What we collect and why

Last updated 28 July 2026

Peptora analyses Certificates of Analysis for research compounds. This page describes exactly what the service stores, who else can see it, and how to have it removed. It describes the software as it actually behaves.

What we collect

• Certificates you upload. The file itself is stored so a published verdict can be re-examined later. Verdicts are public accusations in some cases; keeping the source document is what makes them auditable rather than unfalsifiable.
• Values you confirm — compound, batch code, purity, mass, lab name, and the seller you name in “where did you buy this”.
• Your email address, if you create an account (directly or through Google sign-in).
• Your check history — which certificates you submitted and when, used to meter free checks.
• Your IP address, used for rate limiting to prevent abuse. It is stored as part of a rate-limit counter, not attached to your account.
• Document fingerprints — cryptographic hashes of the file and its contents, used to detect the same certificate being reused by different sellers.

We do not run advertising or analytics trackers, and we do not sell data to anyone.

Cookies

Two, both strictly necessary, both set as HttpOnly and Secure:

• anon_id — a random identifier so a free check without an account can be counted. It contains no personal information and expires after one year.
• sb-…-auth-token — your login session, only if you have an account.

There are no advertising, analytics, or third-party tracking cookies, which is why you are not shown a cookie consent banner.

Who else processes your data

These providers process data on our behalf. The third one matters most and is easy to miss:

• Supabase — database, accounts, authentication.
• Vercel — hosting and request logs.
• Groq — the certificate you upload is sent to Groq, a third-party AI provider in the United States, to read the values off it. Messages you send to the Peptide Master assistant are sent there too. If a certificate contains anything you would not want processed by a third party, do not upload it.
• Cloudflare R2 — storage for the uploaded certificate files. The bucket is private and not publicly readable.
• Google — only if you choose Google sign-in.

What becomes public

A completed check produces a public page: the compound, batch code, the seller you named, the trust score, and the reasoning behind it. That is the purpose of the service — an independent record others can check. The uploaded file itself is never published; it is retained privately as evidence.

Your email address, your account, and your check history are never published, and the public record does not identify who submitted it.

How long we keep it

• Account data — until you delete your account.
• Uploaded certificates and verification records — kept indefinitely, because a published verdict that can no longer be checked is not accountable. See the deletion section for what this means for you.
• Rate-limit counters — short-lived, discarded automatically.

Deleting your data

You can delete your account from your account page. That removes your email address, your login, and your check history.

Being straight with you about one limit: public verification records and the certificates behind them are not removed by deleting your account. They no longer link to you, and nothing identifies you as the submitter — but the record itself remains, because other people and businesses rely on it and a trust index that can be erased on request is not a trust index. If you believe a specific record should not exist, contest it (below) and we will review it on the merits.

Certificates we collect ourselves

Not every record starts with an upload. Some certificates are collected from vendors’ own public COA pages so the index is useful on day one. That is documented separately, including the limits the crawler runs under and how a vendor stops it: the collector.

Contesting a record

If a published verdict concerns your product, you can contest it. Every score is deterministic and reproducible from the audit log shown on the record, so a dispute is a factual question, not an appeal to opinion. If a finding is wrong we correct it and say so.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to processing. Use the account page for deletion, or contact us for anything else. We aim to respond within 30 days.

Contact

Privacy questions: privacy@peptoraai.com

Peptora reports on documents and data for research-use-only materials. It makes no human-use, dosing, or therapeutic claims.