Privacy Policy

Peak Me Up ("PMU", "we") is an unincorporated, founder-led venture run by Adrian Hula from Romania. Adrian Hula is the controller of the information described here.

Privacy questions and requests: privacy@peakmeup.ai. We reply within one month.

• Account: your email, name, and a password hash, or your Google account ID and picture if you sign in with Google; and your time zone, obtained from your browser, to display tracking dates in local time and interpret the reminder times you set.
• Health information you choose to give us: assessment answers and scores, age range, goals, diet, the supplements you take, your daily logs, check-ins, ratings, notes, and (only where a feature is switched on) conditions and medicines.
• Supplement checks: the supplements you check for interactions, timing or dose, and the results.
• Photos and voice notes: a label photo or voice note you upload is sent to our AI provider to read the supplement names. We don't keep voice notes, and photos are deleted once read. Neither is linked to your account.
• Messages: feedback, contact-form and Founding Member messages. The contact and Founding Member forms also record your IP address and the city and country it points to.
• Usage and device: pages and features used, with IP address and browser details; reminder and email interactions; where you came from (campaign links).
• Notifications: if you turn on push notifications, your browser's push address.
• Consent records: what you agreed to, which version and when, including withdrawals.

Health information is special-category data. We process it only with your explicit consent, which you give with a separate box when you sign up (or on a consent screen at your next sign-in, for accounts created earlier):

I agree that Peak Me Up processes the health information I choose to give it, such as my assessment answers and scores, the supplements I take and how they work for me, to provide my results, checks and tracking, to suggest supplements based on my assessment answers and on the supplements I tell it I take, and to check and improve the quality and safety of those results and suggestions.

Earlier version. If your recorded consent is version health-1, you agreed to this earlier wording: “I agree that Peak Me Up processes the health information I choose to give it, such as my assessment answers and scores, the supplements I take and how they work for me, to provide my results, checks and tracking, and to check and improve the quality and safety of those results. I can withdraw this consent at any time in Settings → Privacy or by emailing privacy@peakmeup.ai. Without it, I can’t use the features that need my health information.” The new matching of reported supplements and different supplement forms requires health-2. If you remain on health-1, existing My Stack matching continues unchanged. Privacy Settings shows which version you agreed to.

“Settings → Privacy” above is the Privacy Settings page in your profile menu.

Withdrawing. You can withdraw at any time in Privacy Settings or by emailing privacy@peakmeup.ai. When you withdraw, we permanently delete your health information: your assessments, stack, the supplements you told us you take, checks, tracking history, goals, notes and reminders. It can't be restored, even if you agree again later: you would start afresh. Your account stays, and features that need your health information don't work until you agree again. Any stack you published is permanently deleted, and your reviews of other stacks keep only an anonymous star rating. Withdrawing doesn't affect anything we did before.

Optional research consent. You can also choose to let us use your information to create research records that help improve supplement guidance. Research records will be anonymised before being retained for long-term research; a record that can't be reliably anonymised isn't retained for that purpose. You can turn this off in Privacy Settings at any time, and it doesn't affect your use of PMU. We don't create any research records yet.

• Interaction checker: no account needed. The names you type are used only to run the check: we don't save them, and they aren't sent to AI, analytics or error-monitoring services. For the daily limit we keep a count per browser and per network as one-way codes, not your IP address itself. Your latest result stays in your browser, and moves to your account if you sign up.
• Assessment: with your agreement on its first screen, your answers are processed to show your results. If you save them to sign up but don't create an account within 30 days, they're deleted. We keep weekly totals (how many assessments were saved and how many deleted), which don't record who took them.
• Founding Member application: with your agreement on the form, we process your application (including your goals and the supplements you take) to assess it and contact you about the programme. If you're not accepted, it's deleted 90 days after our decision. If you're on the waitlist, it's kept for up to 12 months after you applied. If you're invited but don't use the invitation, it's deleted 90 days after the invitation expires.

• Running your account and the features you use (contract): sign-in, saving your settings, and the emails your account needs.
• Health information (your explicit consent, GDPR Art. 6(1)(a) and 9(2)(a)): results, supplement suggestions based on your assessment answers and the supplements you tell us you take, checks, tracking, reminders based on them, and checking and improving the quality and safety of those results.
• Security, preventing misuse and managing AI costs (legitimate interests): we automatically record how much each account uses our AI features and what that costs (the feature, the time and the cost, not the content of your health information). No one reviews it unless an account's usage is unusually high; then an authorised person may look at that account's usage and basic account details. Error monitoring runs on the same basis.
• Analytics and advertising measurement (your consent, given in the cookie banner): see section 8.
• Product counts (legitimate interests): When you check interactions, we keep anonymous counts of the medicines, foods and supplements people ask about, not linked to you, to decide what to support next.

