The short version
- Your vials, doses, symptoms, measurements and notes are stored on your phone, not on our servers.
- You don’t need an account. If you make one, we keep your email address and little else.
- Questions you ask the AI assistant go through our server to Anthropic, our AI provider, to be answered. We don’t keep them.
- No ads, no ad trackers, and we never sell your data.
- Crash reports and usage statistics are off unless you turn them on.
- You can export or delete everything from the app at any time.
Who we are
Pepello is made by OpenSkye Labs (“we”, “us”). This policy covers the Pepello app for iPhone and Android and this website. Questions about it go to privacy@openskyelabs.xyz.
What stays on your phone
Everything you enter in Pepello is stored in a database on your phone:
- vials and pens: compound, strength, the water you mixed in, lot number, source, price, notes and photos of certificates of analysis;
- your plans and the doses you log, with injection site and notes;
- symptoms, daily mood check-ins, and measurements such as weight, waist, blood pressure, resting heart rate and blood glucose;
- your answers to the health questions in setup;
- your settings, such as your name, units and reminder times.
When you scan a dose someone shared with you, Pepello uses the camera only on that screen to read the code, on your phone: nothing is recorded or sent. A dose you share is a message and QR code you send yourself; it holds the numbers of the calculation (vial, water, dose and syringe), any label you type, and which peptide it is only if you pick one. It never holds your name or anything else from your log, and Pepello removes links, web addresses and phone numbers from the label.
We can’t see any of it. It leaves your phone only in the ways listed below, in a file you export yourself, or in your phone’s own backup (iCloud or Google) if you have backups turned on. Pepello relies on your phone’s screen lock and built-in encryption to protect it, so keep a passcode on your phone. If you sign in, the sign-in token is kept in your phone’s secure keychain.
What leaves your phone, and why
Questions to the AI assistant
When you ask Pepello’s AI assistant a question, the app sends the conversation (up to its last 50 messages) to our server, which passes it to Anthropic to write the answer. Before your first question, the app tells you this and asks you to agree.
If Send my records with chat questions is on (it is on unless you turn it off in Profile), the app also sends a summary of your vials, plans and last 50 doses so answers can take them into account: compound, product, strengths, dose amounts, how often and dates. It never sends notes, injection sites, lot numbers, prices, photos, your name, measurements, symptoms, mood or health answers. With the switch off, only the conversation is sent.
Our server does not store conversations; the app keeps them only while the chat is open. To limit abuse, our server counts requests per IP address for a day and does not write that count to disk. Anthropic processes the conversation to produce the answer under its commercial terms, which do not allow it to train its models on this data, and keeps it only for a limited time for safety and abuse monitoring. See Anthropic’s privacy policy.
An account, if you choose to make one
Pepello works fully without an account. Where sign-in is offered, you can sign in with Apple or Google. We then store:
- your email address (or the private relay address Apple gives us if you choose to hide yours);
- which provider you used and the account ID it gives us;
- the sign-in token the provider issues, and our own session token.
We don’t store your name, photo, IP address or device details with your account. Today an account holds no health data: syncing your log is not built yet, and if we add it, it will be off until you turn it on, and this policy will say what it sends first.
Crash reports, if you turn them on
Send crash reports in Profile is off by default. If you turn it on, it starts the next time you open the app, and the app sends crash details to PostHog, the same service as usage statistics: the error type, where in the code it happened, the app version, your phone’s model and system version, and a random ID that is not linked to you or to an account. The error message, doses, compound names, notes, your name and anything you typed are removed first. A crash in Android or iOS code is sent the next time you open the app and also includes the system’s own error message, which is not removed and can quote app data. Your IP address is discarded when a report arrives. Turning it off stops it at once.
Our server reports its own errors to PostHog too, with only the error type and where in the code it happened: never the contents of requests, headers, cookies or IP addresses.
Usage statistics, if you turn them on
Share usage statistics is off by default; the app asks once when you set it up, and you can change it in Profile › Privacy and data. If you turn it on, the app sends which screens you open and which features you use, such as saving a dose (not what was in it), to PostHog, an analytics service, so we can see what to make better. Each event has the screen or feature name, the time, the app version, your phone’s model and system version, and a random ID that is not linked to you or to an account. Compound names, doses, injection sites, symptoms, measurements, notes, AI questions and anything you typed are never sent, and your IP address is discarded when it arrives. Turning it off stops it at once.
