Privacy Policy
Last updated: 2026-10-16
This Privacy Policy explains how Optimized Human LLC ("we", "us", "our") collects, uses, shares, and protects your personal information when you use OptimizedHuman and related applications (the "Service"). It applies to all users of the Service, globally. By using the Service you acknowledge the practices described here.
1. Information We Collect
Information you provide directly.
- Account information — email address, password (stored as a salted hash; never in plain text), display name, and optional profile fields such as time zone.
- Content you create — protocols, schedules, dose logs, injection-site coordinates, inventory entries, reconstitution parameters, wellness notes, weight logs, progress photos you choose to upload, comments, and any protocol you choose to share publicly or via link.
- Payment information — handled by Stripe. We receive a customer identifier, subscription status, billing interval, and limited billing metadata. We do not store full payment card numbers on our servers.
- Support and communications — anything you send us by email, in-app messages, or social channels.
Photo metadata (optional). When you choose to opt in during upload, we also store metadata extracted from your progress photos — the date and time the photo was taken and its approximate location (derived from the photo's GPS data) — to arrange your photos on a timeline. This is off by default and only applies to photos you explicitly opt in for.
Information collected automatically.
- Usage data — pages visited, features used, in-app events, browser and operating-system type, device identifiers, approximate IP-based location, session timestamps.
- Server logs — request URLs, response status, timestamps, IP addresses (hashed or truncated where feasible) — retained for security, abuse detection, and debugging.
- Cookies and similar storage — essential cookies and local storage for authentication and session management; Vercel Analytics for aggregate traffic measurement; a functional cookie (
oh_region) that records only whether your country requires your consent before the tags below load, derived from your IP address and never stored by us; and cookies that remember your privacy choices (oh_consent,oh_optout). - Product analytics — inside the web and mobile apps, after you sign in, we use PostHog to understand how the app is used: which screens are opened, which features are started and finished, crash reports, and whether people who try a feature keep using it. Each event is tied to a random account identifier and carries only the screen's general address (for example "/peptides/[id]", never the actual record), simple counts and categories, your subscription tier, platform, app version and the date you signed up, plus standard device details (operating system, browser and screen size). We have PostHog discard your IP address and do not derive your location from it. We never send PostHog your name, email address, compounds, doses, schedules, injection sites, lab results, photos, notes or messages to the assistant, and we do not record your screen. PostHog processes this data only on our behalf; it is not shared with advertisers. If you are in the European Union, the wider European Economic Area, the United Kingdom, Switzerland, or the US states of California, Connecticut, Nevada or Washington, product analytics stays off unless you turn it on. Everywhere else it is on unless you turn it off, and Global Privacy Control switches it off in the web app. You can change it at any time in the app under Profile → Privacy → Share anonymous usage analytics.
- Push notification identifiers — if you enable push notifications on mobile, we store the device token required to deliver them.
Information from third parties.
- OAuth providers — if you sign in with Google, Apple, or similar, we receive the email address and basic profile the provider shares per your consent.
- Stripe — subscription events (created, renewed, cancelled, failed), billing metadata, and fraud signals.
Sensitive-data note. Some content you enter may be considered sensitive personal data under certain laws (for example, information about medical conditions or biometric weight data). We treat this data with the same security controls described in Section 6 and do not use it for any purpose other than providing the Service to you.
2. How We Use Your Information
We use your information to:
- Operate, maintain, develop, and improve the Service and its features;
- Authenticate your account and safeguard the Service against fraud, abuse, and security threats;
- Process payments, provide receipts, and manage subscriptions (via Stripe);
- Send operational emails — such as password resets, receipts, security alerts, and important Service announcements — that you cannot opt out of while you have an active account;
- Send a short series of "Getting started tips" emails during your first two weeks, which explain features you have not used yet and stop early for anything you have already done; you can turn them off at any time in the Email section of your profile, or with the unsubscribe link in any of these emails;
- Send occasional "Product news & offers" emails about new features and member offers. The sign-up screen has a box for them that you can tick or untick before you create your account: if you sign up in the United States it starts ticked; everywhere else — including the European Union, the wider European Economic Area, the United Kingdom and Switzerland — it starts unticked, and we send them only if you tick it or turn them on later. Accounts created before October 2026 receive them only if they opted in. You can turn them off at any time in the Email section of your profile, or with the one-click unsubscribe link in any of these emails;
- Respond to support inquiries and communications;
- Detect, investigate, prevent, and respond to fraud, abuse, chargebacks, and violations of our Terms;
- Conduct aggregate, anonymized analytics to understand usage patterns and inform product decisions;
- Measure the performance of our advertising, using the tags described in Section 1 — only with your consent in the EU, EEA, UK, Switzerland, California, Connecticut, Nevada and Washington, and elsewhere unless you opt out;
- Comply with legal obligations, respond to lawful requests from authorities, and enforce our rights.
