Privacy Policy

This Privacy Policy explains what personal data the STCKD app ("STCKD: Peptides & Supplements") and the website stckd.app handle, why, who else is involved, how long it is kept, and what you can do about it. In this policy, "we", "us" and "our" mean Mário Otruba, the person who makes and runs STCKD.

1. Summary

• You can use STCKD without an account. Then everything you track stays on your iPhone and never reaches us.
• If you create an account, your tracked data is synced to our database in the United States, but only if you give a separate, explicit consent for this health data. You can withdraw it at any time.
• Much of what you track is health data. We use it only to show it back to you and sync it between your devices. We never use it for ads, marketing or research.
• We use no artificial intelligence, no analytics, no advertising and no tracking. We do not sell or share your personal information.
• You can export all your data and delete your account in the app. Deletion is immediate. Backup copies disappear within up to 7 days after deletion (Supabase daily backups roll over).
• Apple handles payments. We never see your card details.
• STCKD is for adults (18+) only.
• Questions: support@stckd.app.

Contents

• 2. Who we are and how to reach us
• 3. The data we handle
• 4. Why we use your data and our legal basis
• 5. Health data and your consent
• 6. No artificial intelligence
• 7. Who receives your data
• 8. Transfers outside the EU
• 9. How long we keep your data
• 10. Export and delete your data
• 11. Your rights in the EU, EEA and UK
• 12. Your rights in the United States
• 13. California
• 14. Canada and Québec
• 15. How to use your rights
• 16. Cookies and device storage
• 17. No selling, no sharing, no tracking
• 18. Children
• 19. Security
• 20. Data breaches
• 21. Changes to this policy
• 22. Contact

2. Who we are and how to reach us

STCKD is made and run by Mário Otruba (individual (natural person), not registered as a trader in the Slovak trade register), Martina Hattalu 2973, 026 01 Dolný Kubín, Slovakia. We are the controller of your personal data. This means we decide why and how it is used.

• Email: support@stckd.app
• Phone: +421 940 857 804
• Post: Mário Otruba, Martina Hattalu 2973, 026 01 Dolný Kubín, Slovakia

Person in charge of personal information. Mário Otruba is responsible for protecting personal information at STCKD, including as the person in charge of the protection of personal information under Québec law. You can reach this person at support@stckd.app.

We have not appointed a data protection officer. Every privacy question goes to the address above. Full provider details are in our Legal Notice.

3. The data we handle

This table shows what you must give us and what is up to you.

3.1 What you track

This is the information you type or tap into the app:

• Supplements, peptides and medicines: name, category (for example peptide, GLP-1 or TRT), dose and unit, method (for example subcutaneous or intramuscular), time, schedule, cycles and pauses, half-life, vial inventory and how much is left.
• Stacks: their names, colors, schedules and which items they contain.
• Intake history: which doses you took or skipped, when, and the actual dose if it differed.
• Injection sites: the site of each dose and your rotation settings.
• Feel Log: mood, energy (1 to 10), a daily note, and symptoms with their severity.
• Body weight and your preferred unit.
• Notes you write, for example about a brand, a batch or where a product came from.
• Your focus choice (peptides, GLP-1, supplements or all) and your reminder and display settings.
• Sync information: when your data was last saved, which items you deleted, and whether you finished the tutorial.

Much of this is health data. Section 5 explains how we protect it.

Where it is stored. It is always stored on your iPhone, inside the app. If you use the app as a guest, it never leaves your iPhone and we never receive it. If you have an account and have given your health-data consent, a copy is also stored in our database (run by Supabase in the United States) as one record linked to your account.

If you used the app as a guest and then sign in, the data already on your iPhone is added to your account and synced, once you have given that consent.

3.2 Your account

If you create an account, we receive:

• Sign in with Apple: an Apple account identifier and an email address. If you choose "Hide My Email", this is a private relay address that Apple creates. Apple may also offer your name to the app. The app does not send it to our servers.
• Sign in with Google: your Google email address, your name, a link to your Google profile picture, and a Google account identifier. Google always sends these when you sign in with Google. Our database provider stores them with your account, and they are deleted when you delete your account. While you sign in, Google's own sign-in software inside the app may also collect technical information for Google's purposes, such as your IP address (which can show your approximate location, used against fraud), a device identifier and usage data. Google's privacy policy covers that; we do not receive it.
• A user ID that our database creates to link your data to your account.

