members' posts. We store each post with your account identifier, whether it is an idea or a problem, its title and description, its status, its vote count, and when you posted it, and we store a record of each upvote you give. Our team can reply under a post, set its status, or hide it, and those replies are stored with the post. Posts that are not hidden, the team's replies, and vote counts are visible to anyone who opens the board, including people who are not signed in, together with the author's display name (or username, if no display name is set) and profile image. The board does not show who voted for a post, and it does not show you posts from an account you have blocked or that has blocked you. Do not include health information or contact details in a post. To have a post deleted, contact us. Posts and upvotes are kept for as long as the board runs and your account exists, and deleting your account deletes your posts and your upvotes.

Reports and blocks

The mobile app lets you report an AI chatbot answer, another learner's profile, or a feedback board post, and lets you block another learner. When you file a report, we record who filed it, the account reported (a chatbot answer has no author account, so that field is left empty), which surface the report came from, the reason you selected, and an excerpt of the reported content of up to 2,000 characters (for a feedback board post, its title and description). A feedback board post that three different members report is hidden from the board until we review it. Filing a report about a learner, or about one of their feedback board posts, also blocks that learner. When you block a learner, we record the block. Reports and blocks are stored on our servers so that a person can review a report and so that a block applies to your account wherever you sign in.

Purchase information

Website purchases are processed by Stripe. Mobile-app purchases, where they are offered, are processed by the app store that delivered the app: Google Play Billing on Android and Apple's in-app purchase system on iOS. We do not receive or store your complete card number, bank-account details, or the payment credentials held by either app store. We receive transaction information needed to validate access and support purchases, which may include the product identifier, purchase token or transaction identifier, order information, subscription status, and expiration time, and we associate that information with your Peptides Academy account. We also send the app store a pseudonymous token derived from your account identifier by a one-way hash, so that a purchase can be matched to the right account. We send the app store nothing else about you: no email address, no name, and no learning progress.

Mailing list and quiz funnel data

When you interact with our landing page quiz funnel or subscribe to our mailing list, we collect your email address, self-reported knowledge level, and peptide interest area. This information is used to personalize your experience and send relevant educational content.

Quiz and exercise data

We collect and store quiz attempts, scores, completion status, and exercise results associated with your account. This data is used to track your learning progress, generate certificates, calculate XP and achievements, and improve our educational content.

AI chatbot data

When you use our AI chatbot feature, Blorb (powered by Anthropic's Claude API), we process the messages you submit. Your message and up to the last ten turns of the conversation are sent to our server, which forwards them to Anthropic as our AI provider so that a reply can be generated. They are subject to Anthropic's privacy policy, and we do not grant Anthropic permission to train its models on your messages. We do not send Anthropic your account identifier, email address, or name alongside the request.

We do not store the text of your chatbot messages or of the chatbot's replies. For each request we record technical information only: your account identifier, your IP address, which model answered, an outcome status and error category, whether a safety filter applied, response time, reply length, the number of internal document lookups, and whether the request was retried. There is one exception: if you report a chatbot answer, an excerpt of that answer of up to 2,000 characters is stored with your report so that a person can review it.

Chatbot use is rate-limited to prevent abuse, counted per account when you are signed in and per IP address when you are not. Signed-in learners without a chat subscription can send five chatbot messages per day; subscribers are not subject to that daily limit.

IP address

We collect your IP address for the purposes of chat rate limiting, security monitoring, fraud prevention, and compliance with applicable law. Separately, Meta, Reddit, and Microsoft receive advertising data only after the applicable consent choice, and Google receives the measurement data described in the "Google Analytics" and "Google Ads" sections below. The advertising sharing is described in the "Meta Pixel and Conversions API", "Reddit Pixel and Conversions API", and "Microsoft Advertising (Universal Event Tracking)" sections below. You can suppress subsequent advertising sharing using the "your privacy choices" link in the footer of every page.

Referral data

If you participate in our referral program, we collect referral codes and track referral relationships between users. This data is used to administer the referral program and award applicable benefits.

Ambassador applications

If you apply to our ambassador program on our ambassadors page, we collect your name, your email address, the social media accounts or other channels you list (the platform and your handle or profile link), your audience size range, your country if you give it, what you tell us about yourself, and the site language you applied in. We also store your browser user-agent and a one-way hash of your IP address, which we use to limit repeated applications. We use this information to review your application, reply to you, and run the program with you if you join. Your application is stored in our database, hosted by Supabase, which only our team can read. A copy is emailed to our team inbox, hosted by Microsoft 365, and a summary without your email address (your name, accounts, audience size, country, language, and what you told us) is posted to a private Discord channel our team uses for notifications. An application is not linked to a Peptides Academy account, so deleting an account does not delete it; ask us at contact@peptidesacademy.co and we will delete it.

Community sentiment data

We aggregate publicly available data from public Reddit posts and other public forums to compute community sentiment ratings for peptides discussed on our platform. No personally identifiable information (PII) is collected in this process. Sentiment data reflects aggregated public opinion and is not derived from user accounts on our platform.

