Member privacy policy

Information you provide

• Account information: your email or linked sign-in identity, passkey public credential data, account identifiers, sessions and the policy versions you agree to. Apple or Google supplies identity information and authorization material when you use that method. PepClub does not receive your Apple or Google password, or a passkey's private key.
• Profile and community information: your chosen handle, display name, bio, any stage you choose to disclose, memberships, follows, posts, replies, drafts, saves and reactions. Media is processed only through an enabled upload feature.
• Messaging information: message requests, participants, messages and delivery or read state where supported. Messages can include health information you choose to send.
• Private Journey information: records you enter, such as weight, treatment or dose logs, symptoms, reflections and photos, in features that support those fields. Records kept only on your device are not silently imported into your account.
• Safety and support information: reports, relevant content snapshots, notes, appeal statements, decisions, acknowledgements and support requests. An identifier linked to your account remains personal information even if your real name is absent.

Health details can also appear in a profile, post, message or support email. You choose what to enter; do not include another person's private health information without permission.

Technical information

Hosting and security processing can receive your network address, request time, country code, device or browser information and error details. Cloudflare processes requests and maintains its own service logs. Sign-in and abuse controls use keyed hashes for certain email and network-address checks; hashing does not make those records anonymous.

Enabled web sign-in uses a host-only session cookie with Secure, HttpOnly and SameSite=Lax settings and a seven-day expiry. It keeps you signed in and is not an advertising cookie. Native sign-in stores account access and recovery material in the device's protected storage. Enabled notification delivery also uses device registration and delivery identifiers.

Why we use it

We use information to verify sign-in, provide the features you request, enforce audiences and privacy settings, deliver messages and requested notices, recover uncertain saves, address abuse, handle reports and appeals, and process supported export or deletion requests. We may also need information to comply with law or respond to a valid legal demand.

Optional Journey cloud sync requires a separate notice and explicit opt-in. Accepting this policy does not enable it. Turning sync off stops cloud access but does not delete records already stored there. Sharing a Journey card is a separate choice and discloses the selected fields or image to its chosen audience.

Who can see what

Ordinary community posts are available to signed-in members, including those who have not joined that community. Restricted communities and invited circles limit the audience further. Member posts are not offered for public search-engine indexing. A link, follow or external group membership does not grant access to a restricted audience.

Profile discovery depends on your visibility choice and the current published profile. Hiding your profile does not change the audience of existing posts. Your email, linked identity and private Journey fields are not part of the member-facing profile.

Private drafts and Journey records are not shown to other members unless you separately share content. Direct messages are shown to authorized conversation participants. PepClub does not offer end-to-end encrypted messaging. Authorized service processing is still needed to store and deliver data; "private" does not mean the service has no technical access.

A participant can report a message through an enabled report feature. The specific reported revision and relevant note then become restricted safety evidence available to authorized reviewers. Reporting is separate from automatic message screening. Members may also retain screenshots or external copies despite the community rules; we cannot recall those copies.

Service providers and screening

Cloudflare hosts the website and member services, databases and enabled file storage. The configured email service receives the destination and message needed to deliver a requested sign-in code or notice. Queued verification emails are encrypted in application storage before delivery. Apple and Google process sign-in through their own services when you select them; their privacy policies apply to that processing.

When approved and enabled, community text intended for all signed-in members may be sent to TypeSafe's Jev service for safety screening, including relevant parent text for a reply. Private drafts, private messages, restricted-community and circle text, and private Journey records are outside that screening boundary. Report evidence is not sent to TypeSafe. Processor approval and configuration are required before screening can run.

We do not sell personal information or use it for targeted advertising. We use PostHog to measure screen visits, interactions, scroll positions, feature outcomes, performance and errors, and to collect masked session replays. Signed-in activity uses a pseudonymous account identifier. We exclude sign-in secrets, message and post bodies, private Journey values, images and typed input from analytics. You can turn off usage and diagnostics in app settings or at the bottom of the website. We do not use advertising tracking pixels. We do not use private Journey records as general-purpose model training data. Providers may process information outside your country; this policy does not promise that data stays in a particular region.

We may disclose information where required by law or necessary to address a serious safety or security issue. Such a disclosure must be limited to the information needed for that purpose.

Copies on your device

Web forms can save account-scoped browser recovery copies of drafts, pending commands, report notes and request recovery keys. Signing out, disabling sync or deleting a server draft does not automatically clear those copies. Review and clear them in the relevant feature, or clear this site's browser data. Clearing a local copy does not cancel a command already received by the server or erase cloud data.

Device-only Journey records and downloaded files remain on your device until you remove them. Device or browser backups may retain copies. Anyone holding an exported deletion-status recovery file can check its minimal request status while the key is valid; protect that file.

Retention, export and deletion

Account data remains while needed to provide the features you use, subject to deletion, security, safety and legal obligations. Different records have different purposes and deadlines. This policy does not establish a single retention period for all account data.

An enabled report form shows its specific evidence notice and retention terms before you submit. An accepted report keeps those terms; a later notice does not silently extend them. Safety evidence, appeal material and minimal audit records may need separate retention, and an open case or authorized hold can delay erasure. Ordinary moderation retention rules are approved; release still requires verified cleanup and restoration. Any new hold rule requires separate approval.

Where exports are enabled, you can request a private archive of your own account data. A ready archive expires after 24 hours and download requires recent sign-in. An export covers its stated collection window; it does not grant access to another member's private information.

Where deletion intake is enabled, an accepted request closes account access and sessions and makes exports unavailable. A receipt is not a completed-deletion certificate. PepClub currently cannot confirm completed account deletion, and a request may remain pending. Completion must account for retained cases, separate stores and restore or backup obligations. Messages or structural conversation records retained for other participants are not automatically erased by signing out or requesting deletion.

Removing local recovery, clearing a shared post, deleting a private record and deleting an account are separate actions. Contact hello@joinpepclub.comif the controls you need are unavailable.

Your choices and privacy requests

Use enabled settings to control profile discovery, linked sign-in methods, blocks and notifications. Choose separately whether to sync a private Journey or submit a report. You may request access, correction or deletion by emailinghello@joinpepclub.com. We may need to verify your identity without collecting unnecessary health details. Rights and permitted exceptions depend on applicable law; this policy does not remove rights you have under that law.

PepClub is intended for adults aged 18 or older. Do not create an account for a child or submit a child's private health records. Contact us if you believe a child has provided personal information.

Material changes will have a new version and notice. Additional consent is required where applicable; changing this page alone does not enable optional processing. See thewebsite privacy notice, member terms andcommunity rules.