The app has no screen for changing your email address. If you need to change it, write to support@stckd.app.

3.3 Security and technical data

Whenever the app talks to our servers (only while you are signed in), our provider Supabase automatically records technical data. This includes your IP address, device and app details (the "user agent"), the times you sign in and make requests, your session tokens, and a log of sign-in events. We use this to keep your account secure, stop abuse and fix problems.

We also record a few product-usage events in our own database (Supabase): which screens of the setup flow you reach, which subscription plan you tap, and whether a purchase went through. Each event carries a random install id, the time, the platform and, once you are signed in, your user ID. We use these only to see where people get stuck in the setup flow and improve it. No third-party analytics service receives them.

3.4 Terms and consent records

When you create an account, we store the date and time, the versions of the Terms and this Privacy Policy you accepted, and your user ID. When you give or withdraw your health-data consent, we store the same kind of record. These records let us show that you agreed.

3.5 Messages to support

If you email us, we receive your email address and whatever you write. Our mailbox runs on Google Workspace. Please do not include health details unless we need them to help you.

3.6 Data that stays on your iPhone

Some data is stored only on your iPhone. We never receive it:

• Age confirmation: that you confirmed you are 18 or older, and when. We do not ask for your date of birth.
• "How STCKD works" acknowledgement, and when you gave it.
• Calculator entries, such as vial size, water volume and price.
• Reminders. They are local notifications that your iPhone schedules itself. There is no push server. "Private reminders" is on by default, so the lock screen shows only "STCKD" and no names or doses. You can change this in Profile.
• Your STCKD Pro status. The app asks Apple, on your iPhone, whether your subscription is active. This status is not sent to our servers.
• Rating-prompt timing: when you first opened the app and whether we already asked you to rate it, so Apple's rating prompt is not shown too often.
• Everything you track in guest mode.

Signing out or deleting your account removes your tracked data from that iPhone. The age confirmation, calculator entries and rating-prompt timing stay until you delete the app.

3.7 Files you create and share

• Data export (JSON): a file with everything you tracked plus your account email.
• Monthly report (PDF, STCKD Pro): a summary of the last 30 days.
• Share card: an image of your stack.

All three are made on your iPhone. They leave your iPhone only if you share them, and they go only where you choose. Temporary copies are deleted after you share. To save a share card to Photos, the app asks for "add only" access, so it cannot see your photos. Once you send a file to another app or person, their own rules apply to it.

3.8 Subscriptions and payments

Apple (merchant of record for all in-app purchases). Apple handles your payment details. We never see them. Apple gives us sales and payout reports, and these do not identify you.

To know which plan is active on your device, we use RevenueCat, a subscription-management provider. RevenueCat receives a random app user id (linked to your user ID once you are signed in), your Apple purchase records for STCKD (product, dates, renewal status, no card details) and your device type. It keeps this for as long as your account exists.

3.9 Crash reports and App Store statistics

If you turned on "Share With App Developers" in your iPhone settings (Settings → Privacy & Security → Analytics & Improvements), Apple may send us crash reports. They contain technical details about the crash, your device model and iOS version. They do not include your name or email. If you test beta versions through Apple's TestFlight, Apple also passes us the feedback and crash reports you send. Apple also gives us overall App Store statistics, such as download numbers, which do not identify you.

3.10 Our website

Our website stckd.app is hosted by GitHub Pages. GitHub logs visitors' IP addresses for security. The website sets no cookies, stores nothing on your device, and runs no analytics.

The password-reset page is the only page that talks to our servers. It sends your new password to Supabase, and only when you open a valid reset link. The reset session is kept only in the page's memory and is gone when you close it.

3.11 What we do not collect

We do not collect your date of birth, location, contacts, photos, camera, microphone, face or fingerprint data, or your advertising identifier. STCKD does not connect to Apple Health: your weight is only what you type in. The app contains no third-party analytics, advertising, tracking or session-recording tools; the only usage data is the handful of setup-flow events described in section 3.3, stored in our own database.

4. Why we use your data and our legal basis

Under the EU General Data Protection Regulation (GDPR), we need a legal basis for each use of your data.

Where we rely on legitimate interest, you can object (see section 11). Where we rely on consent, you can withdraw it at any time. This does not affect what we did before you withdrew it.

