Privacy

1. Who is responsible for your data

Peakly's data controller is By Ylfa, Azuriet 33, 3831 VV Leusden, Netherlands (KVK 99421453) — the entity responsible for the personal data described on this page. For any privacy question, email support@peakly.fyi. The full user agreement is set out in our Terms.

2. What data we collect

Account data

Your email address. If you sign in with Google, we receive the email address and basic profile name on your Google account — never your Google password.

Health data you log

The information you enter to use the app: your GLP-1 medication and the doses you record, your body weight and target weight, and any Food noise or Side effects events you choose to log. This is the core of what Peakly does for you.

Technical data

Standard server logs kept by our hosting provider (Vercel): IP address, browser type, and device information.

Error reports

When something in the app breaks, we send the error type and a technical stack trace to our error-tracking provider (Sentry). This is stripped of your identity, request contents, and any health data before it leaves your session.

On-device storage

We store your theme preference in your browser's local storage. If you use the public sample demo, its doses, weight, Food noise, Side effects, and settings are also stored only in that browser so the demo can resume after a refresh. Demo data is never added to your account or sent to Peakly; Reset replaces it with the original sample. Your sign-in session uses a functional cookie issued by Supabase (see Cookies and local storage below). None of this storage is used for tracking.

3. Health data and your explicit consent (Article 9 GDPR)

Your GLP-1 use, body weight, and self-reported symptoms are special category (health) data under Article 9 of the GDPR. We process this data only because you give your explicit consent by signing up and entering it (Article 9(2)(a) GDPR). You can withdraw that consent at any time — either by clearing all your logged data from your settings, which removes the health data without closing your account, or by asking us to delete your account entirely (see retention below).

4. We never sell your health data

We do not sell, rent, share, or analyse your health data with any third party for advertising, research, profiling, or any other commercial purpose. It exists to run the app for you, and for nothing else.

5. How we use your data, and our legal basis

• Running your account and signing you in — performance of our contract with you (Article 6(1)(b)).
• Storing your logs and showing you levels, projections, and recommended doses — your explicit consent for health data (Article 9(2)(a)).
• Taking payment for a subscription — performance of our contract, handled by Lemon Squeezy (Article 6(1)(b)).
• Keeping the service secure and preventing abuse — our legitimate interest (Article 6(1)(f)).

6. Data minimisation

We do not collect data we do not need to run the app. No analytics SDKs, no advertising pixels, no third-party trackers, no behavioural profiling. If a feature does not need a piece of data, we do not ask for it.

7. Third-party processors

Peakly runs on a small set of vetted providers, each receiving only the minimum it needs to do its job. Most act as our processors under a data-processing agreement. Lemon Squeezy is the exception: as our Merchant of Record it acts as an independent data controller for your payment and tax data.

• Supabase Inc. (United States — your data is stored in the EU (eu-north-1, Stockholm)) — Database, authentication, and file storage. This is where your account and the health data you log actually live. Privacy policy.
• Vercel Inc. (United States) — Application hosting, edge network, and standard server logs (IP address, browser, device). Privacy policy.
• Lemon Squeezy, LLC (United States) — Merchant of Record and payment processing. Lemon Squeezy handles billing, tax, and invoicing; Peakly never sees or stores your card details. Privacy policy.
• Google LLC (United States) — Sign-in, only if you choose to continue with Google. Google confirms your identity; none of your health data is ever shared with it. Privacy policy.
• Resend, Inc. (United States) — Transactional email only — sign-up confirmation and password reset. No marketing, no newsletters. Privacy policy.
• Functional Software, Inc. (Sentry) (United States — your error data is stored in the EU region (Frankfurt)) — Crash and error reporting. Receives only the error type and stack trace when something breaks — never your health data, account, request contents, or identity. All of that is stripped before anything is sent. Privacy policy.

8. International data transfers

Your account and health data are stored in the EU (Stockholm). Some processors are based in the United States (Supabase Inc., Vercel Inc., Lemon Squeezy, LLC, Google LLC, Resend, Inc., Functional Software, Inc. (Sentry)). Where data reaches them, the transfer is covered by Standard Contractual Clauses, the EU-US Data Privacy Framework, or an adequacy decision, as applicable.

9. How long we keep your data

We keep your data while your account is active. When your account is deleted, all of your personal and health data we hold is permanently removed within 30 days — except limited records we are legally required to keep, such as the payment and tax records our payment provider (Lemon Squeezy) must retain to meet accounting obligations. To delete your account, email support@peakly.fyi.

10. Your rights

Under the GDPR (Articles 15–22) you have the right to:

• Access — get a copy of your personal data.
• Rectification — correct data that is wrong.
• Erasure — delete your account and your data.
• Restriction — limit how we use your data.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interest.
• Withdraw consent — at any time, where consent is the basis (including the health data above).

To exercise any of these, email support@peakly.fyi. You can also clear all your logged data yourself from your settings at any time. You have the right to complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

11. Cookies and local storage

Peakly uses only a functional sign-in cookie issued by Supabase to keep you logged in, plus local storage for your theme preference and the public sample demo. We use no advertising cookies, no behavioural tracking, and no third-party tracking cookies.

12. Children

Peakly is not intended for anyone under 18. GLP-1 medication is prescribed to adults, and we do not knowingly collect data from users under 18. If we learn that we have, we delete it promptly.

13. Changes to this policy

If we make a material change, we will notify you by email or an in-app notice at least 30 days before it takes effect, and update the effective date above. If you disagree with a change, you can export your data and close your account during that notice period.