Privacy Policy

Last updated: September 26, 2026

This policy explains what information Peptides·Index ("we", "us") collects when you use peptides-index.com, why we collect it, who processes it on our behalf, and the choices you have. It describes how the site actually works today. When that changes, we update this page and the date above.

The short version#

You can browse every price, page and guide without an account and without telling us who you are.
We use Google Analytics to understand how the site is used. You can switch it off (see Your choices).
When you click through to a vendor, we log the click without storing your IP address.
If you sign in, fill in a form, request coaching or take the stack quiz, we keep what you give us. Every email we send goes through our email and CRM provider, GoHighLevel, which keeps each recipient as a contact along with a copy of the message.
We don't sell your personal information for money.

Information you give us#

Where	What we collect	Why
Sign-in and account	Email address; a 4-digit PIN if you set one (stored only as a one-way hash)	To sign you in with an emailed link or code, or with your PIN
Account features	Price alerts and their settings, and vendors you mark as favorite or hidden	To keep these across devices and send the alerts you ask for
Contact form	Name, email, topic, message, and the page or listing you're writing about	To read and answer your message
Stack quiz	Your goals, experience level, age, sex, health conditions you choose to tell us about (including anything you type under "Something else"), lifestyle, region, compounds you already use, preferred approach and stack size; name and email if you give them	To build your stack suggestions, to see how the quiz is used, and to follow up if you give an email
Email sign-ups and free-guide requests	Name (for the guide) and email	To send what you signed up for
Coaching requests	Name, email and phone number, and the plan you chose	To contact you about the coaching plan
Vendor applications and the vendor portal	Contact name, email, company, website, store platform, the commission and reader discount offered, notes, confirmations ticked, and the IP address the application was sent from; later, your product and order feeds	To review the application, integrate your store and attribute sales

Other things you save, such as favorite compounds and your stack, stay in your browser and aren't sent to our database (see Cookies and browser storage).

Signing in#

When you enter your email address to sign in, we create an account record for that address and email you a one-time link and code. That happens even if you never use the link. Like every email we send, it's delivered through GoHighLevel, which saves the address as a contact and keeps a copy of the message.

The stack quiz#

You never have to tell us about a health condition: "None of these" is always an answer. When you finish the quiz, all your answers, including age, sex and any health conditions, are emailed to us so we can see how the quiz is used and improve it. That happens whether or not you gave an email address, and the email is delivered through GoHighLevel, which keeps a copy. If you do give an email address, your name, email and answers are also saved as a contact in our CRM.

To generate your suggestions, part of your answers is sent to our AI provider: your goals, experience level, preferred approach and lifestyle. Your name, email, age, sex and health conditions are not included in that request. Your answers are also kept in your own browser so you can come back to your results. They aren't saved to your account.

Coaching requests#

Our link-in-bio pages offer paid coaching plans. When you request one, your name, email, phone number and chosen plan are saved as a contact in our CRM and emailed to us. Payment isn't processed on this site at present, and no card details are sent to us or stored.

The AI assistant#

If you use the assistant on the stack results page, what you type is sent to our AI provider, OpenAI, together with the page you're on and the compounds in your stack, so it can answer. If you have replies read aloud, the reply text is sent to OpenAI to be turned into speech. If you use voice mode, your browser connects directly to OpenAI and streams your voice to it, which means OpenAI also receives your IP address. The conversation is saved in your browser so it survives a page reload. We don't store it in our database.

Vendor payments#

Approved vendors pay the onboarding fee through a payment link hosted by GoHighLevel. We never receive or store card numbers.

Information collected automatically#

Analytics#

On peptides-index.com we load Google Tag Manager, which runs Google Analytics 4. Google Analytics records the address of each page you view, how you got here, your device and browser type, and an approximate location that Google derives from your connection. Google sets its own cookies to do this.

We also send Google Analytics a small set of named events so we know which features get used:

a catalog search (your search text is lowercased, cut to 60 characters, and anything that looks like an email address or phone number is removed first);
a click on a Buy link, including the vendor link it leads to, and opening the discount-code step before it;
copying a discount code;
adding a compound to your stack, or opening the stack drawer;
seeing or clicking a Featured deals card on the home page;
switching or sharing a tab on our link-in-bio pages.

These events carry compound names, vendor names, counts and page positions. Our tracking script drops fields with the names email, phone, name, first_name, last_name, address, password, token and user_id, and removes email, phone and token-type parameters from the vendor links it sends. Google's own use of this data is described in How Google uses information from sites that use its services.

Outbound click log#

When you click a Buy link to a vendor, our own server records:

the vendor, compound, size and where on our page the link was;
the campaign source that brought you here (for example "x" when you arrived from one of our posts on X), if there was one;
your browser's user-agent string, used to filter out bots;
the time of the click;
a short hashed value made from your IP address and browser.

We don't store your IP address in the click log. The hashed value is not stored in readable form: it is keyed with a secret that changes every day, and it is used only so that a double-click counts once. The click log is not linked to your account.

We also add a random reference code to the vendor link (the pi_click parameter). If you place an order, the vendor can report that code back to us with the order's total, discount and items, so we can confirm the commission. Vendors also report orders placed with our readers' discount code, even without a click. Vendors don't send us your name, email or address. Once you've switched analytics off in your browser (see Your choices), no click is logged.