5. Health data and your consent

What you track about compounds, doses, injection sites, symptoms, mood, energy and weight is health data. The GDPR calls it "data concerning health". US state laws call it "sensitive" or "consumer health" data.

We store it on our servers only with your explicit consent (GDPR Art. 9(2)(a)). When you create an account, the app asks for this consent separately from the Terms. The box is not ticked for you. This consent also serves as the consent required by US state health-data laws and as express consent under Canadian law.

What the consent covers: storing a copy of your tracked data in our database (Supabase, United States) so it syncs between your devices and can be restored. Nothing else.

If you do not consent, you can still use every feature on your iPhone. Your data simply stays there and is not synced.

How to withdraw: in the app, open Profile (tap your avatar on the Today screen) → Legal & privacy → Withdraw health-data consent. You can also email support@stckd.app. When you withdraw:

• syncing stops straight away;
• we delete the synced copy from our database, and it disappears from backups within up to 7 days after deletion (Supabase daily backups roll over);
• your data stays on your iPhone;
• your account stays, so you can give consent again later if you want.

Deleting your account also ends your consent.

What we never do with health data: we do not use it for advertising, marketing, research or data mining. We do not sell it, share it or show it to anyone. We do not analyze it to draw conclusions about your health. The Insights, the estimated-level chart and the monthly report are simple calculations that run on your iPhone. STCKD is a tracking tool, not medical advice. See our Health Disclaimer.

6. No artificial intelligence

STCKD uses no artificial intelligence or machine learning, on your iPhone or on our servers. We do not send your data to any AI service, and we do not use it to train any model. We make no automated decisions about you and do no profiling.

7. Who receives your data

We do not give your personal data to anyone except the providers below. Processors handle data only on our behalf and on our instructions. Independent controllers run their own service, which you choose to use, under their own privacy policies.

A few more points:

• Supabase runs our database on Amazon Web Services, and its network edge runs on Cloudflare. They are Supabase's sub-processors. You can ask us for the current list of sub-processors.
• Apple and Google receive data from us only when you choose to sign in with them or buy through the App Store. When you sign in with Apple or Google, that company learns that you signed in to STCKD. We never send them your tracked data.
• Only Mário Otruba has administrator access to our systems.
• We disclose data to authorities only if the law requires it. We check that each request is lawful, and we tell you unless the law forbids it.
• If STCKD is ever transferred to a new owner, for example a company set up to run it, your data would move with it under this policy. We would tell you in advance.

8. Transfers outside the EU

We are based in the EU, but our providers store and process data in the United States and other countries. Here is how each transfer is protected:

• Supabase (our database, us-east-1 region): EU Standard Contractual Clauses in Supabase's Data Processing Addendum. Supabase is not certified under the EU–US Data Privacy Framework.
• Google Workspace (support mailbox) and GitHub (website hosting): the EU–US Data Privacy Framework, and Standard Contractual Clauses where their terms include them.
• RevenueCat (subscription management): EU Standard Contractual Clauses in RevenueCat's Data Processing Addendum.
• Apple and Google as sign-in and App Store providers: they are independent controllers and protect transfers under their own privacy policies.

On top of this, all data travels encrypted (HTTPS), our database provider encrypts stored data, and database rules let each account reach only its own data. You can ask us for a copy of the safeguards at support@stckd.app.

For people in Canada, including Québec: your data is stored outside Canada, mainly in the United States. While it is there, courts and authorities in that country may be able to access it under their laws.

9. How long we keep your data

10. Export and delete your data

Export. In the app, open Profile (tap your avatar on the Today screen) → Export my data (JSON). You get a file with everything you tracked. Guests can do this too.

Correct. You can edit or delete any entry in the app at any time.

Delete your account. Open Profile → Delete account & all data and confirm. This happens immediately and cannot be undone. We delete your account (email, sign-in identifiers and password hash) and all synced data, and the app clears your data from that iPhone. What stays for a while:

• backups, which roll over within up to 7 days after deletion (Supabase daily backups roll over);
• security and sign-in logs, kept 7 days (Supabase platform and sign-in logs);
• records of your Terms acceptance and consents, kept for as long as the account exists (deleted with it);
• emails you sent to support, kept 2 years after the conversation ends;
• purchase records, which Apple keeps under its own rules.

