Privacy Policy

1. Controller and contact

PepWay is provided by 55.424.095 ADRIANO KELVIO DA ROCHA DANTAS - ME · CNPJ 55.424.095/0001-62 · Brasil. For privacy questions or to exercise your rights, contact sales@pepway.app. This policy covers the app and pepway.app.

2. Data you provide

The app can store your name, language, preferences, onboarding answers, protocols, medication names, amounts, schedules, dose sites and history, water, weight, body measurements, height, personal goals, manual steps, nutrition, sleep, workouts, symptoms, notes and photos. You choose what to record. Health information is sensitive data. Demo mode uses fictional examples.

Optional referrals and codes

Applying a code sends only the code and platform to verify the campaign. Without an account, the referral stays on this device; when you sign in or create an account during onboarding, we may link the code to the account identifier and referral dates in the Railway infrastructure. The restricted dashboard shows codes, campaigns and counts of referred accounts, without your health records, photos, email or name. Influencers do not receive your personal data. You can remove the code before subscribing, and account deletion removes the association. Technical identifiers derived from network or account are used to limit abuse, with old counters purged on the next request. The influencer dashboard shows only aggregate totals for their own codes: activated accounts, current trials, active subscriptions confirmed by the stores and pending checks. Verification reads commercial subscription status from RevenueCat without using health records. To prevent duplicate bonus credit, the first code applied to an account determines referral credit even if the promotional code is later changed or removed. Links from before this implementation are included as an opening balance without reconstructing past events. Account deletion removes the link and account from totals. Influencer registration uses name and email for authentication, invitations and campaign assignment; removing portal access does not delete the personal account.

Optional onboarding statistics

In versions with this feature, you may allow counts of visited steps, continues, skips and completion from the opening screen. This choice is separate from campaign measurement. Events are sent only after you allow them; earlier steps are not reconstructed. Railway receives a random identifier for this entry on the device, platform, flow version, steps and actions. We do not send answers, health data, referral codes, photos or contacts, or link the identifier to your account, RevenueCat or AppsFlyer. The restricted dashboard shows aggregate totals. Resuming counts in the same entry; another device may count separately. Collection stays off until made available in an update.

You may turn off and erase these events in Privacy and data. The local queue stops immediately; remote deletion needs internet and retries when the app can connect. Erasing this device’s data or deleting the account through the app also requests deletion. Because the identifier is not linked to the account, a deletion request on the website cannot automatically locate it; use the device control or contact sales@pepway.app. History is available for 90 days; the server removes expired records in cleanup runs every six hours. Infrastructure logs follow provider retention periods. Deleting the app without using the control removes the local credential; remaining remote history expires under the retention period.

Optional campaign measurement

PepWay may use AppsFlyer to measure install sources and commercial events, such as onboarding completion and viewing plans, only with your separate permission. On iOS, measurement also requires system tracking authorization. Refusing does not prevent app use or subscription purchases. You can change your choice in Privacy and data. This configuration does not collect IDFA or the Google advertising identifier and blocks postbacks to advertising partners.

AppsFlyer receives an installation identifier, technical app/device metadata, timestamps and permitted events. If measurement is active, RevenueCat may associate this identifier with your subscription identity and forward the product, trial, charge, currency, amount, renewal, cancellation or refund to measure revenue. We do not send medication names, doses, injection sites, health answers, weight, measurements, health-platform data, meals, photos, conversations or contact details as marketing events. Data may be processed outside your country under the providers’ contracts. Revocation stops new app transmissions and requests removal of the RevenueCat association; remote updates require connectivity. It does not retroactively erase events already received by providers. For access, deletion or other requests concerning this data, contact sales@pepway.app. Local erasure removes the measurement preference; account deletion removes the preference and disables this device’s association without cancelling the store subscription.

3. Optional account and sync

You can use local records without creating an account, subject to the subscription conditions in the Terms of Use. In versions using the new infrastructure, PepWay processes your email, identifier, account metadata and authentication information on its server and database hosted on Railway. Google or Apple shares the identifiers, email and name you authorize; PepWay does not receive your password from those providers. Technical information such as IP, date and authentication events may be processed for operation and security.