Security and abuse prevention#

We use IP addresses to limit abuse. For example, a single address can send at most 5 contact messages an hour, and sign-in attempts and wrong PIN guesses are throttled. To do this we keep:

rate-limit records that contain the IP address (or, for IPv6, its network prefix). They're deleted by an automatic cleanup once they're more than 24 hours old; the cleanup runs periodically, so a record can last somewhat longer than that;
hourly counts of account lookups per IP address for up to 14 days;
the IP address a sign-in request came from, kept with the sign-in link until it expires and is deleted;
the browser user-agent string of each signed-in session.

Like any website, our hosting providers process standard request information, such as IP address, browser type and the page requested, in order to serve pages and protect the service.

Cookies and browser storage#

We use a small number of our own cookies, plus Google Analytics cookies when analytics is on.

Name	Type	Purpose	Lasts
pt_session	Cookie (our own, not readable by page scripts)	Keeps you signed in	30 days, extended while you use the site
pt_session_seen	Cookie (our own, not readable by page scripts)	Records when the sign-in cookie was last refreshed	30 days
pep_src	Cookie (our own, not readable by page scripts)	Remembers which campaign brought you here, for the click log	30 days
pep_no_analytics	Cookie and local storage (our own)	Remembers that you switched analytics off	2 years
Google Analytics cookies	Cookies set by Google	Measure visits and usage	Set by Google

We also keep some information in your browser's local storage and session storage. It stays on your device and isn't sent to our database. That includes your theme and table settings, favorite compounds, your stack, quiz answers and results, the assistant conversation, the last email address you signed in with, a hashed record of which addresses have a PIN on this device, scroll position, and the last discount code you copied. Clearing your browser's site data removes all of it.

How we use information#

We use the information above to:

run the price tracker and the features you use, including sign-in, saved preferences and price alerts;
answer your messages and coaching requests;
review and onboard vendors, and confirm affiliate commissions;
understand which pages and features are useful, and fix what isn't working;
prevent spam, abuse and fraud, and keep the service secure;
meet legal obligations.

We use these service providers to run the site. They process information on our behalf:

Provider	What they do for us
Google (Tag Manager and Analytics)	Website analytics
GoHighLevel (LeadConnector) and its email-delivery partners	Sends every email from the site (sign-in links and codes, price alerts, vendor emails and notifications to us, including contact messages and quiz answers). Keeps each recipient as a contact with a copy of each message. Stores contacts from forms, the quiz, coaching requests and vendor applications. Hosts the vendor payment link
OpenAI	Powers the AI assistant, its voice mode and read-aloud replies, and the quiz's stack suggestions
Netlify	Hosts the website. The contact form also sends a copy of each message to Netlify's form service, which may store it
SiteGround	Hosts our server and database

Vendors receive the random reference code on the links you follow, as described above. We may also disclose information if the law requires it, to protect our rights or users' safety, or as part of a sale or transfer of the site.

We don't sell your personal information for money, and we don't give your contact details to vendors.

How long we keep it#

Emailed sign-in links and codes expire after 15 minutes. Expired ones, and the IP address recorded with them, are deleted automatically.
A sign-in session lasts 30 days from your last visit and is deleted automatically once it expires. Signing out ends it immediately.
Account records, including those created by a sign-in request that was never completed, are kept until you ask us to delete them, along with any price alerts and vendor preferences.
Rate-limit records and account-lookup counts are kept for the periods described under Security and abuse prevention.
Click-log entries are kept as records of affiliate activity. They contain no IP address.
Contact messages, quiz and coaching notifications, and GoHighLevel contacts and message history are kept until you ask us to delete them.
Information stored in your browser stays there until you clear it.

Your choices#

Switch off analytics. Type peptides-index.com/?notrack into your browser's address bar. This stops Google Tag Manager and Google Analytics loading in that browser and also stops our click log recording your clicks. Use peptides-index.com/?dotrack to switch it back on, and peptides-index.com/?trackstatus to check the setting. Google also offers a Google Analytics opt-out browser add-on.
Price alerts. Manage or turn off your alerts from your account.
Email. To stop hearing from us, use the unsubscribe link in a marketing email if it has one, or ask us through the contact form.
Browser storage. Clear this site's data in your browser settings.
Access, correction and deletion. Ask us through our contact form and tell us the email address you used. Accounts can't yet be deleted from the account page, so send us a request. A deletion covers your account and everything saved to it in our database, and your contact record and message history in GoHighLevel.

Your rights under US state privacy laws#

Depending on where you live, state privacy laws may give you rights over your personal information. These can include the right to know what we hold about you, to get a copy of it, to have it corrected or deleted, and to opt out of its sale, of sharing for targeted advertising, or of profiling. Some states also give you the right to appeal if we turn down a request.

You can make any of these requests through our contact form. We'll need to confirm the request comes from you, usually by replying to the email address on file. You can use an authorized agent where your state's law allows it. We won't treat you differently for exercising your rights.

Children#

Peptides·Index is meant for adults and is not directed at anyone under 18. We don't knowingly collect personal information from children. If you believe a child has given us information, contact us and we'll delete it.

Security#

PINs are stored using a slow one-way hash (argon2id). Sign-in links, codes and session tokens are stored only as hashes. The sign-in cookie can't be read by scripts on the page. No website can promise perfect security, so please use a PIN you don't use anywhere else.

Vendor and third-party websites#

When you follow a link to a vendor, Amazon or another third-party site, you leave Peptides·Index. From that point that site's own privacy policy applies, including any cookies it sets and anything you give it when you order.

Changes to this policy#

When our practices change, we'll update this page and the "Last updated" date at the top. If a change materially affects information we already hold about you, we'll give notice on the site or by email before it applies.

Contact us#

For privacy questions or requests, use our contact form. See also our Terms of Use and About pages.