Usage data

On the websites, browser localStorage may hold learning progress, quiz scores, preferences, and purchase status. In the mobile app, operating-system protected secure storage holds authentication and onboarding state, while app-private cache storage may hold downloaded course content, catalog data, and progress snapshots needed for faster or offline-tolerant loading. Account progress and entitlements are also transmitted to and stored in Supabase when you sign in; the local copy is not the authoritative billing record.

Website analytics

Besides the third-party tools described further below, our websites keep their own usage analytics in our database, which is hosted by Supabase. These first-party records stay with us. We do not sell them and we do not send them to advertising platforms; the only website data those platforms receive is the measurement and conversion data described in the advertising sections below.

For each visit, we record:

• The pages you view, including any campaign tags in the page address (such as utm_source), and the address of the page that referred you
• Time on each page, how far down the page you scroll, how many pages you view in a visit, and how long the visit lasts
• Your device type (mobile, tablet, or desktop), browser name, and screen size
• A random visitor identifier stored in your browser and a random identifier for the current visit

We also record what you do on the site, each time with only a short, fixed set of details:

• Button and link clicks, such as navigation links, course and blog cards and filters, citation links, and links to other websites (we record only the other website's domain)
• Taps on App Store and Google Play links
• Pricing and checkout steps, course unlock and paywall prompts, and membership cancellation and account deletion steps
• Opening the sign-in window and creating an account
• Starting a lesson, and passing or failing a quiz, with the course and unit
• Opening a frequently asked question (its position on the page, not its text)
• Site search and the AI chatbot, recorded only as the length of a search and how many results it returned, and as a count of chatbot messages. We never record the text you type.
• Reconstitution calculator use, with the values and the result recorded only as broad ranges, never the exact numbers
• Reading most of a blog post, and using the interactive tools in some blog posts, including the options you select in them
• Switching the site language, and the address of any page that was not found
• Sharing a page or certificate, invitation prompts, switching between light and dark mode, and showing or dismissing the app download bar

We use this information to improve our courses and website and to measure which pages and features lead to signups and purchases.

When you are signed in, these records are linked to your account. When you are not signed in, they are tied only to the random visitor identifier. Whether we collect them depends on where you are:

• EEA and Switzerland: only after you accept cookies in our banner, whether or not you are signed in. Until then we do not create the random visitor identifier.
• United Kingdom: by default, with an opt-out. UK law (the Privacy and Electronic Communications Regulations, as amended by the Data (Use and Access) Act 2025) allows a website to store and read information on your device without asking first when it is used only to collect statistics about how the site is used, so that we can improve it. We rely on this only for these first-party records, which stay with us, are not shared with third parties, and do not track you across other websites. In the UK, the third-party analytics and advertising tools described below still wait for you to accept them in our banner, except the Google tag, which loads in its cookieless consent mode described in "Cookies" below.
• Everywhere else: by default, as with the other optional analytics described in this policy.

Declining in the banner, turning optional cookies off with the "your privacy choices" link in the footer of every page, or sending a Global Privacy Control signal stops this collection. In the EEA, the UK, and Switzerland this applies whether or not you are signed in; elsewhere it applies while you are signed out. Your learning progress, quiz results, certificates, XP, and purchases are part of the service rather than analytics, and are kept whatever you choose. If you sign in or create an account, analytics recorded earlier in the same browser is linked to your account. If you delete your account, the analytics records linked to it are deleted.

Mobile experiment and product analytics

The mobile app uses limited first-party analytics to compare onboarding designs, to understand whether people complete onboarding, view membership options, start checkout, encounter a broad purchase outcome, continue with limited access, or begin a first lesson, and to understand how the app is used after onboarding, such as which screens and features people use and how far they get in lessons and courses. The app creates a random app-scoped identifier and random session identifier for this purpose. These identifiers are not advertising identifiers and are not linked to your Peptides Academy account, email address, or username. Analytics requests use the app's public project credential and do not forward your signed-in account session token.

The accepted analytics fields are restricted to a fixed list: experiment and app version, assigned onboarding variant, generic screen name and step number, annual or monthly plan selection, whether store billing and an annual trial were shown as available, a low-detail action source or outcome category, platform, build number, and event timestamps. After onboarding, an event can also carry short labels, counts, and durations from a fixed list: the app screen, tab, or navigation button you use and how long you stay on a screen; the course and unit you open, how many lesson steps you view, and whether you finish; a quiz, exam, or practice score, its number of correct answers, and whether you passed; course unlock, credit, certificate, membership, purchase, and restore steps, with the store product identifier and a broad result; streak, level, and achievement changes; which app setting you change and its new option; which notification you open; and counts of chatbot messages, friend actions, and invite taps. We do not collect your selected peptide topic or knowledge level from onboarding, your onboarding or claim-check answers, the answers you choose in a quiz, free text (including what you type to the chatbot or in a search), URL, receipt, price, raw error message, email address, username, account identifier, or advertising identifier in this analytics system.