Signing in does not enable sync. Separate explicit consent authorizes uploading manual records to your account in the database hosted on Railway. Imported Apple Health and Health Connect data stay on the device and are excluded from cloud and AI. Progress photos stay local by default: Photos offers a separate, optional private backup in Railway S3-compatible storage located in the United States, including image, date, type and notes. Only your account can access it; you may review and restore photos on another device or delete remote files. Disabling uploads does not delete existing backups. Signing out retains your account’s local copy for its next authorized sign-in.

Infrastructure migration and older versions

PepWay is migrating authentication, database and private photo backups from Supabase to the Railway infrastructure. Older app versions may continue to depend temporarily on Supabase until updated. The legacy source is temporarily retained for transition and recovery until decommissioning; this policy does not claim it has already been erased. Migration preserves account identifiers and data associations but may require signing in again. It does not enable sync or photo backup without their separate permissions and does not upload imported health data.

To clarify which infrastructure your version uses or exercise your rights during the transition, contact sales@pepway.app. Deletion requests must also cover the legacy source when it contains data; confirmation in the new infrastructure alone does not prove immediate erasure of the source. Data from accounts requested for deletion must not be used to recreate those accounts from migration or recovery copies.

4. Permissions and health-platform data

Connecting Apple Health or a compatible platform is optional. The screen explains requested data such as steps, weight and sleep. PepWay reads only types permitted by the system; missing data does not mean zero. The imported copy supports your local tracking. You can disconnect in the app and revoke permissions in system settings without deleting source records.

Notifications are optional and can display reminders on the lock screen according to your choices. Camera and photo selection are used when you request adding an image. We do not use health data for advertising, ad targeting, data sales or tracking across apps.

5. Purposes and legal bases

We use records to perform the functions you request. Processing sensitive health data relies on your explicit consent as applicable under LGPD and GDPR. Account services rely on performing the service relationship; security may rely on proportionate legitimate interests and legal obligations where applicable. Withdrawing consent stops the corresponding future processing without invalidating prior lawful processing.

6. Pep and AI estimates

Pep, meal/menu estimates and label reading are optional and use the commercial Anthropic (Claude) API with an authenticated account. AI permission is requested on first use and remembered per account on this device for the described features; you can withdraw it in Profile → Privacy and data. Chat sends text and recent messages; “Use my routine”, off by default, shares a summary of the last seven days of manual records (protocols, times, recorded doses, water, weight, food, sleep, symptoms, measurements and goals). Imported health data and photos are excluded from that summary. Food, menu or label photos are sent only when you choose them for analysis and AI permission is active; system camera and photo permissions remain separate; avoid personal information and photos of people. AI does not save automatically or change protocols: review fields and proposals before saving. Labels are transcriptions, not authentication or confirmation of concentration or prescribing. Food and portion estimates may be incorrect.

Pep history keeps up to 40 messages on this device, separated by account; it is not synced. You can delete this copy on the Pep screen. Withdrawing AI permission stops new submissions for all these features and turns off routine sharing but does not undo content already received by the provider. Signing out does not erase local history. Deleting the account on the device also removes its local history. Submitted food photos are not saved in Pep history; the original file and system caches may remain on the device. An estimate becomes a nutrition record only when you review the form and save.

The PepWay AI server processes content in transit and does not keep prompts, responses or images as database records. To limit usage and costs, it stores daily counters on Railway by account identifier and a global counter without conversation content. Counters older than seven days are removed during new requests; scheduled deletion is not guaranteed while there is no activity. Account deletion removes individual counters; global totals do not identify users. Technical authentication and infrastructure logs may follow provider retention periods.

Under its standard commercial API policy, Anthropic states that it deletes inputs and outputs within 30 days, with exceptions for usage-policy enforcement, legal obligations, specific features and applicable contractual terms that may require longer retention. Commercial use does not authorize model training with this content without express permission. PepWay does not claim a zero-retention agreement. Deleting local history or withdrawing consent does not immediately erase data already processed by Anthropic. Consult the current provider policy at https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data or contact sales@pepway.app to exercise your rights.

Reporting Pep responses

You can report a response within the chat. Only the selected response, the reason and your account identifier are sent to the private PepWay database hosted on Railway; your question and the rest of the conversation are not included. The responsible team can access this content to review safety and quality. The record remains until account deletion or removal after handling; deleting local history does not delete a previously submitted report.