If you signed in with Google, deleting your account also revokes STCKD's access to your Google account and signs you out of Google in the app. If you signed in with Apple, you can stop using your Apple Account with STCKD at any time: iPhone Settings → your name → Sign-In & Security → Sign in with Apple → STCKD → Stop Using Apple Account.

Deleting your account does not cancel STCKD Pro. Apple keeps billing you until you cancel: iPhone Settings → your name → Subscriptions → STCKD → Cancel Subscription. The app reminds you of this before you delete.

Without the app: email support@stckd.app from your account's email address. Full steps are on Delete Your Account and Data.

Guests: we hold nothing about you. Delete the app to delete your data.

11. Your rights in the EU, EEA and UK

The GDPR applies to everything we do, wherever you live, because we are based in Slovakia. You have the right to:

• access your data and get a copy;
• correct data that is wrong or incomplete;
• erase your data;
• restrict how we use your data, for example while we check a complaint;
• data portability: get the data you gave us in a common machine-readable format (the JSON export), or ask us to send it to someone else where this is technically possible;
• object to uses based on our legitimate interest;
• withdraw consent at any time, without affecting what we did before;
• not be subject to decisions made only by automated means. We make no such decisions.

You can also complain to a data protection authority. Ours is the Úrad na ochranu osobných údajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic), Hraničná 12, 820 07 Bratislava 27, Slovakia, dataprotection.gov.sk. You can also complain to the authority where you live or work, or where the problem happened. In the UK, this is the Information Commissioner's Office (ico.org.uk). We would be glad to hear from you first, so we can try to fix it.

12. Your rights in the United States

Some US states give residents privacy rights, and some of these laws may not apply to a business of our size. We give the following rights to everyone in the United States:

• Know and access: what personal data we have about you, and a copy of it. We also tell you which companies received it (see section 7).
• Delete your personal data.
• Correct data that is wrong.
• Portability: get your data in a usable format (the JSON export).
• Opt out of the sale of personal data, targeted advertising, and profiling that has legal or similarly significant effects. We do none of these, so there is nothing to switch off. We still honor any opt-out request, including a Global Privacy Control signal.
• Consent for sensitive data: we process your health data only with your consent (see section 5).
• No discrimination: you get the same service and price whether or not you use your rights.

Authorized agents. Someone else can make a request for you if you give them written permission. We may ask you to confirm this directly with us.

Appeals. If we turn down your request in whole or in part, we explain why. You can appeal by replying to our answer, or by emailing support@stckd.app with the subject "Privacy appeal". We answer your appeal in writing within 45 days and explain the reasons. If we deny your appeal, you can contact your state Attorney General, for example the Connecticut Attorney General (portal.ct.gov/ag), the Washington State Attorney General (atg.wa.gov) or the Nevada Attorney General (ag.nv.gov).

Consumer health data (Washington, Nevada, Connecticut). If you live in these states, our Consumer Health Data Privacy Policy explains your extra rights over health data.

13. California

The California Consumer Privacy Act does not currently apply to us, because we are below its size thresholds. We give California residents its rights anyway, and this section gives the information it asks for.

What we collected in the last 12 months:

We collect no geolocation, biometric, audio or visual data, and we draw no inferences about you. Purchases are handled by Apple; we never receive your payment details, only the record of which plan is active.

• No sale or sharing. We have not sold or shared personal information in the last 12 months, including that of people under 16. "Sharing" here means for cross-context behavioral advertising.
• Sensitive personal information is used only to provide the service you asked for. We do not use it to infer anything about you, so there is no need to limit it.
• Retention: see section 9.
• Your rights: to know, access, delete and correct your data, and not to be discriminated against for using these rights. See section 15.
• Direct marketing (Shine the Light). We do not give personal information to third parties for their own direct marketing.

Do Not Track and Global Privacy Control. We do not track you across other websites or apps over time, and we do not let third parties do so through STCKD or our website. So Do Not Track and Global Privacy Control (GPC) signals do not change how we handle your data. We still treat a GPC signal as a valid request to opt out of the sale and sharing of your personal information.

14. Canada and Québec

If you are in Canada, you have the right to:

• access the personal information we hold about you;
• correct it if it is wrong or incomplete;
• withdraw your consent, subject to legal or contractual limits. For example, if you withdraw your health-data consent, your data stays on your iPhone but is no longer synced (section 5);
• in Québec, get your data in a structured, commonly used technological format (the JSON export), and be told about automated decisions. We make none.

