Privacy Notice

The service is designed to collect only information needed to provide accounts, subscriptions, editorial features, support, and security. The launch data inventory must be verified against the deployed product before this notice becomes effective.

• Account and contact data, such as name, email address, authentication identifiers, and account preferences.
• Subscription and transaction data, such as Stripe customer and subscription identifiers, payment status, invoices, refunds, disputes, promotion codes, and cancellation status. We do not intend to store full payment-card numbers.
• Referral data, such as an affiliate code, attribution timestamp, conversion status, refund adjustment, and payout status.
• Service-use data, such as requested pages, saved entries, update preferences, approximate device and browser details, logs, and security events.
• Communications sent to support or through account and billing workflows.

The service is an educational reference, not a patient record. It is not designed to collect diagnoses, symptoms, medication lists, dosing journals, treatment plans, or other patient-specific health information. Do not submit identifiable patient information through search, saved reading, support, or other product fields.

Before launch, engineering and counsel must confirm that analytics, support tools, and future app features preserve this boundary. Features that collect health information require a separate privacy, security, and regulatory assessment before release.

Information may be used to authenticate users, provide and personalize account features, administer subscriptions and promotions, attribute referrals, communicate about service and billing, prevent abuse, diagnose failures, meet legal obligations, and improve the reference.

Reading interest in peptides or nootropics is not intended to be used for third-party behavioral advertising. Marketing communications should remain separate from essential account, security, and billing messages.

The current architecture uses service providers for hosting, authentication, and payments, including Vercel, Clerk, and Stripe. These providers process information under their own terms and our service arrangements. Additional vendors must be added to the launch data map and disclosed where required.

Information may also be disclosed to professional advisers, authorities when legally required, or a successor in a corporate transaction, subject to applicable safeguards. Affiliates should receive only the limited attribution and payout information needed to administer the program—not subscriber reading history, payment credentials, or patient information.

Essential cookies or similar technologies may maintain sessions, protect security, remember preferences, and preserve a referral code. The preferred referral design uses a user-entered code or first-party signed attribution rather than third-party advertising pixels.

A production cookie inventory, consent mechanism, retention period, and region-specific settings must be verified before launch. Non-essential analytics or marketing technologies should not load until any required choice has been obtained.

Information should be retained only as long as needed for the purposes described, including account access, billing records, security, disputes, and legal obligations. Final retention periods must be documented by data category before launch.

Reasonable technical and organizational safeguards are used, but no system can guarantee absolute security. Production access controls, vendor settings, deletion jobs, backups, and incident procedures must be tested before accepting subscribers.

Users should be able to update account data, cancel online, manage eligible communications, and request access, correction, deletion, or export through the published privacy contact. Requests may require identity verification, and some records may be retained where permitted or required.

Rights differ by location. Counsel must add applicable U.S. state notices, appeal instructions, authorized-agent procedures, and any international disclosures based on the actual launch footprint and data practices.

The service is intended for adults and is not directed to children under 13. The final operator identity, mailing address, privacy email, effective date, and change-notice process must be inserted before launch.