Pepmax
← Back to home

Privacy Policy

Last updated: July 3, 2026

This policy explains what Pepmax collects, why, who we share it with, and the choices and rights you have. Pepmax is a personal logbook — built to be useful to you, not to put your data on display.

1. Who we are

The Pepmax mobile app and website (the “Service”) are provided by Viral Ventures Enterprises LLC, a limited liability company with its registered address at 8 The Green, Ste B, Dover, DE 19901, USA (“Pepmax”, “we”, “us”).Pepmax is the controller of the personal data described here. For any privacy question or request, contact support@getpepmax.com.

2. Information we collect

Information you provide

  • Account details — your email address and name, handled through our authentication provider.
  • Profile & onboarding — information you choose to enter, such as a display name, goals, and experience level.
  • Your logs — the records you create: protocols, doses, vials, cycles, daily check-ins (for example energy, sleep, and soreness), and notes. Some of this is health-related information you choose to record about yourself.
  • Support communications — messages you send us.

Information collected automatically

  • Subscription status — whether you have an active plan, via our payments partner. We do not receive your full card details.
  • Usage & device data — basic product-analytics events, app version, device and operating-system type, and similar diagnostics.
  • Crash & error logs — technical data when something goes wrong, to help us fix it.

We do not collect precise geolocation, and we do not use third-party advertising trackers.

3. How we use your information

  • to provide the core features — logging, the reconstitution calculator, and cycle tracking;
  • to authenticate you and keep your account secure;
  • to process and manage your subscription;
  • to diagnose problems, prevent abuse, and improve the Service; and
  • to respond to support requests and send you essential service messages.

We do not sell your personal information, and we do not use your logs to give medical or dosing advice (see our Disclaimer & Safety).

4. Legal bases for processing (EEA / UK)

If you are in the European Economic Area or the UK, we rely on these legal bases:

  • Performance of a contract — to provide the Service you sign up for.
  • Legitimate interests — to secure, maintain, and improve the Service, where not overridden by your rights.
  • Consent — for optional analytics and any processing of health-related data you choose to record; you may withdraw consent at any time.
  • Legal obligation — to comply with applicable law.

5. Health and sensitive information

Some information you log is health-related (for example your daily energy, sleep, and soreness check-ins and your dosing logs) and may be considered “special category” data (GDPR) or “sensitive personal information” (CPRA). We process it only to provide the features you use, based on your consent. The health and fitness data you enter is linked to your account so we can show it back to you, but it is never sold, never shared for cross-context behavioral advertising, and never used to track you across other apps or websites. We do not use it to build advertising or marketing profiles or to make inferences about you, and we apply additional care to how it is stored and accessed. This is consistent with how the Service is declared on the App Store’s privacy label.

6. Cookies, analytics & tracking technologies

Our website uses essential cookies and similar storage to function, and privacy-respecting product analytics to understand usage. The app uses analytics and crash-reporting SDKs for the same purposes. We do not use advertising or cross-site tracking technologies. You can control cookies through your browser settings; disabling some may affect functionality.

7. How we share information

We use trusted service providers to run Pepmax. Each processes data only as needed and under contract:

  • Authentication — Clerk (identity & account management: your email and name).
  • Database hosting — MongoDB Atlas (secure storage of the logs you create).
  • App & website hosting — Render and Vercel (our back-end API and website).
  • Payments & subscriptions — the Apple App Store, Google Play, and RevenueCat (subscription status and purchase history; we never receive your full card details).
  • Product analytics — PostHog (product-usage events and diagnostics).
  • Crash reporting — Sentry (crash and error diagnostics).
  • Media storage / CDN — Bunny (any images you choose to upload).

Each provider acts as our processor (or, for the app stores, as an independent controller of payment data under its own policy) and handles your data only as needed to deliver these functions. We do not authorize any of them to use your health-related logs for their own purposes.

We may also disclose information to comply with law, enforce our terms, or protect the rights and safety of our users. If we are ever involved in a merger or acquisition, we will require the successor to honor this policy.

8. Data retention

We keep your data for as long as your account is active. When you delete your account, we delete or de-identify your personal data, except where we must retain limited records to meet legal, tax, or security obligations.

9. Security

We use industry-standard measures to protect your information, including encryption in transit and access controls. No system is perfectly secure, but we work to keep your data safe and to limit who can access it.

10. How to access and control your data

You stay in control of your information. Depending on where you live, you may have the right to:

  • Access & export — review your history and export your data from the app’s Settings.
  • Correct — edit your profile and entries at any time.
  • Delete — permanently delete your account and data from the app’s Settings.
  • Object or restrict — object to or limit certain processing.
  • Withdraw consent — where we rely on consent, withdraw it without affecting prior processing.
  • Portability — receive your data in a portable format.

To exercise any right, use the in-app tools or email support@getpepmax.com. We will not discriminate against you for exercising your rights, we may need to verify your identity first, and you may use an authorized agent where permitted.

California residents (CCPA / CPRA)

If you are a California resident, you also have the rights to know, delete, correct, opt out of the “sale” or “sharing” of personal information, and limit the use of sensitive personal information. For transparency:

  • Categories we collect — identifiers (e.g. email, name); account and profile information; the health-related logs you create (sensitive personal information); commercial information (subscription status); and internet/usage and device activity.
  • Sources — directly from you, from your device, and from our service providers.
  • Purposes — to provide, secure, and improve the Service, as described above.
  • Disclosure — we disclose information to the service providers listed in Section 7 for those business purposes only.
  • We do not sell or share your personal information for cross-context behavioral advertising, and we do not use sensitive personal information beyond providing the Service.

11. Marketing communications

We primarily send essential service messages. If we ever send promotional messages, you can opt out using the unsubscribe link or by contacting us. Opting out does not stop essential account and transactional messages.

12. Automated decision-making

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects about you. The reconstitution calculator performs arithmetic on the values you enter and does not make decisions for you.

13. Children

Pepmax is intended only for adults aged 18 and older, and is not directed to children. We do not knowingly collect personal data from anyone under that age. If you believe a child has provided us information, contact support@getpepmax.com and we will delete it.

14. International data transfers

Your information may be processed in countries other than your own, including the United States, which may not provide the same level of data protection as your home country. Where required, we use appropriate safeguards (such as the European Commission’s standard contractual clauses) for such transfers. If you are in the EEA or the UK, you can raise any data-protection question or request with us directly using the contact details in Section 17.

15. Complaints

We’d like to resolve any concern directly — please contact us first. If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection supervisory authority.

16. Changes to this policy

We may update this policy; the “Last updated” date above reflects the latest version. We will communicate material changes where appropriate.

17. Contact

Questions or requests? Email support@getpepmax.com, or write to Viral Ventures Enterprises LLC at 8 The Green, Ste B, Dover, DE 19901, USA. We have not appointed a Data Protection Officer; all privacy inquiries go to the email above.