Privacy PolicyWhat Pepstack collects, where it lives, and how to get rid of it.
Last updated 19 August 2026.
Pepstack is a supplement timing and scheduling app for iPhone. It holds information about your body, your health goals and your daily routine, and some of that is sensitive. This policy sets out exactly what is stored, where, who else sees it, and how to delete it. It is written to be specific rather than reassuring.
The controller of this data is Deepak Kumar, established in Virginia, United States. For any privacy question or request, contact Pepstackapp@outlook.com. There is no separate Data Protection Officer, and one is not required at this scale; that same address is the contact point for all data protection matters.
Who can use Pepstack
You must be at least 13 to create an account, or older where the law of the country you live in sets a higher age for consenting to online services — in much of the EU and the UK that age is 16. Pepstack is not designed for children, is not directed at them, and has no verifiable parental consent mechanism. If we learn an account belongs to someone below the applicable age, it will be deleted.
What the app collects
All of it comes from you — from onboarding, from the schedule you build, and from what you record as you use the app. None of it is bought, inferred from third parties, or gathered by tracking you elsewhere.
Account
| Data | Why |
|---|---|
| Email address | Sign-in and account recovery |
| Password | Stored only as a hash by our authentication provider — never in readable form, and not visible to us |
| Display name | Shown to you in the app |
| Account created, last opened | Account housekeeping |
| Subscription tier | Determines what the account can access |
Personal characteristics
These drive which published reference intakes are shown to you. Several are sensitive.
| Data | Notes |
|---|---|
| Age | Selects the right published reference intake band |
| Sex | Male, female, or not stated |
| Menstrual status | Optional. You can leave it blank |
| Dietary restrictions | Vegetarian, vegan, dairy-free and similar |
Health and routine
This is health data. Under UK and EU data protection law it is special category data and is processed only on the basis of your explicit consent, given when you complete onboarding. You can withdraw that consent at any time by deleting your account, which erases all of it.
| Data | Notes |
|---|---|
| Supplements in your stack | Products you have chosen to take |
| Your daily schedule | Includes wake time, sleep time and meal times, so it reveals your routine |
| Every dose, and whether you took it | A timestamped adherence history over time |
| Reasons for skipped doses | Free text you write yourself |
| Adverse reactions | Free text you write yourself |
| Health goals | Skin, sleep, energy, focus, training, immunity, growth |
Progress notes and photos
This is the most sensitive thing Pepstack holds, so it gets its own section rather than being folded into "your content".
If you use progress tracking, the app stores free-text notes, body measurements you enter, and photographs you choose to upload — which may be photographs of your own body. Photos are held in a private storage bucket, in a folder belonging to your account, with access rules that permit only your account to read them. They are never shown to other users, never used for marketing, never used to train anything, and are not sent to the AI assistant. They are deleted when you delete your account.
The camera is only ever opened at your request. The app does not have background access to your photo library.
AI assistant
| Data | Notes |
|---|---|
| Message counts and timestamps | Used only to enforce rate limits |
| Reported answers | Stored only when you press report on an answer, so the question and answer can be reviewed |
| Conversation history | Cached on your device, separated per account, cleared when you sign out or delete your account |
What the app does not collect
Stated plainly because the absence matters as much as the presence:
- No location data of any kind.
- No contacts, calendar or health-app data.
- No microphone access, and no camera access except a photo you take deliberately.
- No advertising identifier, and no advertising. Pepstack shows no ads.
- No device fingerprinting, and no cross-app or cross-site tracking.
- No third-party analytics, attribution or crash-reporting software in the app. There is none. The website is covered separately below.
Your data is never sold, rented, or shared with anyone for their own purposes.
This website
Everything above describes the app. The website you are reading this on collects far less, and it is worth separating the two.
It uses Cloudflare Web Analytics to count pageviews and referrers. It sets no cookies, does not fingerprint your device, and does not follow you to any other site — which is why there is no cookie banner here. What it produces is totals, not profiles, and there is nothing in it that identifies you.
If you would rather not be counted at all, open this link and this browser is left out from then on; this one undoes it. The choice is stored on your device only.
Apart from that and the contact form described above, the website records nothing.
