PepBloom Privacy Policy

Osman Emre Gündoğdu, a sole proprietorship registered in Türkiye ("we", "us"), makes the PepBloom app. This policy explains what PepBloom keeps on your phone, what leaves it, who gets it and how to delete it.

Health data has its own policy: the Consumer Health Data Privacy Policy. It covers Washington, Nevada and Connecticut law and lists every kind of health data PepBloom handles.

1. What stays on your phone

Everything you enter into PepBloom is saved in the app's storage on your iPhone:

• medications, doses, schedules, medication groups (stacks), vial mixes, injection sites and dose notes
• side effects
• daily check-ins: hours and quality of sleep, energy, mood, appetite and food noise
• weight, goal weight, meals, protein, water and nutrition targets
• workouts you log: type, start time, length, effort and notes
• lab (bloodwork) results
• progress photos
• your setup answers (goals, starting weight)
• reminders, the inbox of past reminders and news, and the Home Screen and Lock Screen widget
• the feature ideas you sent and voted for, so you can see what happened to them
• your chats with the AI assistant, and the things you asked it to remember
• the time you agreed to our health-data terms

We can't see any of this. Your iPhone protects app files with its own encryption while the phone is locked. If you back up your iPhone to iCloud or a computer, Apple's backup includes PepBloom's files, the same as any other app's.

Progress photos stay on your phone. They aren't in PepBloom's backup and we never upload them. When you save one, PepBloom removes the location data from the photo. Meal and menu photos are used to fill in the meal or pick dishes, then deleted from the phone.

Exports. The doctor PDF and the CSV export are made on your phone. They only go where you send them.

Apple Watch. The PepBloom Apple Watch app shows your next dose and today's list, and what you log on the watch is saved through your iPhone. It only talks to your iPhone, so nothing goes to us or anyone else because of it.

2. What leaves your phone, and why

Any request over the internet also shows the receiving server your IP address. We don't use IP addresses to find your location.

Open Food Facts

When you scan a barcode, PepBloom sends only the barcode number. When you search, it sends only the words you typed. Open Food Facts never gets your name, account, weight, doses or any other health data. Open Food Facts is a public database with its own privacy policy; we have no contract with them, so we send them nothing that identifies you. Nutrition values come from their database and may be wrong. You can edit them before saving.

Account and backup

At the end of setup, the iPhone app asks you to Sign in with Apple, which turns on backup. In Türkiye you can skip it. When you sign in:

• We ask Apple for your email only, never your name. You can choose Apple's "Hide My Email" relay address.
• Your phone creates a 256-bit encryption key and keeps it in your iPhone's Keychain. Your phone encrypts your data with that key (AES-256-GCM) before uploading. The key never reaches us.
• Our server stores the encrypted file, your account ID, a version number, its size and the time. We can't open the file, and neither can Supabase.
• The backup holds everything PepBloom saves on your phone except progress photos, your first name and your reminder inbox, including your assistant chats and the things you asked it to remember. It updates on its own shortly after you change something, and when you leave the app.
• If you restore onto a phone that already has its own logs, chats or remembered facts, PepBloom shows what each copy holds and asks which to keep. It never replaces them without asking.
• You can view a recovery key in Profile > Settings > Account & Backup, after Face ID. You only need it on a new phone that wasn't set up from an iCloud backup of your old one. If you lose both your phone's key and your recovery key, we can't recover your backup for you.
• Outside Türkiye, the sign-in screen has its own unticked box, Email me tips and offers. Only if you tick it, your email goes to Resend, our email service, for PepBloom tips, offers and a reminder if you don't finish subscribing. PepBloom saves when you ticked it and the words it showed. Untick it in Profile > Settings > Account & Backup, or use the unsubscribe link in any email.

Usage totals

We count how often features are used as daily totals with no account, device ID or IP address attached, and we never try to link those totals to a person. We also count what people pick (a medication name, a dose, a schedule, a vial mix, a side effect, a lab marker). Each pick is added to a running total for that one value, with no account, device ID, IP address or link to anything else you picked, so we can see "40 people use 0.5 mg" but never who. We only look at values at least 5 people picked, and we delete any value fewer than 5 people picked within 90 days of the first time it arrived. You can turn both off in Profile > Settings > Privacy.

