Privacy Policy

We do not collect government identification, date of birth, or any health information, and we never ask what a compound is being used for.

We do not receive, store or have access to your card number. Card payments are handled entirely by Stripe on Stripe-hosted pages. What reaches us is confirmation that a given order reference was paid, together with the billing name and email you gave Stripe.

Where an order is settled by another method, we receive only the reference needed to match the payment to the order. We do not hold bank account credentials.

We use the minimum that makes the site work, plus analytics:

• —Authentication — keeps you signed in. Strictly necessary; the site cannot offer accounts without it.
• —Cart contents — stored in your browser so a cart survives a page reload.
• —Age confirmation — records that you have already confirmed, so you are not asked repeatedly.
• —Analytics identifier — a random value your browser generates for itself, used to tell a returning visit from a new one. It is not linked to your identity unless you are signed in.

Clearing your browser storage removes all of these. Doing so signs you out and empties your cart.

Where advertising is running, we may load a measurement pixel from TikTok or Meta to tell whether an ad led to a visit. These are scoped deliberately narrowly:

• —Pixels do not load at all unless advertising is actively configured.
• —They never fire on account, order, admin or authentication pages, because those URLs can carry an order reference or a token.
• —Purchase confirmation is reported from our server with an order total, not with the contents of your order. Advertising platforms are not told which compounds you bought.
• —Where an identifier is included for match quality, it is cryptographically hashed before it leaves our server.

We use the following processors. Each receives only what it needs to perform its function, and none is permitted to use your information for its own purposes.

We do not sell personal information, and we do not share it with third parties for their own marketing. We may disclose information where we are legally required to.

• —Order records — retained as long as required for tax and accounting purposes.
• —Account details — retained while your account is open, and deleted on request.
• —Usage data — retained in aggregate; it is not useful to us at an individual level.
• —Correspondence — retained while a matter is open and for a reasonable period afterwards.

Depending on where you live — California, Colorado, Connecticut, Virginia and a growing number of other states — you may have a statutory right to some or all of the above. We extend them to everyone rather than checking your address first. To exercise any of them, email contact@peakresearchpeps.com. We will not treat you differently for asking.

The site is served over HTTPS. Account data sits behind row-level access rules so one account cannot read another's orders or addresses. Passwords are stored as salted hashes by our authentication provider and are not recoverable by us — which is why a reset is the only route back into a locked account. No system is perfectly secure, and we do not claim otherwise.

This site is not directed at anyone under 21 and we do not knowingly collect information from minors. If you believe a minor has created an account, contact us and we will remove it.

If this policy changes materially we will update the date at the top of the page. For any privacy question, or to exercise any right above, write to contact@peakresearchpeps.com. We reply within one business day.