Analytics transmission begins only after you confirm that you are 18 or older and is then on by default. You can turn it off at any time under settings & legal > anonymous app analytics. Turning it off stops future collection and sends a device-held deletion capability that deletes the random identifier's experiment assignment and stored events. The service retains only one-way suppression hashes of the erased random identifier and deletion capability so delayed uploads cannot recreate the deleted record; these hashes contain no event data and are not used for analytics. If you later turn analytics back on, the app creates a new random identifier and deletion capability while preserving your assigned onboarding design. Because this analytics identifier is not linked to your account, deleting your account alone does not identify that separate anonymous record; use the analytics switch or contact us if you also want it erased. Request infrastructure may process an IP address transiently for abuse prevention, but the experiment database receives only a short-lived, rotating keyed hash rather than the raw address.

Mobile notification data

If you grant notification permission, the mobile app can schedule study, streak, quest, credit, and trial reminders on your device. The reminder content and timing are scheduled locally by the app. Peptides Academy does not currently store a mobile push token in its database or send server-originated push notifications. You can disable notifications in your device settings.

Automatically collected information

When you visit our websites or the mobile app connects to our APIs, our hosting and infrastructure providers may automatically collect standard request and security-log data, such as your IP address, device or browser type, requested resource, and timestamps. This data is used for security, abuse prevention, and performance purposes.

How We Use Your Information

We use the information we collect to:

• Create and manage your account
• Process purchases and grant access to paid content
• Track your learning progress, quiz results, and exercise completion
• Generate completion certificates
• Communicate with you about your account or purchases
• Schedule local mobile-app reminders when you grant notification permission
• Send marketing and educational communications (if you have opted in)
• Provide AI chatbot responses to your inquiries
• Show your display name, username, and profile image to other learners on community surfaces
• Review reports of chatbot answers and member profiles, and enforce blocks between accounts
• Administer referral programs
• Rate-limit chatbot usage and prevent abuse
• Analyze website traffic and usage patterns via Google Analytics and Microsoft Clarity
• Understand how our websites are used and which pages and features lead to signups and purchases, using our own first-party website analytics
• Measure whether our educational advertising on Meta, Reddit, Microsoft Advertising, and Google Ads leads to signups and purchases
• Compare mobile onboarding designs, improve the mobile signup and membership funnel, and learn how the app's lessons and features are used, using limited first-party analytics
• Improve our platform and educational content
• Detect and prevent fraud, abuse, or security incidents
• Comply with applicable legal obligations

We do not sell your personal information for money. However, we share a limited subset of online-activity and identifier data with Meta (Facebook/Instagram), Reddit, Microsoft Advertising, and Google Ads for ad-attribution measurement and educational-content retargeting. Meta, Reddit, Microsoft, and Google Ads sharing follows the applicable consent choice described below. Because this is disclosure to advertising networks for cross-context behavioral advertising, it qualifies as "sharing" (and may be treated as a "sale") under the California Consumer Privacy Act as amended by the CPRA. See the advertising-platform sections below for the exact data shared and how to opt out. You can suppress subsequent sharing at any time using the "your privacy choices" link in the footer, and we honor Global Privacy Control browser signals as a valid opt-out: with that signal, the Meta, Reddit, and Microsoft advertising pixels never load, and the Google tag stays in its cookieless, consent-denied state described in "Cookies" below.

Third-Party Services

We use the following third-party services to operate our platform:

Google Analytics

We use Google Analytics (measurement ID: G-J16JDD67M2) to analyze website traffic and usage patterns. Google Analytics sets tracking cookies on your device (including _ga and _gid cookies) that collect information such as your IP address, browser type, pages visited, time spent on pages, and referring URLs. This data is used to understand how visitors interact with our platform so that we can improve our content and user experience. The Google tag runs in Google's consent mode, described under "Cookies" below: it loads for every visitor, but it sets these cookies only once analytics consent applies. Google may use this data in accordance with Google's privacy policy. You can opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on.

Microsoft Clarity

We partner with Microsoft Clarity to capture how you use and interact with our website through behavioral metrics, heatmaps, and session replay so we can improve our product. Website usage data is captured using first-party and third-party cookies and other tracking technologies to determine the popularity of products and online activity. This information is also used for site optimization, fraud and security purposes. Clarity does not collect any text you enter into form fields, and we have masking enabled to suppress sensitive content by default. For more information about how Microsoft collects and uses your data, see the Microsoft Privacy Statement. You can opt out of Microsoft Clarity by declining analytics cookies in our cookie banner, or globally via the Digital Advertising Alliance opt-out page (select Microsoft).

