Privacy Policy
Summary
Atlas is designed to be private by default. Your logs — workouts, meals, protocols, doses, journal entries, health metrics, achievements — are stored on your device and, if you have iCloud enabled, in your private iCloud database, which is between you and Apple — we cannot access it. We run no ads, no tracking, and no user-data backend of our own. A small number of network services are used, each described in its own section below: Apple's StoreKit and optional Sign in with Apple; the RevenueCat SDK for subscription infrastructure; Open Food Facts for barcode lookups; and — only when you invoke them — three optional AI features (meal photo scanning, the research assistant, and the weekly summary) that send the minimum needed to our own proxy server, which forwards it to Anthropic's Claude API and stores nothing.
What data the app handles
Data stored locally on your device
- Protocol and dose data you create (peptide name, dosage, schedule, notes)
- Usage history (dose logs, adherence streaks, achievements)
- Your profile (optional: display name, body metrics, goals, preferences)
- App settings
This data is stored in your device's local app container using Apple's
standard persistence frameworks (SwiftData and UserDefaults) and,
where applicable, shared with the Atlas Widgets extension and
Atlas Watch app via an App Group. It is not
transmitted to us or anyone else.
iCloud sync (optional, automatic)
If you are signed into iCloud on your device, Atlas uses Apple's CloudKit framework to sync your protocols and entries through your private iCloud database. This sync is end-to-end between your devices and Apple's servers; we do not have access to the data, and Apple's privacy policy governs storage. You can disable this in Settings → [Your Name] → iCloud → Atlas.
Apple Health (HealthKit)
With your permission, Atlas reads the following metrics from Apple Health to show recovery trends and correlate them with what you log:
- Heart rate
- Heart rate variability (HRV, SDNN)
- Resting heart rate
- Sleep
- Body mass
- Step count
- Active energy burned
If you turn on "Write meals to Apple Health" (off by default), Atlas also writes the calories, protein, carbohydrates, and fat of meals you log into Apple Health. Nothing else is written.
HealthKit data is analyzed on your device, with one opt-in exception: if you enable the AI weekly summary (an Atlas Pro feature with its own toggle), weekly averages of HRV, resting heart rate, and sleep hours — no raw samples, no identifiers — are sent to our AI proxy and on to Anthropic's Claude API to generate your recap. Our proxy does not store them; Anthropic processes them under its commercial API terms. Turning the toggle off stops that flow entirely. You can revoke HealthKit access at any time in Settings → Privacy & Security → Health → Atlas.
Camera, photos, and AI meal scanning (optional)
The camera is used for three things you start yourself: scanning food barcodes, reading nutrition labels (processed on-device), and photographing meals for AI nutrition estimation. A meal photo you submit is sent over HTTPS to our proxy server, forwarded to Anthropic's Claude API for analysis. Our proxy does not store it; Anthropic processes it under its commercial API terms. Barcode images and label scans never leave your device; an optional profile photo is stored locally. If you pick a meal photo from your library, Atlas reads only that photo and its capture date.
AI research assistant and weekly summary (optional, Atlas Pro)
The research assistant sends your chat messages (plus relevant entries from the bundled research database) to the same proxy → Claude API path. The weekly summary sends the aggregate described in the HealthKit section plus adherence and nutrition averages. Requests are authenticated and rate-limited, are processed transiently, and are not used to train models. If you never invoke these features, nothing is ever sent.
Subscription infrastructure (RevenueCat)
Atlas uses the RevenueCat SDK in observer mode to keep subscription status reliable. RevenueCat receives purchase/entitlement information from Apple's StoreKit under an anonymous app-user identifier — not your name, email, or health data — and acts as our processor for that purpose. See RevenueCat's privacy policy.
Open Food Facts
Barcode and food-name lookups query the public Open Food Facts database. The barcode or search text you enter is the only user input sent.
Sign in with Apple (optional)
If you choose to sign in with Apple, Atlas stores the opaque Apple user identifier, and — only when Apple provides them on first sign-in — your name and relay email, in your device's Keychain. These values are used solely to personalize the app and to detect when you revoke access. They are not transmitted to us. You can sign out at any time inside the app, and you can revoke the app's access at any time in Settings → Apple Account → Sign in with Apple.