We don't sell your information, and we don't share your health information with supplement companies, employers or insurers.

Some features use OpenAI to analyse supplement combinations, timing and dose, or to read a label photo or voice note. The interaction and timing checks send only the supplements, with no profile information. A few features that explain results for you do include relevant health information, and run only with your consent.

OpenAI processes these requests on our behalf under OpenAI's data processing terms, which form part of its services agreement. It doesn't use them to train its models, and may keep them for up to 30 days to detect abuse. We keep a copy of AI requests and answers to check the quality and safety of results. Those copies are kept until you withdraw consent or delete your account. Staff can read one only with a recorded reason.

These providers process information to help us run PMU:

• Supabase: database and file storage (United States)
• Vercel: hosting; keeps short-lived request logs, which can include page addresses (United States)
• OpenAI (OpenAI Ireland Ltd.): AI features; processed in the United States
• Resend: email delivery (United States). We don't track whether you open our emails or click their links.
• Sentry: error monitoring (EU). Page addresses are sent without their query part.
• Google: sign-in, if you choose it
• Your browser's push service: push notifications, if you turn them on
• ip-api.com: finding the city and country of an IP address, for the contact and Founding Member forms
• Microsoft Clarity and Reddit: only with your consent (section 8)

Transfers outside the EU. Where Supabase, Vercel, OpenAI or Resend process information in the United States, the transfer relies on the European Commission's standard contractual clauses or an adequacy decision, as set out in each provider's data processing terms.

• Necessary (always on): your sign-in session, a session ID for security, and the guest checker's daily-limit cookie.
• Error monitoring (always on, legitimate interests): Sentry records errors without your IP address.
• Analytics (only with your consent): Microsoft Clarity records how pages are used. The interaction checker is masked, so what you type and see there isn't recorded.
• Advertising measurement (only with your consent): the Reddit pixel tells Reddit about visits and some actions, such as completing the assessment (not your answers or scores).

You can change your choice at any time from the cookie banner.

• Your account and health information: while your account exists, or until you withdraw your health consent (your health information is then deleted).
• Supplements you tell us you already take (before you add them to your stack): we keep these names until you remove them, confirm that a My Stack entry represents or replaces them, withdraw your health consent or delete your account. An exact confirmed supplement match in My Stack also removes the corresponding reported name. If you take both supplements, both remain recorded. If we switch this feature off, we keep them unused until you remove them, withdraw your health consent or delete your account, and you can still see and remove them in your profile.
• When you delete your account, it's erased straight away: your profile, health information, checks, tracking, AI request copies, messages, notifications and files. We keep only:
  • weekly AI cost totals, with no person in them;
  • a record that an account was erased that day, with counts of what was removed and the reason you chose;
  • for 30 days, a deletion record holding a one-way code made from your account ID, not your name or email, so that we can delete your information again if we ever have to restore a backup (see Backups below). Withdrawing your health consent creates the same record;
  • if you reviewed someone else's stack, its star rating, shown as "Anonymous", with its date rounded to the month (stacks you published are deleted);
  • supplement interaction findings produced while you used PMU, which are about supplements, not you, with the link to you removed.
• Guest assessments: 30 days if no account is created.
• Founding Member applications: not accepted, 90 days after our decision; on the waitlist, up to 12 months after you applied; an invitation not used, 90 days after it expires.
• Usage logs: we record which pages and features are used, with the time, the page address, including information in its URL parameters, the referring page or campaign, and general browser and device information. When you're signed in, these records are linked to your account. We remove IP addresses and full browser identifiers (user-agent strings) after 13 months; we keep them that long to investigate security problems and misuse. The rest of each record is currently kept without a fixed deletion date, unless you delete your account, in which case the records linked to it are deleted.
• Backups: deletion from our live database happens straight away. Our database provider also keeps daily backups for about a week, used only to recover from a serious failure; deleted information disappears from them as they expire, within 8 days. If we ever restore a backup, we use the deletion records to delete again anything you asked us to delete before it's used.

You can:

• withdraw your health consent or research consent in Privacy Settings, or by email;
• delete your account in Personal Details;
• ask for a copy of your information, to correct it, to restrict or object to how we use it, or to receive it in a portable format, by emailing privacy@peakmeup.ai;
• complain to a data protection authority: in Romania, ANSPDCP (dataprotection.ro), or the authority where you live.

PMU is for adults; you must be 18 or older to use it. If we learn that someone under 18 has an account, we delete it.

Information is encrypted in transit. Only our servers can reach the database; staff access to individual AI requests needs a recorded reason. If a personal-data breach is likely to put you at risk, we'll tell you and the authority as the law requires.

If we change this policy in a way that matters, we'll tell you by email or in the app before it applies. If a change needs your consent, we'll ask for it.