Privacy Policy

DoseCraft is operated by Jonathan Cimadevilla. This Privacy Policy explains how we collect, use, and protect your personal information when you use the DoseCraft application and related services (collectively, the “Service”).

We collect the following categories of data:

• Account data:email address and password (stored as a cryptographic hash — we never store your plaintext password).
• Dose logs: peptide names, dosage amounts, timestamps, injection sites, and any notes you add.
• Protocol data: protocol configurations, schedules, and compound selections.
• Health notes: optional wellness entries, side-effect notes, and progress observations you choose to record.
• Usage data: pages visited, features used, and general analytics to improve the Service.

Your data is used exclusively to:

• Provide, maintain, and improve the Service.
• Generate personalized insights, charts, and reports from your logs.
• Power AI features (e.g., protocol suggestions, fact-checking) using anonymized or pseudonymized inputs.
• Send transactional emails (password resets, account alerts).
• Comply with legal obligations.

We share data only with trusted service providers who process it on our behalf:

• Stripe— payment processing. Stripe receives your payment details directly; we never store card numbers.
• PostHog— product analytics. Collects anonymized usage data (pages visited, features used, session duration) to help us improve the Service. No personally identifiable health data is sent to PostHog.
• Sentry— error monitoring. Captures application errors and performance data to help us diagnose and fix issues. May include device type, browser version, and anonymized session context.
• Resend— transactional email delivery. Processes your email address to send account-related emails such as verification, password resets, and subscription notifications.
• Neon (PostgreSQL) — database hosting for your account and log data.
• Vercel— application hosting and edge delivery.
• Groq / Anthropic — AI inference for chat, fact-checking, and protocol features. Inputs are processed transiently and not used to train third-party models.

We do not sell, rent, or trade your personal information to any third party — ever. Your health-related data is yours. We act solely as a data processor on your behalf.

We implement industry-standard security measures including encrypted connections (TLS), hashed passwords (bcrypt), environment-variable secret management, and access controls. While no system is 100% secure, we take every reasonable step to protect your data.

Your data is retained for as long as your account is active. You may delete your account and all associated data at any time through the following methods:

• In-app: Navigate to Profile → Delete Account. You will be asked to confirm with your password and type “DELETE” to proceed.
• Email: Send a deletion request to hello@dosecraftapp.com from the email address associated with your account.

Upon deletion, all personal data including dose logs, protocols, chat history, and preferences are permanently removed. Any active Stripe subscription is automatically cancelled. Data is removed from active systems immediately and from backups within 90 days.

Depending on your jurisdiction, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Deleteyour data (“right to be forgotten”).
• Port your data in a machine-readable format.
• Opt out of the sale of personal information (we do not sell data, but you may exercise this right under CCPA).
• Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at hello@dosecraftapp.com. We will respond within 30 days.

DoseCraft uses the following cookies and tracking technologies:

• Essential cookies: authentication tokens and session management. Required for the Service to function.
• Analytics cookies (PostHog): anonymized usage analytics including pages visited, features used, and session duration. These cookies help us understand how users interact with the Service so we can improve it. You may opt out of analytics cookies via the cookie consent banner.
• Preference cookies: store your display preferences such as theme and cookie consent status.

We do not use third-party advertising trackers. No data collected through cookies is sold to or shared with advertising networks.

DoseCraft is not intended for use by individuals under 18 years of age. We do not knowingly collect data from minors. If you believe a minor has provided us with personal information, contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. Material changes will be communicated via email or an in-app notice. Your continued use of the Service after changes constitutes acceptance of the updated policy.

For questions, data requests, or concerns about this Privacy Policy, contact us at: hello@dosecraftapp.com