Privacy Policy

1. Who we are

This policy describes the practices of EditPep, the independently operated educational tracking service at editpep.app. References to “we,” “us,” and “our” mean the operator of EditPep. For privacy questions or requests, email support@editpep.app.

It covers our website, account tools and support communications. External services you choose to visit have their own policies. Our Terms & Conditions explain use of the service, subscriptions and refunds.

2. Information we handle

Account information. Your email address, account identifier, registration date, password verification data, email verification status, sign-in preference and session records. We store a salted password hash, not a readable copy of your password. Your profile can also include a display name, birth date and preferred measurement units.

Information you choose to record. Weight, waist size, glucose, blood pressure, heart rate, heart-rate variability, mood, pain, calories, dates and notes. Saved protocols include compound names, amounts, routes, timing, dose changes, titration phases and related estimates or saved history. These records and the projections derived from them can reveal sensitive health information. Only enter information you want the service to process.

Billing information. Membership status and history, payment-provider identifiers, subscription status, invoices and paid-through dates. Stripe collects payment details in its checkout and billing portal. EditPep does not receive or store your full card number or card security code.

Support and technical information. Messages you send us, plus request and device information needed to deliver and protect the site, such as IP address, browser information, request time, requested page and error or security events. Cloudflare processes connection and challenge information for hosting and abuse prevention. We do not request your device’s precise location.

3. How we use it

We use information to create and secure your account; save, display and export your records; calculate the educational charts and projections you request; manage subscriptions; answer support requests; investigate errors or misuse; and meet applicable legal obligations.

We send verification codes, password-recovery messages, security notices and a welcome email through our email provider. These account emails do not include your health measurements or saved medication schedules. A verification email is necessary to finish signup; it is not enrollment in a marketing mailing list.

We do not sell personal information, use health logs for targeted advertising, or place advertising pixels in the account tools. Health records are processed to provide the features you choose, rather than to make employment, insurance or credit decisions.

4. Service providers & disclosure

Cloudflare hosts and delivers EditPep, stores account and saved-record data in its database service, and supplies security protections including Turnstile. That means Cloudflare processes the account and health data needed to run the service. Cloudflare privacy policy.

Resend delivers account emails. It processes recipient addresses, message content and delivery information. Our support mailbox and email-routing providers also process messages you send us. Resend privacy policy.

Stripe processes checkout, payments, subscriptions, invoices, fraud prevention and the billing portal. Our integration sends an account reference and subscription information; it does not send your health logs or compound schedules as payment metadata. Information you enter directly into Stripe is handled under Stripe’s privacy policy.

The operator and authorized service providers may access information as needed to operate, secure or support EditPep. Account privacy does not mean that records are inaccessible to the operator or hosting provider. We may also disclose information when legally required or reasonably necessary to investigate fraud, protect rights or respond to a security incident. If ownership of the service changes, we will notify you of material changes to how your information is handled.

5. Cookies & browser storage

EditPep uses an essential session cookie to keep you signed in. It is marked Secure, HttpOnly and SameSite. Cloudflare and Stripe may use cookies or similar technologies for their security and payment features.

If you hide the homepage introduction, a preference cookie remembers that choice in this browser for up to one year. The introduction video is hosted by EditPep and plays only when you choose to play it.

We also use browser storage for preferences such as theme, sign-in method and measurement shortcuts. Local calculator or legacy local-workspace data may be stored in your browser separately from account records. Clearing browser storage removes those local settings or records and can sign you out; it does not delete records saved to your online account. Deleting your account does not automatically remove every local copy on every device.

You can manage cookies and site storage in your browser. Blocking essential storage may prevent sign-in or some features from working.

6. Sharing your progress

Sharing is optional. A progress card can include starting and ending measurements, the change between them, dates and elapsed time. Check the preview and its settings before sharing or downloading.

We do not automatically publish your records to social media. When you send a card through your device’s sharing options or upload it yourself, the selected recipient or platform receives that copy. Their privacy settings and policies apply. Deleting your EditPep account will not delete downloaded cards, screenshots or copies held by other people.

7. Retention & deletion

We keep saved account records while your account remains active so you can return to them. Canceling a subscription does not delete your account or records. Verification and session credentials expire; expiration alone does not necessarily mean every related technical record is immediately erased.

Successful account deletion removes the account and its linked profile, measurements, saved protocols, protocol snapshots, sessions and membership records from the active application database. The deletion process first checks billing and cancels active subscriptions. If that cannot be completed, the account is retained and the app asks you to resolve the issue. Export anything you wish to keep before deleting.

Deletion is not an instant erasure from every system. Backups, security and verification records, support correspondence, and records required for legal, accounting or dispute purposes may remain for their applicable retention periods. Stripe retains its own customer and transaction records; deleting an EditPep account does not itself delete those Stripe records. We limit retained information to the purpose for which it is needed. Contact us for help with a broader deletion request, including provider-held copies where applicable.

8. Your choices & requests

Use your account tools to review or edit saved records. In Profile, you can export account data and delete your account after confirming your password. These controls remain available without a paid membership.

You can also email support@editpep.app to request access, correction or deletion, withdraw a consent where processing relies on consent, or ask about the information we hold. Use “Privacy request” in the subject and describe your request. Please do not send passwords, verification codes, full card details or unnecessary medical information.

We may need to verify your identity before acting on a request. Depending on where you live, you may have additional rights to a copy of your information, to restrict or object to processing, to appeal a decision about a request, or to complain to a privacy regulator. Contact us to exercise a right or appeal our response. We respond as required by applicable law and explain any limits or information we must retain. We do not penalize you for exercising applicable privacy rights.

9. Security & processing locations

We use HTTPS, password hashing, protected session cookies, account-scoped access checks and abuse controls. No online service can guarantee absolute security. Protect your password and devices, and contact us if you suspect unauthorized access.

Our service providers may process information in the United States and other countries where they operate. Their infrastructure and applicable safeguards govern those transfers; we do not promise that all records remain in one country.

EditPep is an educational tracking tool, not a healthcare provider. This policy is not a claim of HIPAA certification or a guarantee that the service meets a clinician’s regulated recordkeeping requirements.

10. Adults only

EditPep is intended for people 18 or older. We do not knowingly collect personal information from children. If you believe a child has provided information, contact us so we can investigate and arrange appropriate deletion.

11. Changes & contact

We will update the effective date when this policy changes. For material changes, we will provide a notice on the site or by email and obtain consent when required, before using information in a new way that requires it.

Questions about your records or this policy? Write to support@editpep.app.