Using Atlas does not require signing in. Every feature works without an account.
Notifications
Atlas schedules local dose reminders on your device using iOS's
UserNotifications framework. Notification content never
leaves your device and is not delivered through any remote push service.
Purchases (StoreKit)
Subscriptions and one-time purchases are processed by Apple via StoreKit. Atlas receives a purchase receipt from Apple to unlock paid features; it does not see or store your payment details. Apple's own privacy policy governs the purchase itself: apple.com/legal/privacy.
Biometric authentication (Face ID / Touch ID)
If you enable the app lock, authentication is performed on-device by Apple's LocalAuthentication framework. Atlas never receives your biometric data — only a yes/no result from the system.
What we do NOT collect
- No advertising or tracking identifiers (IDFA or otherwise)
- No ad networks, data brokers, or cross-app tracking SDKs
- No crash-reporting or telemetry uploads (diagnostics stay on-device)
- No precise or coarse location
- No contacts and no microphone
- No storage of your logs, photos, or health data on our servers
Atlas's App Privacy manifest (PrivacyInfo.xcprivacy)
declares NSPrivacyTracking = false. Its collected-data
list contains exactly two entries — Purchase History and an anonymous
User ID — reflecting the RevenueCat subscription infrastructure
described above; neither is linked to your identity or used for
tracking.
Data sharing
We do not sell, rent, or share your personal data. The only parties that process data on our behalf are the ones this policy names — Anthropic (transient AI request processing) and RevenueCat (subscription status) — each limited to the specific data described above. Your logs and health history never leave your device or your private iCloud database.
Data export and deletion
- Export: Atlas Pro subscribers can export all protocol history and tracking data as CSV, JSON, or PDF from Profile → Data Export. If you are not a Pro subscriber and need a copy of your data for legal or portability reasons, email privacy@peptidesai.com and we will walk you through a manual export at no charge.
- Deletion: deleting the app from your device permanently removes all Atlas data stored locally. To also remove the iCloud copy, sign into iCloud.com and delete the iCloud.com.peptidesai.app container, or wait — uninstalling from all your devices clears it within Apple's normal retention window. If you signed in with Apple, also revoke app access in Settings → Apple Account → Sign in with Apple to complete removal of the Keychain-stored identifier.
Because we do not operate a backend server of our own, there is no remote copy of your data on our systems for us to delete.
Children
Atlas is not directed at children under 13 and should not be used by them. The app is intended for adults making informed decisions in consultation with a qualified healthcare provider.
Medical disclaimer
Atlas is an educational and tracking tool. It is not a medical device, and it does not provide medical advice, diagnosis, or treatment. Many substances referenced in the peptide database are research chemicals not approved for human use. Always consult a qualified healthcare provider before starting, changing, or stopping any protocol.
Your rights (GDPR / UK GDPR / CCPA)
Because all personal data is stored on your device or in your private iCloud database, under your direct control, you can exercise the following rights at any time:
- Access / portability: Pro subscribers can export via Profile → Data Export; non-subscribers may request a free manual export by emailing privacy@peptidesai.com.
- Rectification: edit any entry directly in the app.
- Erasure: delete entries in the app, or uninstall to remove everything. Uninstalling works regardless of subscription status.
- Withdraw consent: revoke HealthKit or Sign in with Apple access in iOS Settings as described above.
We do not sell personal information as defined by the California Consumer Privacy Act (CCPA). We do not have a Data Protection Officer because we do not process personal data on our own systems.
Security
Data is protected by the standard iOS sandbox and, for credentials, the
iOS Keychain with kSecAttrAccessibleAfterFirstUnlock.
Enabling Face ID / Touch ID app lock adds a second barrier. No security
measure is perfect; enabling a device passcode and keeping iOS up to
date materially improves protection.
Changes to this policy
If this policy changes, the effective date above will be updated and the updated version will be made available at the same URL from which you are reading this. Material changes will also be surfaced in-app.
Contact
Questions or privacy requests: Peptides AI — privacy@peptidesai.com