Subscriptions (Apple and RevenueCat)

Apple handles payment. We never see your card. RevenueCat gets your purchase and trial history and basic technical details (app version, iOS version, your App Store country and the IP address your phone connects from). Until you sign in with Apple (or first use the assistant), it files them under a random ID. After that, it files them under your account ID, so your subscription follows your account and our server can check it. RevenueCat never gets your email, name or any health data, and we don't add any other details to your RevenueCat record.

AI assistant

The assistant is off until you agree. Before your first question, PepBloom shows a separate permission screen that names Anthropic and Claude and says what will be sent. You can turn AI off at any time in Settings. When it's off, no AI request leaves your phone. Every other part of PepBloom works without AI.

• What's sent: your message, the chat so far, the things you asked it to remember, and only the PepBloom data your question needs. PepBloom asks before sharing each kind of data (your medications and dose logs; your meals, water and weight; your side effects; your daily check-ins), and you can allow it once or always. Meal and menu photos sent for a nutrition estimate are shrunk and stripped of location data first.
• What's never sent: your name, email, account ID, location, dose notes, progress photos, or anything read from Apple Health (weight, steps, workouts or sleep).
• How it travels: your phone sends the request to our server, which checks that you're signed in, removes any email addresses or US phone numbers in the text, and passes it to Anthropic. Our server doesn't save or log what you asked or what Claude answered, and it doesn't tell Anthropic who you are.
• Anthropic deletes API requests and answers within 30 days, and keeps a request for up to 2 years only if its safety systems flag it for review. Anthropic doesn't train its models on our requests.
• Changes need your OK. If the assistant suggests logging something, PepBloom shows you the entry first and saves it on your phone only when you tap Confirm.
• Your chats stay on your phone. PepBloom saves each chat on your phone so you can go back to it later from the assistant's chat list. You can delete one chat, or clear them all, from that list. If you use backup, your chats are in the encrypted backup too, which we can't read. Our server still keeps none of them.
• What the assistant remembers. You can ask the assistant to remember short facts, like "I inject on Fridays" or "vegetarian". It saves one only after you tap Remember, and it can suggest one but never saves it on its own. The list is saved on your phone and in your encrypted backup, and is sent with your questions while the assistant is on, so you don't have to repeat yourself. It never changes the assistant's rules: it still gives no dosing advice. To see, change or delete any of it, or tap Forget everything, go to Profile > Settings > What PepBloom AI remembers.
• Deleting chats and remembered facts removes them from your phone right away, and from your backup at the next backup, which runs on its own shortly after a change or when you leave the app.

Crash reports

If PepBloom crashes, Sentry gets the technical details: device model, iOS version, app version and where in the code it failed. We set it up so it gets no account ID, no screenshots, no text you typed, no food searches, no medication names and no web addresses with search terms. Crash reports are deleted after 90 days or less.

Community

The community is optional and needs Sign in with Apple. Nothing you log in PepBloom goes into it: other members see only what you choose to write there.

• Pseudonym. You post under a made-up name like "quiet-ring-482", which you can change. Other members never see your real name, email or account ID. Pseudonyms can't contain an email address. Our server links your pseudonym to your account so we can enforce the rules, and nobody outside PepBloom sees that link.
• What you post is public to members. Posts, comments and poll options can be read by every signed-in member. Poll votes are counted, and nobody sees who voted for what. Think before sharing details that could identify you.
• Your community activity stays separate from your health logs. Your doses, weight, meals and other logs are never attached to your profile or posts, and moderators can't see them.
• AI moderation. Before anyone else sees a post or comment, our server checks its text against the community rules, then sends it to Claude, an AI model made by Anthropic, to screen it. Anthropic gets only the text: no name, pseudonym or account ID. It deletes the request within 30 days (up to 2 years if its safety systems flag it), and doesn't train its models on it. Anything the check can't clear goes to one of our moderators.
• Reports. When you report a post, comment or person, we keep who reported, what, the reason and any note you add. The person you report never learns who reported them. Our moderators get an email saying a report came in, with the reason and a count. The email never includes post text, pseudonyms or anything about anyone's health.
• Blocks. When you block someone, we keep that you blocked them so their posts disappear for you and yours for them. They aren't told.
• Moderation records. When a moderator or the AI check publishes, holds or removes something, we record what happened and why, without the text.
• If someone may be in danger. If a post suggests someone may be in immediate danger, we may email that person at the address on their account to share crisis resources. Where we believe there is a serious and imminent risk to someone's life, we may share what's needed to help (such as the post and the account email) with emergency services. We do this only to protect life, and we record each time we do.

