Privacy Policy

Effective date: May 7, 2026 · Last updated: May 18, 2026

OnePin ("we", "us", "our") is a peptide and supplement protocol tracking app operated by James Lee. This policy explains what we collect, why, and your rights.

1. Information We Collect

Account Information

Email address - required to create your account, sign in, and receive critical account notices.
Authentication tokens - issued by Apple, Google, or our email magic-link provider when you sign in.

Protocol & Inventory Data

The peptides, supplements, doses, schedules, and inventory you enter into the app.
Dose log entries (timestamps, amounts, body sites, notes) you record.
Compound preferences and household member configurations.

Subscription & Payment Information

If you subscribe via the web, payment is processed by Stripe. We receive your subscription status and a Stripe customer ID. We do NOT store your card number, CVC, or full billing details.
If you subscribe via iOS, payment is processed by Apple In-App Purchase. We receive a transaction receipt that we use to verify your subscription.
If you subscribe via Android, payment is processed by Google Play Billing. We receive a subscription receipt for verification.

Device & Usage Information

Basic technical info (device type, OS version, app version) when you submit a bug report.
Crash reports auto-attached to bug submissions.
We do NOT use third-party analytics, advertising trackers, or cross-app tracking.

Health Data (HealthKit / Health Connect)

If you opt in to Apple HealthKit or Android Health Connect integration, we read selected metrics (e.g., HRV, sleep, weight) to display alongside your protocols.
Health data is stored locally on your device and (if you enable cloud sync) in your encrypted Supabase row. We do NOT share, sell, or use it for advertising.
You can revoke health data access at any time via your device's Health app settings.

2. How We Use Your Information

Provide the core tracking, scheduling, and reminder features of the app.
Sync your data across your devices when you sign in.
Verify your subscription status and grant access to paid features.
Respond to bug reports, feature requests, and support inquiries.
Send service-critical emails (account changes, subscription notices). We do NOT send marketing emails without your explicit opt-in.

3. Third-Party Services

OnePin shares minimum-necessary data with these processors:

Supabase (database, auth, storage) - stores your account, encrypted protocol data, and uploaded photos.
Stripe (web payments) - processes subscriptions and stores billing data per its own privacy policy.
Apple / Google (mobile in-app purchases) - process iOS / Android subscriptions per their respective policies.
Anthropic and OpenAI (AI features, opt-in) - if you enable an AI insight, the data being analyzed is sent to the AI provider you select (Anthropic or OpenAI) using your own API key to generate a summary. Depending on the feature this may include your protocol and compound names, dose history, lab and biomarker entries, adherence statistics, and connected Apple Health metrics. OnePin asks for your explicit consent before any data is sent, and the request is processed under the selected provider's own privacy policy. AI features are optional and run only when you trigger them.
Cloudflare Email Routing - forwards support@onepin.app messages to our team.

We do NOT sell your data to anyone, ever.

4. Data Storage & Security

Data at rest is encrypted on Supabase's infrastructure (AES-256).
Data in transit uses TLS 1.2+ over HTTPS.
Row-level security policies ensure each user can only read and write their own records.
We use industry-standard authentication (OAuth 2.0 + JWT) for all account access.

5. Your Rights

Access - export all your data as JSON or CSV via Settings > Data > Export.
Delete - delete your account and all associated data via Settings > Account > Delete Account, or by emailing support@onepin.app.
Correct - edit any data directly in the app.
Portability - JSON export covers all your protocols, inventory, dose logs, and settings.
Withdraw consent - revoke optional integrations (HealthKit, AI helper) at any time.

If you are an EU/UK/California resident, you have additional rights under GDPR/CCPA, including the right to lodge a complaint with your local data protection authority.

6. Children's Privacy

OnePin is intended for adults aged 21 and older and is not directed to anyone under 21. We do not knowingly collect data from minors. If you believe someone under 21 has created an account, contact us at support@onepin.app and we will remove the account.

7. Data Retention

Account data is retained as long as your account is active.
If you delete your account, all data is removed within 30 days.
Anonymized aggregated metrics (e.g., total user count) may be retained indefinitely; these contain no personal information.

8. International Transfers

Your data may be stored on servers located in the United States or other regions where Supabase operates. By using OnePin, you consent to these transfers. We rely on standard contractual clauses where required.

9. Changes to This Policy

We may update this policy as the app evolves. The "Last updated" date at the top reflects the most recent revision. Material changes will be communicated via in-app notice or email.

10. Contact

Questions or requests? Email support@onepin.app.

OnePin is operated by James Lee. This privacy policy is provided for informational purposes and does not constitute medical advice.