Meta Pixel and Conversions API

We use the Meta Pixel (a small browser script from Meta Platforms, Inc., the parent of Facebook and Instagram) and the Meta Conversions API (server-to-server event reporting) to measure how well our educational ads perform. These tools help us understand which ads led you to our courses so we can spend our advertising budget on what actually works. We do not use these tools to advertise peptide products, dosing, sourcing, treatments, or outcomes, our ads promote peptide-science education only.

Data shared with Meta: a hashed (one-way SHA-256 transformed) version of your email address, your IP address, your browser user-agent, the URL you visited, the page-load and any purchase event with its dollar amount and a generic course identifier (e.g., "ghk-cu"), and Meta's own first-party cookies (`_fbp`, `_fbc`) if present. We do not send peptide-content beyond the generic course identifier, health claims, dosing data, lab results, signup-form answers, quiz answers, or any other sensitive information.

Consent and gating: for visitors in the European Economic Area, the United Kingdom, and Switzerland, the Meta Pixel only loads after you affirmatively accept advertising cookies in our cookie banner. For visitors outside those regions the pixel may load by default, and you can opt out at any time via the "your privacy choices" link in our footer. Server-side Conversions API events fire only for actions you knowingly initiate (signing up, purchasing) and use the same consent state. If your browser sends a Global Privacy Control signal, the pixel never loads and no Meta sharing occurs.

Opt out: you can withdraw consent at any time using the "your privacy choices" link in the footer of every page. Opening it lets you turn off analytics and advertising cookies (including the Meta Pixel and Conversions API), which flips your stored consent to declined, revokes Google analytics/ad consent, and stops further pixel loading; this applies even if you previously accepted. You can also decline cookies in our banner, or set Meta's Ad Settings to limit ad personalization. For full details on how Meta processes data, see Meta's Privacy Policy and the Meta Pixel privacy notice.

Reddit Pixel and Conversions API

We use the Reddit Pixel (a small browser script from Reddit, Inc.) and the Reddit Conversions API (server-to-server event reporting) to measure how well our educational ads on Reddit perform, so we can spend our advertising budget on what actually works. We do not use these tools to advertise peptide products, dosing, sourcing, treatments, or outcomes, our ads promote peptide-science education only.

Data shared with Reddit: a hashed (one-way SHA-256 transformed) version of your email address, a hashed account identifier, your IP address, your browser user-agent, the Reddit ad click identifier (`rdt_cid` / `_rdt_cid`) if present, the page-visit event, a course-view or add-to-cart event carrying a generic course identifier (e.g., "ghk-cu") and its dollar amount, a lead event if you join our mailing list (a bare signal that a signup happened, carrying a zero dollar amount and the currency (USD), and no email address from your browser), and any purchase event with its dollar amount and a generic course identifier. We do not send peptide-content beyond the generic course identifier, health claims, dosing data, lab results, signup-form answers, quiz answers, or any other sensitive information.

Consent and gating: for visitors in the European Economic Area, the United Kingdom, and Switzerland, the Reddit Pixel only loads after you affirmatively accept advertising cookies in our cookie banner. For visitors outside those regions the pixel may load by default, and you can opt out at any time via the "your privacy choices" link in our footer. Choosing decline or opting out through "your privacy choices" suppresses subsequent Reddit Pixel events. Server-side Conversions API events fire only for actions you knowingly initiate (signing up or purchasing) and use the recorded consent state. If your browser sends a Global Privacy Control signal, the pixel never loads and no Reddit sharing occurs.

Opt out: you can stop subsequent Reddit Pixel and Conversions API events at any time using the "your privacy choices" link in the footer of every page. You can also send a Global Privacy Control browser signal, which prevents the Reddit Pixel from loading. For details on how Reddit processes data, see Reddit's Privacy Policy.

Microsoft Advertising (Universal Event Tracking)

We use Microsoft Advertising's Universal Event Tracking tag (UET, a small browser script from Microsoft Corporation) to measure how well our educational ads on Bing and the Microsoft Advertising network perform, so we can spend our advertising budget on what actually works. We do not use this tool to advertise peptide products, dosing, sourcing, treatments, or outcomes, our ads promote peptide-science education only.

Data shared with Microsoft: your IP address, your browser user-agent, the URL you visited, Microsoft's own first-party UET cookies (`_uetsid`, `_uetvid`), the Microsoft ad click identifier (`msclkid`) if you arrived from a Microsoft ad, a page-load event for each page you view, a lead event if you join our mailing list (a bare signal that a signup happened, carrying no email address and no other data), and, if you complete a purchase, a purchase event carrying its dollar amount, the currency (USD), and the Stripe transaction identifier. We do not send your email address in any form (hashed or otherwise), peptide names, course identifiers, health claims, dosing data, lab results, signup-form answers, quiz answers, or any other sensitive information. We share a narrower set of data with Microsoft than with Meta or Reddit: no email address and no course identifier.