Our website and the launch list

pepbloom.app has no analytics scripts, ads or cookies. The calculators run in your browser, and what you type in them never leaves it. Our web host sees your IP address with each page request, like any website's host.

If you join the launch list, your email address goes to Buttondown, our email service, which also gets your IP address when you sign up. Buttondown first emails you a link to confirm. After that we send three emails at most: a beta invite, the pre-order link and the launch. Our emails have no open or click tracking, and each one has an unsubscribe link. The form sends only your email, never which page you were reading. We delete the whole list 30 days after PepBloom launches.

3. Apple Health

Apple Health sync is off until you turn it on in PepBloom (Profile > Settings > Apple Health) and allow it in Apple's permission screen.

• PepBloom reads: your weight, including from a smart scale. Each time you open PepBloom, it also reads your steps, workouts (including from Apple Watch and other apps) and sleep. Those are shown in PepBloom but aren't saved in PepBloom or its backup. The one exception: if you tap Save on the sleep hours in a daily check-in, that number is kept with the check-in.
• PepBloom writes: weight you log in PepBloom; calories, protein, carbs, fat and fiber from meals you log; water; and workouts you log (type, time and length, never effort or notes). When you change or delete a workout in PepBloom, PepBloom changes or deletes it in Apple Health too.
• PepBloom never writes your doses to Apple Health.

Weight read from Apple Health, and sleep hours you save in a check-in, stay on your phone (and in your encrypted backup, if you use one); steps, workouts and other sleep data stay on your phone only. None of it is used for advertising, marketing or data mining or sold, none of it is shared with third parties, and none of it is ever sent to the AI assistant. We never put it in iCloud Drive or CloudKit; only your iPhone's own backup includes it, like any app's files (see above). You can change what PepBloom reads and writes at any time in the Health app under Sharing > Apps > PepBloom.

4. Camera, photos and notifications

• Camera: to scan barcodes, take meal and menu photos and take progress photos. Barcodes are read on your phone; no picture is saved or sent.
• Photos: only the photos you pick, through Apple's photo picker.
• Face ID: before showing your backup recovery key.
• Notifications: dose reminders, refill alerts, the daily check-in reminder (if you turn it on), the trial-ending reminder and, after a plan ends, a note that reminders are paused plus at most two follow-ups (7 and 30 days later) are scheduled on your phone. We don't run a push server. Turn on Private reminders to hide medication and stack names in reminders and the widget.

5. What we don't do

• We don't sell your data, and we don't share it for advertising.
• We don't track you across other companies' apps or websites, and PepBloom doesn't ask to.
• We don't use third-party analytics, advertising or attribution tools.
• We don't use your location.
• We don't use your data to train AI models.
• We don't send your setup answers anywhere. They stay on your phone.

6. How long we keep things

Apple keeps its own purchase records under Apple's privacy policy.

7. Your choices and rights

In the app:

• Erase all data (Profile > Settings > Account & Backup, when you're not signed in) deletes everything PepBloom keeps on your phone: logs, photos, settings and scheduled reminders.
• Delete account (Profile > Settings > Account & Backup, when you're signed in) deletes your encrypted backup and account from our server, deletes your RevenueCat record, revokes PepBloom's Sign in with Apple access, and erases your phone. Deleting your account doesn't cancel an Apple subscription; cancel it in iPhone Settings > [your name] > Subscriptions.
• Export your data as a PDF or CSV at any time, with or without a subscription.
• Turn off Apple Health sync, AI features, usage totals and reminders in Settings.