7. Providers and transfers

Railway hosts the PepWay API, authentication, PostgreSQL database and private photo backup storage. BetterAuth is software running on the PepWay server, not an external authentication service receiving your data. Apple and Google process sign-in when selected, and stores process available purchases. RevenueCat processes account or anonymous identifiers, purchase history and status to validate access, restore subscriptions and analyze subscription performance. We do not send health records, photos, names or email addresses to RevenueCat. The website host may process technical data needed for delivery and security. These services involve international processing, including in the United States, depending on the resources used. International transfers must follow applicable safeguards, including required contractual instruments. We may share data when subject to a valid legal obligation.

Resend delivers transactional account confirmation, access recovery and security emails sent by PepWay <conta@pepway.app>. It processes the recipient address, necessary message content and technical delivery data. We do not send your health history or conversations to Resend. Support and privacy remain at sales@pepway.app. Anthropic processes only the AI content authorized in the preceding section; its infrastructure may operate outside Brazil.

Versions with remote updates use Expo/EAS Update to distribute app fixes. Delivery may process technical data such as IP address, platform, version and update identifiers. This distribution does not send health records, photos or conversations. Compatible packages download in the background and may be applied at the next app launch.

8. Retention, deletion and security

Local records remain until you erase them, clear browser data or uninstall the app. Synced records remain linked to your account until removed or the account is deleted. Disabling sync stops new uploads but does not erase previously uploaded data. Confirmed deletion removes the account and its active records; provider-held technical data and backups follow contractual retention periods and applicable obligations and are not used to restore an account deleted at the user’s request.

We use account-based access controls and protected transport provided by the services. We do not promise absolute security or end-to-end encryption. Protect your device and account. Files you export are under your control and cannot be remotely erased by PepWay.

9. Your rights

Depending on applicable law, you may request confirmation of processing, access, correction, portability, erasure, restriction, objection and withdrawal of consent. Use Profile → Privacy and data or contact sales@pepway.app. We may request only proportionate verification needed to protect your account. You may also complain to Brazil’s ANPD, the competent EU data protection authority or another applicable authority. US state privacy rights apply where their requirements are met.

10. Age and changes

The personal-record service is intended for adults. We do not knowingly collect children’s data. Contact us if you identify misuse so we can review and remove it. Material changes to purposes or permissions will be communicated; new processing requiring consent depends on a new choice. The document version and date appear on this page.

11. Voice and device extensions

Voice transcription requires permission and native availability. Apple/Google system speech recognition may process audio; text appears as a draft before you send it to Pep. The app does not save audio. Reading a reply uses device speech synthesis. Widgets, Live Activities and Apple Watch start disabled, with specific options for water, schedules and medication names. They use a limited local copy without imported health data or photos and may appear on lock screens or paired devices. Signing out clears reachable extension copies; a disconnected Watch may retain its last copy until communication resumes, and snapshots expire after 30 minutes.

12. Optional community

Community uses a separate profile with your chosen nickname and rules acceptance. Other members of groups you join can see your nickname and posted text. We never publish your records, photos or health data automatically. Memberships, posts, blocks and reports are stored in the database hosted on Railway; report inappropriate content or block a profile in the screen. Filters limit content, spam and dosing instructions; reports can hide posts for review. Authorized operators may remove content or restrict participation. Deleting a community profile removes its memberships and posts; moderation restrictions can remain linked to the account until expiry or account deletion. To prevent deleting posts from resetting the daily limit, we store minimal publication receipts (account ID, post ID and time), without the text. Receipts older than seven days are removed on that account’s next publication; deleting the account removes all receipts. Contact: sales@pepway.app.

13. Photo measurement availability

This feature is disabled in the current release because an anthropometry provider has not been contracted. Body photos are never sent for analysis without specific availability and permission. The prepared Bodygram integration, when enabled, will send two photos, age, sex used by the calculation, height and weight through our server. The provider may retain scans in the PepWay account; request their deletion through sales@pepway.app. Provider terms, retention and contracts must be confirmed and user information updated before activation. Claude is not used to fabricate body measurements or body fat.