Privacy Policy
Effective date: May 1, 2026
This Privacy Policy describes how The Formularie ("we," "us," or "our") collects, uses, stores, and protects information from users ("you") of The Vial — Peptide Calculator mobile application and the website at theformularie.com (collectively, the "Service").
By using the Service, you consent to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.
1. Who we are
The Service is operated by The Formularie.
Privacy questions and data-subject requests: [email protected]
2. Information we collect
2.1 Information you provide directly
- Account information: name, email address, password (stored as a salted hash by our authentication provider — we never see your plaintext password)
- Profile information: display name, optional phone number
- Health-tracking data you choose to log: peptide protocol details (peptide name, dose, frequency, schedule), outcome logs (weight, mood, energy, sleep quality, skin, recovery, symptoms), reminders you create, notes you attach to log entries
2.2 Information collected automatically
- Device information: device type, operating system version, app version, language preference
- Usage information: which screens within The Vial app you visit, which features you use, and errors or crashes that occur in the app. We do not see anything you do in other apps or elsewhere on your device.
- Authentication tokens: refresh tokens issued by our authentication provider, optionally stored in your device's Android Keystore when you enable biometric sign-in
- Push notification token: an anonymous identifier provided by Firebase Cloud Messaging (FCM) when you enable reminder notifications
2.3 Biometric data
When you enable biometric sign-in (fingerprint or face unlock on Android), we do not see or store your biometric data. Biometric matching happens entirely on your device. We store only an encrypted token in your device's secure keystore, which is unlocked by a successful biometric match. The token can be cleared at any time via the in-app Privacy Vault.
2.4 Information we do NOT collect
- We do not collect precise location data
- We do not access your contacts, photos, microphone, or camera
- We do not collect or process payment information (the Service does not accept payments)
- We do not send your data to any AI or machine-learning provider
- We do not run any third-party advertising or analytics SDKs that track you across other apps or websites
- We do not sell or rent your personal information
3. How we use your information
We use information for the following purposes:
- Provide the Service: authenticate you, store your protocols and logs, calculate doses and reconstitution volumes, render charts, send reminders you scheduled
- Communicate with you: password-reset emails, support replies
- Improve the Service: aggregate, anonymized analysis of feature usage and crash reports
- Comply with legal obligations: respond to lawful requests from law enforcement, prevent fraud, enforce our Terms of Service
We do not use your information for cross-app tracking, behavioral advertising, or sale to data brokers.
4. Third parties we share information with
We share specific subsets of your data with the following service providers, each bound by confidentiality and data-protection obligations.
| Provider | Data shared | Purpose |
|---|---|---|
| Supabase | Account, profile, protocols, outcome logs, encrypted vault payloads | Primary backend database, authentication, file storage |
| Google (if Google sign-in) | Email address, name, profile picture | OAuth sign-in |
| FCM | Anonymous push token, notification payload | Deliver reminders you scheduled |
We do not share your peptide protocols, outcome logs, symptoms, weight, mood, or sleep data with any party other than the service providers listed above, and only as necessary to provide the Service.
We may disclose information to comply with legal process, prevent fraud or harm, or in connection with a corporate transaction (merger, acquisition, asset sale), in which case we will notify you and give you the opportunity to delete your data before transfer.
5. Data retention
- Account data: retained while your account is active. Upon deletion request, removed within 30 days from active systems and within 90 days from backups.
- Outcome logs and protocols: deleted with your account.
- Encrypted vault payloads: deleted with your account.
- Crash reports and aggregate analytics: retained in anonymized form indefinitely.
6. Your rights
Depending on your location, you may have the following rights regarding your personal data:
- Access: request a copy of the personal data we hold about you
- Correction: ask us to correct inaccurate data
- Deletion: ask us to delete your account and personal data (subject to retention obligations in section 5)
- Portability: ask us to provide your data in a machine-readable format
- Objection / restriction: object to or restrict certain processing
- Withdraw consent: where we rely on consent (such as push notifications), you can withdraw it any time in app settings
To exercise these rights, email [email protected] from the email address associated with your account. We will respond within 30 days.
If you are in the European Economic Area, United Kingdom, or Switzerland, you also have the right to lodge a complaint with your national data-protection authority. If you are in California, you have additional rights under the California Consumer Privacy Act (CCPA) including the right to opt out of "sales" of personal information — we do not sell personal information.
7. Security
We use industry-standard measures to protect your data:
- In transit: all communications between the app and our backend use HTTPS / TLS 1.2+
- At rest: account passwords are stored as salted hashes by our authentication provider. Sensitive on-device data (saved biometric tokens, in-flight protocols) is encrypted with AES-GCM using a device-specific key stored in Android Keystore
- Database: row-level security ensures each authenticated user can only access their own data
No method of transmission or storage is 100% secure. If you suspect your account has been compromised, change your password immediately and email [email protected].
8. International data transfers
The Service is operated from the United States. If you access the Service from outside the US, your information will be transferred to and processed in the US. By using the Service, you consent to this transfer.
For users in jurisdictions with data-export restrictions (such as the European Economic Area), our service provider Supabase operates under standard contractual clauses or equivalent transfer mechanisms.
9. Minors' privacy
The Service is not directed at anyone under 21 years of age, and we do not knowingly collect personal information from people under 21. If you are under 21, please do not use the Service. If you believe a person under 21 has provided personal information to us, contact [email protected] and we will delete the information promptly.
10. Cookies and tracking
The mobile app does not use browser cookies. It stores small amounts of data locally on your device (using AsyncStorage and the Android Keystore) for sign-in state, theme preferences, and your protocol / outcome logs.
The website at theformularie.com uses minimal essential cookies for site functionality; we do not run third-party advertising or analytics cookies.
11. Changes to this policy
We may update this policy from time to time. When we make material changes, we will update the "Effective date" at the top and notify you in-app, by email, or both at least 14 days before the new policy takes effect. Continued use of the Service after the new policy takes effect constitutes acceptance.
12. Contact us
For privacy questions, data-subject requests, or to report a concern:
Email: [email protected]
We aim to respond to all privacy inquiries within 30 days.