Email. We send email through Resend. Emails contain no health information — no compound names, doses, schedules or lab results — only links into the app, where you sign in to see your data. We do not use open or click tracking: our emails contain no tracking pixels and their links are not rewritten. You can't turn off account and security emails (such as verification codes and password resets) while you have an account. If an address has bounced or been reported as spam, we keep a one-way hash of it and stop emailing it — including security emails — until you contact us at support@optimizedhuman.app to restore it. When you delete your account we remove your email address from our record of the emails we sent you.
Legal bases (for users subject to GDPR or UK GDPR): contract performance (operating the Service you signed up for), legitimate interests (security, fraud prevention, product improvement), consent (optional marketing, optional cookies), and legal obligations (tax, anti-fraud, responses to authorities). You can withdraw consent at any time where consent is the legal basis; withdrawing consent does not affect processing done before withdrawal.
We do not use your content to train public or third-party AI models. If in the future we offer AI features that process your content, we will do so to deliver the feature to you, disclose it clearly, and seek consent where required.
3. How We Share Your Information
We do not sell your personal data for money. We share information only as described below.
Analytics and advertising partners.
- Google (Google Tag Manager, Google Analytics) and Reddit (Reddit Pixel) receive the information described under Analytics and advertising tags, from our marketing website and our sign-up and log-in pages only. They process it under their own terms and privacy policies and may use it for their own purposes, including measuring and improving their advertising services. Under some U.S. state privacy laws, this may count as "selling" or "sharing" personal information for cross-context behavioral (targeted) advertising. You can opt out as described in Your privacy choices.
Service providers (subprocessors) we use to operate the Service:
- Supabase — database hosting and authentication (United States);
- Stripe — payment processing and subscription management (United States);
- Vercel — web application hosting, analytics, and Core Web Vitals (United States / global edge);
- Railway — backend API hosting (United States);
- Sanity — content management for editorial content (global);
- Expo / EAS — mobile build and push-notification infrastructure (United States);
- PostHog — product analytics and crash reporting inside the apps, as described under Product analytics; no health information is sent (United States);
- Resend — email delivery: verification codes, password resets, security alerts and the optional emails described in Section 2. Resend keeps delivery logs (recipient address, subject and delivery status) for a limited period under its own retention policy (United States);
Each provider is contractually obligated to process personal data solely to provide its service to us and in accordance with applicable law. A current list of subprocessors is available on request at privacy@optimizedhuman.app.
Other sharing.
- Public protocols. When you choose to share a protocol publicly or by link, the content you marked shareable (title, compounds, schedule, and your display name) becomes visible to anyone with the link or to all users for public protocols. Do not publish content you want kept private.
- Legal requirements. We may disclose information where we believe in good faith it is necessary to comply with a law, regulation, legal process, subpoena, or governmental request, or to protect our rights, safety, or property, or the rights, safety, or property of our users or the public.
- Business transfers. If we are involved in a merger, acquisition, restructuring, bankruptcy, or sale of assets, your information may be transferred to the successor entity, subject to a privacy policy at least as protective as this one.
- With your consent. For any other purpose disclosed to you and to which you consent.
4. Data Retention
We retain your account and associated data while your account is active and for up to ninety (90) days after account deletion to allow recovery from accidental deletion and to complete fraud-prevention reviews. After that period we delete or anonymize personal data, except where longer retention is required by applicable law (for example, tax and financial records, which we retain for up to seven (7) years per standard accounting practice).
Server logs are retained for up to ninety (90) days. Anonymized, aggregated analytics may be retained indefinitely. Payment records are retained by Stripe per its policies and applicable law.
Our record of emails sent to you (which email, when, and whether it was delivered) is kept while your account is active; on account deletion the address is removed from it.
5. International Data Transfers
Our infrastructure is primarily located in the United States. By using the Service you understand that your personal data may be transferred to, processed in, and stored in the United States or other countries where our providers operate. Where required by law, we rely on Standard Contractual Clauses, the EU–U.S. Data Privacy Framework (where applicable), the UK International Data Transfer Addendum, or equivalent safeguards to protect such transfers.