Apple Health and Health Connect
If you allow it, Pepello reads your weight from Apple Health or Health Connect, and only when you tap Import. It reads nothing else and never writes to either. Imported readings are stored on your phone like any other measurement. They are not sent to us or anyone else, not included in AI questions, and never used for advertising or sold. You can remove Pepello’s access in your phone’s Health or Health Connect settings at any time.
Reminders
Reminders are scheduled on your phone. There is no push server and we don’t collect a notification token. By default the lock screen shows only “Pepello reminder”.
Home-screen widgets
If you add a Pepello widget, the app works out its text on your phone and keeps it in storage that only the app and its widget can read. It is never sent anywhere. By default a widget shows only times and whether a dose is due or logged; it names the compound only if you turn on Show compound names in widgets, and it never shows an amount.
Links you open
Guides and AI answers link to their sources, such as FDA labels and research papers. Opening one takes you to that website, which has its own privacy policy.
This website
This website uses Google Analytics, loaded through Google Tag Manager, to count visits and see which pages people find useful. It records the pages you view on this website, how you arrived (such as a search or a link), your browser and device type, and your approximate location from your IP address, and it sets cookies so visits can be told apart. Google receives this underits privacy policy. The app sends nothing to Google Analytics. Our hosting provider keeps standard server logs, such as IP address and pages requested, to run and secure the site. If you email us, we use your email only to reply. The dose calculator works entirely in your browser: the numbers you type are never sent to us, to Google or anyone else, and never saved. If you pick a light or dark theme, your browser remembers that choice on your device; it is never sent to us.
What we never do
- We never sell your personal or health data, or share it with data brokers.
- We never use it for advertising, and the app has no ad or attribution SDKs.
- We never send your health data, such as doses, compounds or symptoms, to an analytics service.
- We never track you across other companies’ apps and websites.
- We never use Apple Health or Health Connect data for anything but showing it back to you.
Who helps us run Pepello
| Provider | What for | What it receives |
|---|---|---|
| Anthropic | Writing the AI assistant’s answers | Your conversation, and your records summary if that switch is on |
| PostHog | Usage statistics and crash reports | Screen and feature names with a random ID, only if you turn usage statistics on; scrubbed crash details, only if you turn crash reports on; our server’s own errors |
| Apple and Google | Sign in with Apple or Google | What you share with them when you sign in, and a request to revoke access when you delete your account |
| Google Analytics | Counting visits to this website | Pages you view on this website, how you arrived, your browser and device, and approximate location, with a cookie ID; nothing from the app |
| Our cloud hosting and database providers | Running our server, its database and this website | Requests passing through, and your account if you have one |
We may also disclose information if the law requires it, and only what it requires.
How long we keep it
- On your phone: until you delete it, or delete the app.
- Conversations: not kept by us.
- Your account: until you delete it. Deleting it removes it from our database at once.
- Crash reports: not linked to you or an account; deleted automatically by PostHog after its retention period.
- Usage statistics: not linked to you or an account; deleted automatically by PostHog after its retention period.
Your choices and rights
- Export: Profile › Export my data saves a file with everything Pepello stores on your phone.
- Delete on your phone: Profile › Delete all my data erases your log, settings and photos, cancels reminders and disconnects Health Connect.
- Delete your account: Profile › Delete account. See how to delete your account, including without the app.
- AI records: turn off Profile › Send my records with chat questions.
- Crash reports: Profile › Send crash reports, off by default.
- Usage statistics: Profile › Share usage statistics, off by default.
Depending on where you live, including California, Washington, the UK and the EU, you may have the right to access, correct, delete or get a copy of your personal data, to withdraw consent, and to complain to a regulator. Since almost everything is on your phone, the app’s own controls cover most of this. For anything else, email privacy@openskyelabs.xyz; we answer within 30 days and never treat you differently for asking.
If something goes wrong
If personal health information is accessed or shared without authorization, we will tell the people affected, and the Federal Trade Commission where its Health Breach Notification Rule applies, without unreasonable delay and within 60 days.
Age
Pepello is for adults 18 and over, and asks you to confirm this before you start. We don’t knowingly collect data from anyone younger.
Where data is processed
Our server and our providers are based in the United States. If you use Pepello from elsewhere, AI questions and any account data are processed there.
Changes to this policy
When we change this policy, we update the date at the top. If a change affects what leaves your phone, the app will tell you before it happens.
Contact
OpenSkye Labs, privacy@openskyelabs.xyz.