Privacy Policy

Outsourced CTO (Pty) Ltd t/a Online Peptide (“Online Peptide”, “we”, “us”) operates the Online Peptide mobile app and the website at onlinepeptide.store. We are the responsible party (data controller) for the personal information described here. We process personal information in line with South Africa’s Protection of Personal Information Act (POPIA), and we honour equivalent rights for users in other regions.

We only collect what the product needs to work:

• Account information. When you sign in with Apple, Google, or email, we receive your name and email address. You can also use the app anonymously, without an account.
• Health & tracking data you enter. Injection/dose logs, body-weight entries, goals, protocols and any notes you add. This is data you choose to record; it is used only to power your own dashboard and history.
• App activity. In-app actions such as course/learning progress and your settings, so the app can remember your preferences.
• Purchases (website store). If you place an order, we process your order details and shipping/contact information. Card payments are handled by our payment processor — we do not receive or store your full card details.
• Technical data. A device/installation identifier assigned by our backend, plus standard server and security logs (e.g. IP address, timestamps) generated by our hosting and content-delivery providers.

We do not use third-party advertising SDKs or third-party analytics/tracking SDKs in the app, and we do not collect your location, contacts, photos, or advertising identifiers.

• Provide the core service — sync your profile, tracking data and history across your devices.
• Fulfil and support store orders you place on the website.
• Maintain security, prevent abuse, and keep the service reliable.
• Respond to your support requests.
• Comply with legal, accounting and tax obligations.

We do not sell your personal information, and we do not use your health-tracking data for advertising.

We share personal information only with the processors that run the service on our behalf, under contract and only as needed:

• Google Firebase — authentication, database and app infrastructure (stores your account and tracking data).
• Railway & Cloudflare — website hosting and content delivery / security.
• Payment processor (PayFast) — processes store payments; we never see your full card data.

We may also disclose information where required by law, or to protect our rights, users, or the public.

Your data is transmitted over encrypted connections (TLS) and stored in access-controlled infrastructure. Access to your account and tracking data is restricted to you — enforced by server-side security rules that deny access to anyone but the owning account.

We keep your account and tracking data for as long as your account is active. When you request deletion, we remove it as described in our Data & Account Deletion policy. We may retain limited order records for as long as required by tax and accounting law.

Subject to applicable law, you can:

• Access the personal information we hold about you.
• Correct information that is inaccurate or out of date.
• Delete your account and associated data.
• Export a copy of the data you have entered.
• Object to or restrict certain processing.

To exercise any of these, email [email protected]. See the deletion policy for how to remove your data.

Online Peptide is intended only for adults aged 18 and over. It is not directed to children, and we do not knowingly collect personal information from anyone under 18.

Our providers may process data on servers outside your country. Where that happens, we rely on providers that apply appropriate safeguards for international transfers.

We may update this policy from time to time. Material changes will be reflected by the “Last updated” date above and, where appropriate, communicated in the app or on the website.

Questions or requests? Email [email protected].