By email: write to privacy@pepbloom.app to ask what we hold about you, get a copy, correct it, delete it, or withdraw consent. We answer within 45 days. If we need more time (up to 45 more days), we'll tell you why. Requests are free up to twice a year. If you never made an account, we hold almost nothing about you; to delete your RevenueCat record, send the Apple order ID from your purchase receipt email.

If we say no, you can appeal by replying to our answer with "Appeal". We'll decide within 45 days and explain why. Washington residents can then contact the Washington Attorney General, Connecticut residents the Connecticut Attorney General, and Nevada residents the Nevada Attorney General. Users in Türkiye can also complain to the Personal Data Protection Board (section 11).

State laws. Washington, Nevada and Connecticut give you specific rights over health data; see the Consumer Health Data Privacy Policy.

California. The California Consumer Privacy Act applies to companies above certain size limits, which we're under today. We give Californians the same rights anyway: to know what we hold, get a copy, correct it and delete it, with no different treatment for using them. We don't sell or share personal information as the CCPA defines those words, and we don't use sensitive personal information to infer things about you. We treat what you log as medical information under California's Confidentiality of Medical Information Act and don't disclose it without your permission. We don't share personal information with others for their direct marketing.

Do Not Track. PepBloom doesn't track you across sites or apps, so there's nothing for a Do Not Track signal to switch off.

8. Security

• Data travels over encrypted connections (HTTPS).
• Backups are encrypted on your phone before upload, with a key we never receive.
• Each account can read only its own backup, enforced in the database.
• Only the owner can access our server systems, with two-factor login.
• Our server never stores or logs the content of AI requests.

No system is perfect. If a breach affects your data, we'll notify you as the FTC Health Breach Notification Rule and state laws require, within 60 days of finding it, by email and in the app, and we'll tell the FTC (and, if 500 or more people in one state are affected, local media) as the Rule requires.

9. HIPAA

HIPAA covers doctors, health plans and companies working for them. You download PepBloom yourself and enter your own data, so HIPAA doesn't apply to PepBloom. Your data is protected by the rules in this policy, the FTC Act, the FTC Health Breach Notification Rule and state health-privacy laws. If your doctor's office gets a report you send them, their own rules apply from then on.

10. Children

PepBloom is for adults 18 and over. We don't knowingly collect data from anyone under 18. If you think a child is using PepBloom, write to privacy@pepbloom.app and we'll delete what we hold.

11. Where PepBloom is offered

PepBloom is offered worldwide, except in the European Union, the European Economic Area (Norway, Iceland and Liechtenstein), the United Kingdom and Switzerland. We run PepBloom from Türkiye. Our servers and the companies we work with process data in the United States.

Türkiye (KVKK)

The data controller under Turkish Law No. 6698 on the Protection of Personal Data (KVKK) is Osman Emre Gündoğdu, a sole proprietorship registered in Türkiye, privacy@pepbloom.app. This applies to everyone who uses PepBloom, wherever you live. Users in Türkiye can read our Turkish-language Aydınlatma Metni.

• Health data is processed only with your explicit consent under Article 6 of Law No. 6698. You can withdraw it at any time as section 7 explains.
• Transfers abroad. We transfer personal data to the companies in section 12, which are in the United States, under the standard contracts approved by the Turkish Personal Data Protection Board, as Article 9 of Law No. 6698 requires, and we notify the Authority of these contracts.
• Your rights under Article 11: to learn whether we process your data, get information about it, learn its purpose and who receives it in Türkiye or abroad, have it corrected or deleted, object to a result reached only by automated processing, and claim compensation for unlawful processing. Write to privacy@pepbloom.app. We answer within 30 days, free of charge. If you're not satisfied, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).
• Marketing email. We send marketing emails to users in Türkiye only with your prior consent under Law No. 6563, recorded in the İleti Yönetim Sistemi. You can unsubscribe from any email at no cost.

12. Companies we work with

Supabase, RevenueCat, Anthropic, Sentry, Resend and Buttondown work under contracts that let them use the data only to provide their service to us.

13. Changes

If we change this policy in a way that matters, PepBloom will tell you in the app before the change applies. If a change means using data you already gave us in a new way, we'll ask for your permission first.

14. Contact

Osman Emre Gündoğdu
Türkiye
privacy@pepbloom.app