Consent and gating: for visitors in the European Economic Area, the United Kingdom, and Switzerland, the UET tag only loads after you affirmatively accept advertising cookies in our cookie banner. For visitors outside those regions the tag may load by default, and you can opt out at any time via the "your privacy choices" link in our footer. We do not use Microsoft's "consent mode", which would load the script before your choice and report a denied signal. If the recorded consent state is anything other than accepted, the script is never loaded, no UET cookies are set, and no data reaches Microsoft. If your browser sends a Global Privacy Control signal, the tag never loads and no Microsoft advertising sharing occurs.

Opt out: you can withdraw consent at any time using the "your privacy choices" link in the footer of every page, which stops the tag from loading on subsequent page views. You can also decline cookies in our banner, send a Global Privacy Control browser signal, or limit ad personalization in Microsoft's ad settings. For details on how Microsoft processes data, see the Microsoft Privacy Statement.

Google Ads

We use Google Ads (from Google LLC) to show ads for our educational content in Google Search and to measure which ads lead to signups and purchases, so we can spend our advertising budget on what actually works. We do not use Google Ads to advertise peptide products, dosing, sourcing, treatments, or outcomes, our ads promote peptide-science education only.

Data shared with Google: if you arrive from a Google ad, the Google click identifier (`gclid`) is kept in your browser and, if you create an account, stored with your account (the most recent Google ad click is kept), unless you have declined tracking or your browser sends a Global Privacy Control signal. If you later sign up or make a purchase, Google Analytics reports that event to Google Ads. Once a day we also upload purchases made by visitors who arrived from a Google ad: the click identifier, the time of the purchase, its dollar amount, the currency (USD), and an order identifier. We do not send your email address, name, peptide names, course identifiers, health claims, dosing data, quiz answers, or any other sensitive information to Google Ads.

Consent and gating: Google's tags run in consent mode. The Google tag loads for every visitor, but it starts with advertising consent denied, and while consent is denied it sets no cookies and sends Google only cookieless pings, as described in "Cookies" below. For visitors in the European Economic Area, the United Kingdom, and Switzerland, Google's advertising cookies are only set after you affirmatively accept them in our cookie banner. For visitors outside those regions they may be set by default, and you can opt out at any time via the "your privacy choices" link in our footer. While you have not made a choice, the click identifier may be carried in the links between our own pages, without setting a cookie, so that a visit from an ad can still be measured. If you decline, opt out through "your privacy choices", or your browser sends a Global Privacy Control signal, we stop carrying the identifier and never include your purchases in the daily upload.

Opt out: you can withdraw consent at any time using the "your privacy choices" link in the footer of every page. You can also manage ad personalization in Google's My Ad Center. For details on how Google processes data, see Google's privacy policy.

Supabase

Provides authentication, database, and serverless-function services for the websites and mobile app. Your email, username, learning progress, entitlements, and other account data are stored on Supabase's infrastructure, which is hosted on servers located in the United States. See Supabase's privacy policy for details.

Stripe

Handles payment processing for purchases made on our websites. When you make a website purchase, you interact with Stripe's secure payment infrastructure. See Stripe's privacy policy for details.

Google Play

Handles Android mobile-app subscription checkout, payment credentials, renewal, cancellation, and applicable refund workflows. Google sends us limited purchase and subscription data so we can validate and provide access; it does not send us your complete payment-card details. See Google's privacy policy for details.

Apple

Handles iOS mobile-app in-app purchase checkout, payment credentials, renewal, cancellation, and applicable refund workflows, and provides the Sign in with Apple option. Apple sends us limited purchase and subscription data so we can validate it and grant access; it does not send us your complete payment-card details. If you use Sign in with Apple and hide your email address, Apple operates the relay that forwards our mail to you. See Apple's privacy policy for details.

Expo

Provides mobile-app build, update-delivery, and on-device notification-scheduling infrastructure. When the mobile app checks for or downloads an update, Expo may process technical request data such as app version, platform, IP address, and device or installation identifiers. The current mobile app does not request or store an Expo push token and does not use Expo to send server-originated push messages. See Expo's privacy policy for details.

Cloudflare

Provides hosting, CDN, and security services. Cloudflare may collect standard web analytics data. Content is distributed via Cloudflare's global content delivery network. See Cloudflare's privacy policy for details.

Resend

We use Resend (Resend, Inc.) as our email delivery service provider to send transactional emails (such as account, purchase, and security notifications) and, where you have opted in, educational and marketing emails. To do this, Resend processes your email address and related email-engagement events (such as deliveries, opens, and clicks). See Resend's privacy policy for details.

Microsoft 365

Our business email, including our contact@peptidesacademy.co inbox, is hosted on Microsoft 365 (Microsoft Corporation). We also send some emails from that mailbox through Microsoft's Outlook service, using the Microsoft Graph API: a thank-you note after your first purchase, a short email asking why you canceled an app membership, a reminder to claim a Foundations certificate you have earned, and course launch and other announcements. To send these, Microsoft processes your email address and the content of the message. When you email us or reply to one of these emails, your message is stored in that mailbox. See the Microsoft Privacy Statement for details.

