Privacy & Cookies

What we collect

NovaPeptides is a catalogue and education site with no online cart and no accounts, so we collect very little. When you message us on WhatsApp, we receive whatever you choose to send us in that conversation. If you accept analytics cookies, we also collect anonymous usage data about how the site is used.

The data involved

• Enquiry content you send us directly on WhatsApp.
• Anonymous, aggregated usage analytics (pages viewed, buttons tapped) via Google Analytics 4, only if you accept cookies.
• Advertising measurement via the Meta Pixel, only if it is enabled and you accept cookies.
• Standard server and security logs kept by our hosting provider.

Why we collect it

We use this information to answer your enquiries, to understand which parts of the site are useful so we can improve them, and to measure whether our marketing is working. We do not use it to make automated decisions about you, and we do not sell it.

Cookies and your consent

Analytics and advertising cookies are switched off by default. They only load if you choose Accept on the cookie banner. You can decline, and the site works exactly the same. You can change your mind at any time by clearing the site data in your browser, which will show the banner again.

Who processes your data

When enabled and consented to, analytics data is processed by Google (Google Analytics 4) and, where advertising measurement is used, by Meta Platforms (the Meta Pixel). Both are major providers with their own privacy policies. WhatsApp messages are handled by WhatsApp, which is also part of Meta. Our website hosting is provided by our infrastructure partner.

Two separate things

This policy covers two systems that do not share data with each other. The first is this website, a catalogue and education site with no cart and no accounts. The second is the Nova tracker, a signed-in application where you can log doses, vials and progress. Everything above this heading is about the website. Everything below it is about the tracker.

What a Nova tracker account holds

A tracker account exists to hold a record you build yourself. That record is health information, and under the Australian Privacy Act health information is sensitive information, which carries a higher standard than ordinary personal data. We treat it that way.

What is stored

• Your email address, display name and time zone.
• Cycles you set up: the compound, the dose, the schedule, the start and end dates.
• Individual doses you log, including the date, the injection site and any note you write.
• Vials you add, including quantity, reconstitution volume and run-out estimates.
• Weekly check-in answers and any side-effect text you enter.
• Weight and other measurements you choose to record.
• Research articles you save, and your conversations with the Ask Nova assistant.
• Reminders, achievements and your notification history.
• Optional health questionnaire answers, if you choose to answer them. Every question can be skipped and any answer can be deleted on its own.

None of it is required. The questionnaire is optional, notes are optional, measurements are optional. An account holding nothing but a dose log works exactly as well as a full one, and we would rather hold less.

What the tracker does not do

The tracker sets two cookies and no others. One holds your session so you stay signed in, and one is a security token that stops another website submitting forms as you. Both are strictly necessary to sign in at all, so there is no consent banner and nothing to opt out of short of signing out.

There is no Google Analytics in the tracker, no Meta Pixel, no advertising tag and no third-party script of any kind. The application is served under a Content Security Policy that only permits it to connect back to our own server, so a tracking script could not send anything anywhere even if one were added by mistake.

A session lasts up to 30 days and expires after 14 days without use. You can see every device signed in to your account, and sign any of them out, on the Security screen in Settings.

Ask Nova and what leaves our server

Ask Nova is a research assistant. Your question is sent to Anthropic, which provides the language model, along with the research sources we retrieved in order to answer it. Your health log is not sent with it.

If a question genuinely needs your own data, you have to tick "use my log" on that individual message. Nothing is shared automatically, the setting does not persist to your next message, and the application shows you the exact list of what was included. Unticking it stops a new summary being sent. It does not unsend the conversation so far: everything already in that thread goes out again with your next question in the same thread, including an earlier reply that described your log back to you. Starting a new conversation leaves it behind.

When you tick "use my log", only this is sent

• The names of your active cycles, and the compound in each.
• How often each one is scheduled, and the date it started.
• How many doses you have logged, and your adherence percentage.

These are never sent, at any setting

• Your notes.
• Your weight and measurements.
• Side-effect text.
• Health questionnaire answers.
• Your email address and your name.

Searching the literature

The research screen queries PubMed and ClinicalTrials.gov, both run by agencies of the United States government, and optionally Reddit for community discussion. Those services receive your search terms, as any search engine would. They do not receive your identity, your account, or anything from your log.

Results you save are stored in your account and are visible only to you.

Who at Nova can see your log

Nobody, by default. There is no screen anywhere in the staff interface that displays a member's doses, notes, measurements, check-in answers, questionnaire responses or assistant conversations. It is not a policy we ask staff to follow. It is an endpoint that does not exist.

For support cases there is one narrow exception, and it was built to be uncomfortable to use. A staff member can request summary counts on an account: how many cycles, how many doses, the date of the most recent one. To do that they must type a written reason, the access is recorded permanently in an audit log, and you are told.

Even then, cycle labels, compound names, doses, notes, measurements, check-in answers, side-effect text and conversations are all withheld. The counts are all they get.

How it is protected

The measures in place

• Everything travels over HTTPS.
• Passwords are stored as scrypt hashes. We cannot read your password, and a copy of the database would not reveal it.
• Session cookies are HttpOnly, so no script on the page can read them, and only a hash of the session token is stored on our side.
• Every database query is scoped to your account by the code that runs it, and separately by database row level security, and separately again by delete rules that cascade. Any one of those three failing still leaves two.
• Sign-in attempts are rate limited, and the audit log stores a one-way hash of the IP address rather than the address itself.

No system is beyond compromise and we are not going to claim otherwise. What we can say is that this account was built to hold sensitive information from its first line of code, rather than having security added to it afterwards.

Getting your data out, and getting rid of it

Australian Privacy Principle 12 gives you the right to the personal information an organisation holds about you. In the tracker that is a button, not a request form. Settings, then Your data, then Export gives you a single file containing every record in your account, immediately.

Deleting your account is on the same screen. Type your email address to confirm, and everything is scheduled for permanent removal after 30 days, during which signing in again cancels it. If you would rather not wait, an immediate option on the same screen destroys every record at once and cannot be undone.

After an immediate deletion the account row itself is kept in an anonymised form holding no name, no email address and no health data, purely so the record that an account was deleted on that date at its owner's request still exists.

Retention and your rights

For website enquiries, we keep conversations only as long as needed to help you and for our own records, and analytics data is retained according to the analytics provider settings. Under the Australian Privacy Act you can ask us what personal information we hold about you, ask us to correct it, or ask us to delete it. Contact us and we will help. For a Nova tracker account, export and deletion are self-service and are covered above.