Where it is stored
Everything above lives in Supabase, a hosted Postgres database and file store, in the us-west-2 (Oregon, United States) region. Row-level security is enabled on every table holding user data, with rules that restrict each row to the account that owns it.
Data is encrypted in transit and encrypted at rest by that provider. We will not tell you it is "100% secure", because no system is, and a claim like that would be worth nothing.
Who else it goes to
Four recipients. There are no others, and none of them receive your data for their own purposes.
1. Supabase — database and file storage
Processes everything described above on our behalf, in order to run the app.
2. Anthropic — only when you use the AI assistant
When you send the assistant a message, the request goes to our own server function, which adds context and calls Anthropic's API. What is sent with your message:
- Your question and the recent conversation.
- Your age, sex, dietary restrictions, recorded reactions, goals, current stack, schedule and adherence — so the answer relates to your situation.
What is not sent: your email address, your name, your account identifier, and your progress notes or photos. The context is sent so that the request can be answered, and it is not sent for the purpose of training a model. Anthropic processes it under their own terms as a sub-processor.
3. Apple — only if you subscribe inside the app
A subscription bought inside the app is handled entirely by Apple through in-app purchase. Apple, not us, receives your payment details. We never see your card number.
4. RevenueCat — only if you subscribe
We use RevenueCat to keep track of whether a subscription is active. When you buy or restore a subscription, RevenueCat receives the purchase receipt from Apple, an identifier for your app installation, and basic device and platform information, so it can tell the app what you are entitled to.
RevenueCat does not receive your health data, your stack, your schedule, your progress notes or your photos. It is a sub-processor acting on our instructions.
5. Stripe — only if you pay by card
In the United States the app also offers payment by card, taken on a checkout page hosted by Stripe and opened in your browser. Stripe, not us, receives your card details. We never see your card number on this route either.
What Stripe receives from us is your email address, which plan you chose, and an identifier for your account so that the payment can be matched back to it. Stripe additionally collects what it needs to take the payment and prevent fraud, including your card details, your billing address and your IP address, and handles that under its own privacy policy as well as on our instructions.
Stripe does not receive your health data, your stack, your schedule, your progress notes or your photos.
Links out of the app
Some links take you to a retailer's website, and some of those are affiliate links. Tapping one means leaving Pepstack. The retailer, and the affiliate network that pays the commission, will see that the visit came from us and may set their own cookies. That is their processing, under their own privacy policy, and we do not control it.
We do not send them anything about you. Not your email, not your stack, not your schedule, not your health data, not your notes or photos. All that leaves is the click itself.
How long it is kept
Your data is kept until you delete your account. Nothing expires on a timer and nothing is deleted automatically — a dose you logged in your first week is still there a year later, which is deliberate, because adherence history is only useful over time.
We would rather say that plainly than quote a retention period the app does not actually enforce. If that changes, this section changes with it.
Deleting your account deletes all of it immediately, as described below.
Deleting your account and your data
You can delete your account from inside the app. It is not a request that we process manually and it is not reversible. Deletion removes your sign-in record and cascades through every table described in this policy — profile, stack, schedule, dose history, skip reasons, reactions, progress notes, progress photos, and assistant usage records. Data cached on your device is cleared at the same time.
Your rights
Depending on where you live, you have the right to ask for a copy of your data, to correct it, to delete it, to receive it in a portable form, to restrict or object to how it is used, and to withdraw consent for the health data described above. Withdrawing that consent means deleting your account, because the app cannot function without it.
Make any of these requests at Pepstackapp@outlook.com. If you are in the UK or the EU and you are unhappy with the response, you can complain to your national data protection authority.
Two things this policy will not claim
- Pepstack is not HIPAA compliant, and HIPAA does not apply to it. It is not a healthcare provider, health plan or clearinghouse. Any app claiming HIPAA compliance in this category is misrepresenting itself.
- Pepstack does not provide medical advice. It does not diagnose, treat, cure or prevent anything. See the Terms of Use.
Changes
If this policy changes in a way that materially affects you, you will be told in the app before the change takes effect. The date at the top always reflects the current version.
Contact
Privacy questions and requests: Pepstackapp@outlook.com.