Privacy Policy

Last updated: June 2026

1. Controller

DR Development and Media LLC, Vazha Pshavela Avenue No 20, 0112 Tbilisi, Georgia
Managing Director: Dimitri Roschkowski
Email: info@mypep.app

2. Core Principle: Zero-Knowledge

myPeptides is built on a zero-knowledge principle. Your content data (e.g. your peptide entries, plans, tracker data, calculator inputs) is stored primarily locally in your browser (IndexedDB) and does not leave your device unless you enable the optional cloud synchronization. We operate no tracking, no analytics tools, no advertising cookies, and we do not share data with third parties for marketing.

3. What Data Is Processed

a) Local data (on your device, IndexedDB). The content you create in the app is stored locally in your browser. As the operator, we have no access to it. You can delete this data yourself at any time by removing it in the app or clearing this site's browser data. Legal basis: Art. 6(1)(b) GDPR.

b) Optional cloud sync (end-to-end encrypted). If you enable synchronization, your data is end-to-end encrypted with a key known only to you before it leaves your device and is transmitted to our sync server (sync.mypep.app) solely as encrypted data blocks (ciphertext). The server can never access the plaintext of your data and stores only encrypted content together with the technical metadata required for synchronization (e.g. an account/device identifier, transfer timestamps). We cannot decrypt your content. Legal basis: Art. 6(1)(a) GDPR (consent) and Art. 6(1)(b) GDPR.

c) Strictly necessary cookies. We use only strictly necessary cookies, which do not require consent: mp_lang (language choice) and a storage value for the color scheme (light/dark). These contain no personal profiles and are not used for tracking. Legal basis: Art. 6(1)(f) GDPR; Section 25(2) TDDDG.

d) Server logs / hosting. When you access the website, our hosting provider (servers located in the EU) automatically processes technical access data (e.g. IP address, date/time, requested resource, status code, user agent), technically necessary to deliver the website and ensure its stability and security. Legal basis: Art. 6(1)(f) GDPR.

e) Payment processing (Paddle). Purchases of myPeptides Pro in the browser are handled by Paddle.com Market Limited. Paddle is the seller and merchant of record and, in that capacity, a separate controller — not our processor. As soon as you open the purchase page, Paddle processes your IP address to determine country, currency and tax rate; when you buy, your email address, billing details and payment details are added. We pass along a pseudonymous account identifier (a random UUID) so that your purchase can be linked to your account. On its own that identifier says nothing about who you are — but Paddle and RevenueCat store it together with your email address and billing details, which ties it to an identified person there. For us, it maps to your account. It is therefore personal data in every case, not anonymous. Content from the app is not transmitted — it is end-to-end encrypted and unreadable to Paddle and to us. Legal basis: Art. 6(1)(b) GDPR. Paddle's privacy policy: https://www.paddle.com/legal/privacy

3a. Account with email address and password

When you create an account with an email address, we process information that can identify you for the first time. Here is everything that gets stored.

What data. Your email address; a value derived from your password (the password itself never reaches our server and is stored nowhere); session data for as long as you stay signed in; the time and a random identifier for browsers you explicitly trust; and an encrypted key bundle that only you can open — to us it is a sequence of unreadable bytes.

Purpose and legal basis. The processing serves the performance of the user agreement: without an account there is no access to your synchronised data. Legal basis: Art. 6(1)(b) GDPR.

Recipients. Confirmation and sign-in codes are sent through the controller's own mail server (smtp.dr-gruppe.net). No external email provider is involved: your address goes neither to a processor nor to any third party.

Separate data sets. The email service and the sync service (sync.mypep.app) live in separate data sets with no shared identifier. From our own records it is therefore not possible to tell which email address belongs to which synchronised account. To be straight about it: for paying customers the payment provider knows the email address and the subscription service knows the account identifier — there, a link is technically possible.

Retention. Account data stays until you delete it. Registrations that were never confirmed are deleted after 48 hours. Confirmed accounts whose setup was never completed are deleted after 7 days. A browser's trust expires after 60 days. If you request a full restart of your account, the encrypted keys are deleted 72 hours later; any successful sign-in during that window cancels the process.

Authenticator app and passkeys. If you set up an authenticator app, we store an encrypted TOTP secret and encrypted backup codes. Neither leaves our server, and neither says anything about your device. If you add a passkey, we store its public key, a credential identifier, a counter, the name you give it, and the model identifier of the authenticator (AAGUID) — no biometric data. Your fingerprint or face never leaves your device; all we learn is that your device performed the check. Passkeys and the authenticator app stay until you remove them in settings, and they disappear with your account.

Deletion. You can delete your account yourself at any time under Settings → Account. After that the synchronised contents are permanently unreadable — for us too, because only you ever held the key.

Subscription management (RevenueCat). If you buy myPeptides Pro, RevenueCat, Inc. (USA) processes the purchase on our behalf in order to manage your Pro access across all your devices — as a processor under Art. 28 GDPR, bound by our instructions. What is transmitted is the pseudonymous account identifier and the purchase data from Paddle, including your email address; no content from the app. If you never buy anything, you never deal with RevenueCat. Legal basis: Art. 6(1)(b) GDPR. The transfer to the USA relies on whichever transfer mechanism applies (EU-US Data Privacy Framework or standard contractual clauses). Privacy policy: https://www.revenuecat.com/privacy

If you sign up for the beta at mypep.app/beta, we store your first name, your email address, the platform you chose (iPhone or Android), the language of the page and the time of sign-up.

Purpose and legal basis. We use these details only to invite you to the beta. The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by submitting the form and can withdraw at any time with effect for the future.

Recipients. Each new sign-up triggers a notification email to us, sent through our own mail server. For the invitation itself we pass on your email address: for iPhone to Apple (TestFlight), for Android to Google (the tester list of the closed test on Google Play). Apple or Google send the invitation and process the address as independent controllers under their own privacy policies, including in the USA. Your first name, language and sign-up time stay with us.

Retention and deletion. We keep these details until the beta ends or until you withdraw your consent, whichever comes first. To withdraw or have the data deleted, a short email to info@mypep.app is enough; we will then also remove you from the tester list at Apple or Google.

4. No Tracking, No Analytics, No Advertising

We use no analytics or tracking services (no Google Analytics or similar), no advertising cookies, no profiling, and no automated decision-making. There is no sharing of your data with third parties for advertising or marketing purposes.

5. Recipients / Processors

The only transfer is to our hosting/server provider, which supplies the infrastructure within the EU; a data processing agreement under Art. 28 GDPR is in place. Because cloud sync content is end-to-end encrypted, this provider likewise has no access to your plaintext content.

6. Retention Period

Local data remains on your device until you delete it. Encrypted sync data is stored until you delete it via the app or terminate synchronization. Server logs are retained only for the short period required for security.

7. Your Rights

Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21). Any consent (e.g. for cloud sync) can be withdrawn at any time with effect for the future (Art. 7(3) GDPR). Because we cannot decrypt your content, you can delete it yourself, fully and at any time. You also have the right to lodge a complaint with a data protection supervisory authority.

8. Contact

For information requests and to exercise your rights: info@mypep.app