Anthropic

Our AI chatbot feature uses Anthropic's Claude API. When you submit messages to the chatbot, your messages are transmitted directly to Anthropic for processing as our AI provider. We do not grant Anthropic permission to train its models on your messages. See Anthropic's privacy policy for details.

Cookies and Device Storage

Cookies

We use the following types of cookies:

• Essential cookies: our authentication provider (Supabase) sets session cookies to maintain your login state. These cookies are strictly necessary for the service to function.
• Analytics cookies: Google Analytics sets tracking cookies (including _ga, _gid, and related cookies) to collect anonymized usage data about how visitors interact with our platform. The _ga cookie persists for up to 2 years; the _gid cookie persists for 24 hours. Microsoft Clarity sets first-party cookies (including _clck and _clsk) to enable session replay and heatmaps; _clck persists for up to 1 year, _clsk for 1 day.
• Advertising cookies and identifiers: Meta's `_fbp` and `_fbc` cookies, Reddit's `_rdt_cid` click-id cookie, Microsoft's `_uetsid` and `_uetvid` UET cookies, and Google's `_gcl_aw` conversion cookie may be used for ad measurement and attribution. The `_uetsid` session cookie expires after 24 hours and the `_uetvid` visitor cookie persists for up to 13 months; both are set by Microsoft's tag, and only after the applicable consent choice. Our first-party code writes the Meta and Reddit click-id cookies only after consent. Advertising cookies are not set when your browser sends a Global Privacy Control signal. Outside the EEA, the UK, and Switzerland, an ad click identifier that arrives in a link may still be kept in your browser's local storage, but it is not stored with your account or shared.
• Consent management: where you are decides the default. In the EEA, the UK, and Switzerland, and wherever we cannot tell your location, no optional cookie is set and Microsoft Clarity, the Meta Pixel, the Reddit Pixel, and Microsoft's UET tag do not load until you accept in our cookie banner. In the UK, our first-party website analytics (and the random visitor identifier it uses) runs by default with an opt-out, as described in "Website analytics". Everywhere else, these tools load by default and you can opt out at any time with the "your privacy choices" link. If you decline, opt out, or your browser sends a Global Privacy Control signal, Clarity and the advertising pixels never load and no optional cookies are set.
• Google tag and consent mode: the Google tag, which serves Google Analytics and Google Ads, loads for every visitor in Google's consent mode and starts with analytics and advertising consent denied. While consent is denied (before you make a choice in the EEA, the UK, and Switzerland, after you decline or opt out, and always when your browser sends a Global Privacy Control signal), it sets and reads no cookies and sends Google only cookieless pings: the page you visited, events on it such as starting checkout or signing up, the time, your browser and device type, and your consent state, without a cookie or device identifier. Like any request to Google, these pings reach Google with your IP address, and the page address can include an ad click identifier if you arrived from an ad. Google's analytics and advertising cookies are set only once consent is granted: when you accept, or, outside the EEA, the UK, and Switzerland, by default until you opt out.

You can control cookies through your browser settings. Disabling essential cookies may prevent you from using certain features of the service. You can opt out of Google Analytics cookies specifically by using the Google Analytics Opt-out Browser Add-on.

The cookie, website analytics, session-replay, and advertising-pixel practices above apply to our websites. The native mobile app does not use browser cookies, Google Analytics, Microsoft Clarity, Meta Pixel, or Reddit Pixel.

Local storage

We use browser localStorage to store:

• Your theme preference (dark or light mode)
• Learning progress and quiz scores
• Purchase unlock status
• Gamification data (XP, streaks, achievements)
• Cookie consent status
• A persistent anonymous visitor identifier (`pa_visitor_id`) used to link your first-party site activity across visits and, if you create an account, to your account
• Marketing attribution data for the source of your visit: UTM campaign parameters and ad click identifiers, including Meta's `fbclid`, Google's `gclid`, Reddit's `rdt_cid`, and Microsoft's `msclkid`. The Microsoft click identifier is stored only in this first-party record on your device; we do not write a separate cookie for it. In the EEA and Switzerland this record is saved on your device only after you accept cookies in our banner. In the UK the campaign parameters are saved as part of our first-party website analytics, and the ad click identifiers wait for your acceptance. Until then the record is kept only for your current browser tab, and declining discards it

This website data is stored on your device and can be cleared through your browser settings.

Mobile app storage and cache

The mobile app uses operating-system protected secure storage for account session tokens, onboarding state, a random experiment identifier, and the random deletion capability used to erase that experiment data. It also uses app-private cache storage for downloaded educational content, queued privacy-bounded analytics events, and temporary or stale-while-revalidate copies of account, catalog, progress, and course data. This improves startup speed and limited offline continuity. Account data may still be synchronized with Supabase as described above. You can remove on-device copies by clearing the app's storage in your device settings or uninstalling the app, subject to your operating system's backup and restore behavior.

Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we process your personal data on the following legal bases:

• Consent: we process your data based on your consent for marketing communications (including mailing list subscriptions and quiz funnel opt-ins), and for optional analytics and advertising cookies (including Google Analytics, Google Ads, Microsoft Clarity, the Meta Pixel, the Reddit Pixel, and the Microsoft Advertising UET tag). Clarity and the advertising pixels load only after you accept them in our cookie banner. The Google tag loads in consent mode before you choose, but it sets no cookies and sends only cookieless pings until you accept, as described in "Cookies". You may withdraw your consent at any time by clicking "unsubscribe" in any email, using the "your privacy choices" link in the footer, or contacting us.
• First-party website analytics: in the EEA and Switzerland, consent, given in our cookie banner. In the UK, our legitimate interest in understanding how our website is used so that we can improve it, with the storage on your device covered by the statistics exemption in the Privacy and Electronic Communications Regulations; you can object at any time by declining in the banner, using the "your privacy choices" link, or sending a Global Privacy Control signal.
• Contractual necessity: we process your data as necessary to perform our contract with you, including creating and managing your account, processing purchases, granting access to paid content, tracking learning progress, and generating certificates.
• Legitimate interest: we process data based on our legitimate interests for limited first-party mobile product analytics, security monitoring, fraud prevention, rate limiting, service improvement, and aggregating community sentiment data from public sources. Our legitimate interests do not override your fundamental rights and freedoms, and the mobile analytics control described above lets you object and erase that app-scoped analytics record.
• Legal obligation: we may process your data to comply with applicable legal obligations, such as tax reporting, responding to lawful requests from public authorities, or complying with court orders.

International Data Transfers

Your personal data is stored and processed in the United States. Specifically:

• Supabase: our primary database and authentication provider hosts data on servers located in the United States (us-west-1 region).
• Cloudflare: content is distributed via Cloudflare's global content delivery network (CDN), which may cache and serve content from servers located in various countries.
• Stripe: payment processing is handled by Stripe, which processes data in the United States and other jurisdictions.
• Google: website analytics and Google Play transaction data are processed by Google in the United States and other jurisdictions.
• Anthropic: AI chatbot data (via Anthropic's Claude API) is processed by Anthropic in the United States and other jurisdictions.
• Microsoft: Microsoft Clarity session and heatmap data, Microsoft Advertising (UET) ad-measurement data, and the email we send and receive through Microsoft 365 are processed by Microsoft in the United States and other jurisdictions.
• Expo: mobile update-delivery and notification-token infrastructure may process technical request data in the United States and other jurisdictions.

If you are located outside the United States (including in the EEA, UK, or Switzerland), your personal data will be transferred to and processed in the United States, which may not provide the same level of data protection as your jurisdiction. By using the service, you consent to this transfer. Where required by applicable law, we rely on appropriate safeguards for such transfers, including standard contractual clauses adopted by the European Commission.

Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access - request a copy of the personal data we hold about you
• Correction - request correction of inaccurate data
• Deletion - request deletion of your personal data and account
• Portability - request your data in a portable format
• Opt-out - opt out of any marketing communications

You can delete a signed-in account in the mobile app under settings, use our account deletion page, or contact us at contact@peptidesacademy.co to exercise these rights. Deleting an account, or deleting the mobile app, does not cancel a Google Play or App Store subscription; to stop future renewals, cancel it separately in Google Play subscriptions, or on an Apple device in Settings > [your name] > Subscriptions. We will respond to other privacy requests within 30 days (or such shorter period as may be required by applicable law).

You can separately stop and erase mobile experiment analytics under settings & legal > anonymous app analytics. This control does not require an account.

European Residents (GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following additional rights under the General Data Protection Regulation (GDPR) and equivalent local laws:

• Right to object - you may object to our processing of your personal data based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.
• Right to restrict processing - you may request that we restrict the processing of your personal data in certain circumstances (e.g., while we verify the accuracy of your data).
• Right to withdraw consent - where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint - you have the right to lodge a complaint with your local data protection supervisory authority.
• Right to data portability - you may request to receive your personal data in a structured, commonly used, and machine-readable format.

FNA Enterprise LLC acts as the data controller for the purposes of GDPR. Our contact information is: contact@peptidesacademy.co.

California Residents (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to know: you have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the business purpose for collecting it, and the categories of third parties with whom we share it.
• Right to delete: you have the right to request the deletion of personal information we have collected about you, subject to certain exceptions permitted by law (such as information needed to complete a transaction or comply with a legal obligation).
• Right to correct: you have the right to request that we correct inaccurate personal information we maintain about you.
• Right to opt-out of sale or sharing: you have the right to opt out of the "sale" or "sharing" of your personal information. We share limited identifiers and internet-activity information with Meta, Reddit, Microsoft Advertising, and Google Ads for cross-context behavioral advertising and attribution. You can suppress subsequent sharing using the "your privacy choices" link in the footer, and we honor Global Privacy Control signals before loading advertising pixels.
• Right to non-discrimination: we will not discriminate against you for exercising your CCPA/CPRA rights.

