Privacy Policy

Account data and health tracking data are stored in Supabase, a PostgreSQL database provider. Supabase stores data in the US (AWS us-east-1) by default and is SOC 2 Type II certified.

All data is encrypted in transit via TLS 1.2+ and at rest using AES-256. Row-level security (RLS) ensures your data can only be accessed by your own authenticated session - not by other users. Internal access to user data by peripal personnel is restricted and logged, and occurs only to resolve a support request you have submitted or to investigate a reported security incident.

If you use peripal as a guest (no account), all data is stored only in your browser's localStorage on your device. It never leaves your device until you choose to create an account.

We use your data only to:

• Provide the app features (syncing logs, generating your doctor report, etc.)
• Send account-related emails (email verification, password reset)
• Improve the app through aggregated, anonymised analytics (no individual data used)

We never:

• Sell your personal health tracking data (logs, symptoms, medications, cycle data)
• Share your health tracking data with insurers, employers, or data brokers
• Use your health tracking data to target or personalize advertising
• Use your data to train AI models

Advertising and affiliate links: peripal may display contextual advertising or include affiliate links in content (such as links to products or services that may earn us a commission). Any advertising or affiliate content will be clearly labeled. Your health tracking data is never used to target, select, or personalize these. See our Terms of Service for more detail.

Strictly necessary cookies

Secure session cookies issued by Supabase Auth to keep you signed in. These are:

• HttpOnly (not accessible to JavaScript)
• Secure (HTTPS only)
• SameSite=Lax (CSRF protection)

Sessions automatically expire after 30 minutes of inactivity to protect your health data.

Analytics cookies

We use Google Analytics 4 (GA4) to understand how the app is used in aggregate (e.g., which pages are visited, session duration). GA4 sets cookies named _ga and _ga_*, which persist for up to 2 years. We have enabled IP anonymization - your full IP address is never stored by Google. GA4 data is used only to improve the app and is never linked to your health data.

You can opt out of Google Analytics at any time using the Google Analytics opt-out browser add-on, or by enabling your browser's built-in tracking protection.

We do not use advertising cookies or any other third-party tracking.

Do Not Track

Some browsers offer a "Do Not Track" (DNT) signal. We do not currently alter our data collection practices in response to DNT signals, as no uniform standard for responding to DNT has been adopted. You can use the opt-out mechanisms above to limit analytics tracking.

Your account and health data are retained for as long as your account is active. Server logs are retained for 30 days.

When you delete your account, all your data (health logs, medications, period data, forum posts, and profile) is permanently deleted within 24 hours. This cannot be undone.

Backup copies are encrypted, access-controlled, and purged within 30 days of deletion. During that window your data exists only in secure backup storage and is not used for any purpose. Some data may be retained in aggregated, de-identified form (e.g., total number of users) that cannot be linked back to any individual.

Under the California Consumer Privacy Act (CCPA), California Privacy Rights Act (CPRA), and applicable US state privacy laws (Virginia CDPA, Colorado CPA, Connecticut CTDPA, Texas TDPSA, and others), you have the following rights:

To exercise any right not covered above, email stephanie@peripal.co. We will respond within 45 days. If we need additional time, we will notify you within the initial 45-day period.

We implement the following security measures to protect your data:

• TLS encryption for all data in transit
• AES-256 encryption at rest
• Row-level security (database-level access control)
• Passwords hashed with bcrypt (never stored in plaintext)
• Breach-detected password blocking via HIBP at signup
• Session inactivity timeout (30 minutes)
• Strict Content Security Policy headers
• Server-side rate limiting on authentication endpoints

Data breach notification

In the event of a data breach involving your personal health information, we will notify affected users by email within 60 days of discovering the breach, consistent with the FTC's Health Breach Notification Rule. If a breach affects 500 or more individuals in a state, we will also notify prominent media outlets in that state and the FTC as required by law.

If you discover a security vulnerability, please report it responsibly to stephanie@peripal.co.