6. Security
We use industry-standard safeguards to protect your information, including TLS encryption in transit, encryption at rest for database storage, salted password hashing, least-privilege access controls, principle-of-least-privilege API keys, audit logs, and regular security review. Payment data is processed by Stripe, which is PCI DSS Level 1 certified; we do not store card numbers on our servers.
No method of transmission or storage is perfectly secure. We cannot and do not guarantee absolute security. If you have reason to believe your account has been compromised, contact us immediately at security@optimizedhuman.app.
7. Your Rights
Depending on your jurisdiction, you may have some or all of the following rights:
- Access the personal data we hold about you;
- Correct inaccurate or incomplete data;
- Request deletion of your account and associated personal data;
- Object to or restrict certain processing;
- Receive your personal data in a portable, machine-readable format (where technically feasible);
- Withdraw consent for optional processing, such as marketing emails;
- Lodge a complaint with your local data-protection authority.
Self-service data export is not yet available. To exercise any of the rights above, email privacy@optimizedhuman.app from the address associated with your account. We will respond within thirty (30) days (or as required by applicable law). We may need to verify your identity before fulfilling the request.
California residents (CCPA/CPRA). You have the right to know what personal information we collect, the right to delete personal information, the right to correct inaccurate personal information, the right to limit the use of sensitive personal information, and the right to opt out of the "sale" or "sharing" of personal information. We do not sell personal information for money, but the analytics and advertising tags described in Section 1 may be a "sale" or "sharing" of personal information for cross-context behavioral advertising. Visitors in California see these tags only after accepting them in our cookie banner, and can withdraw that consent at any time below, which also serves as the opt-out. We do not use or disclose sensitive personal information — including the health information you enter in the Service — for advertising, and we do not knowingly sell or share the personal information of anyone under 16. Residents of other U.S. states with similar laws have the same right to opt out of targeted advertising, and the same controls apply to them.
Your privacy choices
In the European Union, the wider European Economic Area, the United Kingdom and Switzerland, and in the US states of California, Connecticut, Nevada and Washington, Google Analytics and the Reddit Pixel stay off unless you accept them in the cookie banner, which appears on your first visit. You can withdraw your consent at any time, as easily as you gave it, with the control below; withdrawing does not affect anything collected while you had consented.
Everywhere else, you can opt out of the sale or sharing of your personal information — which switches off Google Analytics and the Reddit Pixel on this website and on our sign-up and log-in pages — in any of these ways:
- Turn on Global Privacy Control in your browser or a browser extension. We treat it as an opt-out request for that browser, with no further step needed, wherever you are.
- Use the control below. It saves your choice in a cookie in this browser, so you will need to repeat it on another browser or device, or if you clear your cookies. Consent answers are kept for six months, after which we ask again.
- Email privacy@optimizedhuman.app.
Checking this browser's current choice… If nothing appears, you can also opt out by turning on Global Privacy Control in your browser, or by emailing privacy@optimizedhuman.app.
Product analytics inside the apps is a separate setting, saved to your account so it applies on every device: open the app and go to Profile → Privacy → Share anonymous usage analytics. See Product analytics for what it covers.
We do not discriminate against you for exercising any of these rights.
8. Children's Privacy
The Service is not intended for individuals under 18, and we do not knowingly collect personal information from minors. If you believe a minor has provided us personal data, please contact privacy@optimizedhuman.app so we can delete it.
9. Not Covered Entities
We are not a covered entity, business associate, or health information exchange under the U.S. Health Insurance Portability and Accountability Act (HIPAA), and the Service is not designed to be a HIPAA-compliant system. Do not enter, upload, or transmit protected health information (PHI) that requires HIPAA protection through the Service. Similar considerations apply to equivalent laws in other jurisdictions.
10. Third-Party Links and Services
The Service may contain links to third-party sites or services (for example, research articles cited in the peptide catalog). We are not responsible for the content, privacy practices, or terms of those third parties. Review their privacy policies before using them.
11. Changes to This Policy
We may update this policy from time to time. Material changes will be announced via the Service or by email before they take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.
12. Contact
Privacy questions and rights requests: privacy@optimizedhuman.app
Security reports: security@optimizedhuman.app
Mailing address: 30 N Gould St, STE R, Sheridan, WY 82801, USA