Categories of personal information collected: identifiers (email, username, IP address, online and advertising identifiers), commercial information (purchase records), internet activity (browsing history, interactions with our site), and inferences (quiz results, learning progress).

Categories shared for cross-context behavioral advertising: we may share identifiers and internet-activity information, including page visits and conversion events, with Meta, Reddit, Microsoft Advertising, and Google Ads as described above. Declining or exercising the opt-out suppresses subsequent events; a Global Privacy Control signal prevents the advertising pixels from loading and keeps the Google tag in its cookieless, consent-denied state.

No monetary sale of personal information: FNA Enterprise LLC does not sell your personal information to third parties for monetary consideration, and we do not knowingly share or sell the personal information of consumers under 16 years of age. Our advertising-network sharing is described above and can be limited through our privacy controls.

How to opt out (two or more methods): we provide more than one designated method to opt out of the "sale" or "sharing" of your personal information: (1) the "your privacy choices" opt-out link in the footer of every page; (2) emailing us at contact@peptidesacademy.co; and (3) sending a Global Privacy Control (GPC) browser signal, which we automatically honor as a valid opt-out for the browser sending it. You do not need to create an account to exercise any of these.

Request metrics: FNA Enterprise LLC is a small business that does not buy, sell, or share the personal information of 10 million or more California consumers in a calendar year, so we are not required to compile or publish the annual consumer-request metrics described in 11 CCR 7102. We will provide information about requests we received on request where required by law.

To submit a CCPA/CPRA request, contact us at contact@peptidesacademy.co or use the "your privacy choices" link in the footer. We will verify your identity before processing your request and respond within 45 days.

Data Security

We implement reasonable technical and organizational measures to protect your personal information. Data transmission is encrypted via HTTPS/TLS. Authentication and password credential protection are handled through Supabase's secure infrastructure, and the mobile app stores session tokens in operating-system protected secure storage.

However, no method of electronic transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

Data Retention

We retain your personal data for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law. Specific retention periods are as follows:

• Account information (email, username, password hash): retained for as long as your account is active. Upon account deletion request, deleted within 30 days.
• Purchase records: records we must retain are kept for up to 7 years after the transaction date for tax, accounting, fraud-prevention, and legal compliance. Google Play, Apple, and Stripe retain their own transaction records under their policies.
• Learning progress, quiz data, and exercise results: retained for as long as your account is active. Deleted upon account deletion.
• Chat data and logs: we do not store the text of chatbot messages or replies. Chat request telemetry is kept for as long as necessary to operate, secure, and improve the chat feature, and the IP address recorded with a chat request is removed after 30 days. Daily chat usage counts, which include an IP address for signed-out use, are deleted after 30 days. Chatbot text is retained only where you have reported an answer, as part of that report.
• Reports and blocks: a report and its content excerpt are kept for as long as necessary to review it, act on it, and identify repeated abuse. A report you filed is deleted when your account is deleted; a report filed about you is kept for review with your account identifier removed from it. A block is kept until it is lifted or either account is deleted.
• IP address logs (for rate limiting and security): retained only for as long as necessary for rate limiting, security, fraud prevention, and legal-compliance purposes, after which they are deleted or de-identified in the ordinary course of business.
• Google Analytics data: retained for 14 months in accordance with Google's data retention settings, after which it is automatically deleted.
• Mobile experiment analytics: experiment events and their app-scoped assignments are automatically deleted after 90 days without activity, and are deleted sooner when you turn off anonymous app analytics in the mobile app. After erasure, one-way suppression hashes of the random identifier and deletion capability are retained solely to prevent delayed or replayed requests from recreating the deleted record; they contain no events and are not used for measurement.
• Feedback board posts and upvotes: retained for as long as the board runs and your account exists. Deleted upon account deletion, or sooner if you ask us to delete a post.
• Ambassador applications: there is no automatic deletion period. We keep an application to review it and, if you join, to run the program with you, and we delete it when you ask us to.
• Referral data: retained for as long as the referral program is active and your account exists.
• Mailing list data: retained until you unsubscribe, at which point your email is removed from active mailing lists within 10 business days.
• Certificates: retained indefinitely to allow verification, unless you request deletion.

If you request account deletion, we will delete your personal data within 30 days, except where retention is required by law or for legitimate business purposes as described above.

Website localStorage persists until you clear it or your browser data. Mobile-app secure storage and cache data persist until the app replaces them or you clear the app's storage or uninstall the app, subject to operating-system backup and restore behavior.

Children's Privacy

Our platform is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will delete it.

Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated "last updated" date. Continued use of the platform after changes constitutes acceptance of the updated policy.

Contact Us

If you have questions about this privacy policy or our data practices, contact us at:

FNA Enterprise LLC d/b/a Peptides Academy
email: contact@peptidesacademy.co