The person in charge of protecting personal information is Mário Otruba, reachable at support@stckd.app.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca). In Québec, you can complain to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).

15. How to use your rights

• In the app: export, correct and delete your data, and withdraw your health-data consent (see sections 5 and 10).
• By email: write to support@stckd.app. Tell us what you want and which law you rely on, if you know.

Checking it is you. We need to make sure we give data only to the right person. If you write from the email address of your account, that is usually enough. If not, we may ask you to confirm from that address or to sign in to the app. We ask only for what we need, and we never ask for your password. If you use the app as a guest, we hold no data about you. It is all on your iPhone.

How fast we answer:

• EU, EEA, UK and Canada: within 30 days. If a request is complex, we may need up to two more months under the GDPR. We will tell you why within the first 30 days.
• United States: within 45 days. If needed, we may extend this once by another 45 days and will tell you why.

Using your rights is free. Under the GDPR, we may charge a reasonable fee or refuse only if a request is clearly unfounded or excessive, and we would explain why.

16. Cookies and device storage

Our website sets no cookies and stores nothing on your device. The app stores your data on your iPhone only to make the app work. All of this storage is strictly necessary, so we do not ask for cookie consent. Details, including a full list, are in Cookies and Device Storage.

17. No selling, no sharing, no tracking

We do not sell or share personal information, and we do not use it for targeted advertising.

STCKD does not track you. We do not link your data with data from other companies for advertising, and we do not pass it to data brokers. So the app does not show Apple's App Tracking Transparency prompt, and it does not use your advertising identifier. There are no ads in the app.

18. Children

STCKD is for adults only. You must be 18 or older to use it, and the app asks you to confirm this the first time you open it. The app is not aimed at children. We do not knowingly collect data from anyone under 18. If we learn that we have, we delete the account and its data. Parents and guardians can contact us at support@stckd.app.

19. Security

We take reasonable steps to protect your data. No system is perfectly secure, so here is exactly what we do:

• Encrypted connections: the app talks to our servers only over HTTPS. Our website is served over HTTPS.
• Access rules: database rules (Supabase "row-level security") let each signed-in account read and change only its own data.
• Encryption at rest: our database provider, Supabase, states that it encrypts all stored customer data (AES-256). Your data is not end-to-end encrypted. This means our provider's systems and our administrator account can technically read it. We look at it only when we need to run the service, fix a problem you report, or follow the law.
• Your session: on your iPhone, the token that keeps you signed in is stored in the iOS Keychain and is available only on that iPhone.
• Lock screen and app switcher: "Private reminders" is on by default. The app hides its screen in the iPhone app switcher.
• On your iPhone: your tracked data is stored inside the app. We do not add our own encryption to it. It relies on your iPhone's own protection, such as your passcode. It may also be included in your iPhone backups (iCloud or computer).
• Limited access: only Mário Otruba has administrator access.

Please use a strong, unique password and keep your iPhone locked with a passcode.

20. Data breaches

If a security breach affects your personal data:

• EU (GDPR): we will report it to the Úrad na ochranu osobných údajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic), Hraničná 12, 820 07 Bratislava 27, Slovakia, dataprotection.gov.sk within 72 hours of learning about it, unless it is unlikely to put anyone at risk. If it is likely to put you at high risk, we will tell you directly without undue delay.
• United States: we will follow the US Federal Trade Commission's Health Breach Notification Rule. This includes telling you within 60 days of discovering the breach, and telling the FTC and, where the rule requires, the media within the rule's deadlines. We will also follow any state breach-notification laws that apply.
• Canada: if a breach creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and tell you as soon as possible. For Québec, we will report incidents that risk serious injury to the Commission d'accès à l'information and tell the people affected.

We keep a record of every breach, even small ones.

21. Changes to this policy

When we change this policy, we update the version and dates at the top. If a change is important, for example a new use of your data or a new provider, we will tell you in the app before it takes effect. Where the law requires it, we will ask for your consent again. We will never use your health data for a new purpose without asking you first.

Previous versions are kept in our archive.

22. Contact

Mário Otruba, Martina Hattalu 2973, 026 01 Dolný Kubín, Slovakia

Email: support@stckd.app · Phone: +421 940 857 804

Person in charge of personal information: Mário Otruba