What we collect
Almost nothing, and here is why
The public site is a set of static files. It ships a policy that forbids it from making any network request at all, so most of what a privacy policy usually has to promise is enforced by the browser rather than by us.
Last updated
The enforcement is in the headers, not the promise
Every page on this host is served with
connect-src 'none' in its Content-Security-Policy. That instructs your
browser to block every outbound request this page might try to make — analytics, beacons,
anything. You do not have to take our word for it: open the network tab.
What this site does not do
- No analytics. No Google Analytics, no Plausible, no self-hosted tracker, no pixel. We do not know how many people read any given page.
- No third-party fonts. The typefaces fall back to your system stack rather than calling a font CDN, which would otherwise be the only call home on a page about someone's medical protocol.
- No advertising, and nothing is sold. No data leaves your browser because none is gathered.
- No account. Every record, both calculators, the glossary and the full rubric are readable signed out.
The two things stored in your browser
Both stay on your device and neither is transmitted anywhere.
sp-theme— remembers whether you chose the light or dark theme. Stored inlocalStorage. Clearing site data removes it.sp_returning— a cookie set by the signed-in app atapp.peptidecorpus.comand read here, so that the header can show “open the app” instead of “start free” if you already have an account. It holds the single value1. It says nothing about who you are.
The signed-in app is a different host
Everything above describes www.peptidecorpus.com. The application at
app.peptidecorpus.com necessarily handles an account and whatever you record in it,
and carries its own policy. The two are separate origins deliberately: a browser will not
let this host read the app's session, which is a structural guarantee rather than an
undertaking.
Server logs
The site is served by a CDN, which keeps short-lived operational logs — the sort of request records any web server produces. We do not build profiles from them and we do not combine them with anything else, because there is nothing else.
Children
This site is not directed at children and we do not knowingly collect anything from anyone, of any age.