Legal — Pepza for Android & iOS

Pepza Privacy Policy.

Last updated — August 14, 2026

This Privacy Policy describes how BBXLabs ("we", "us", "our") handles information in connection with the Pepza mobile application ("Pepza" or the "App"), published on Google Play (Android) and the Apple App Store (iOS, coming soon). The short version: your health data is stored locally on your device and never sold. The App includes limited third-party SDKs for analytics, crash reporting, push notifications, and advertising — described in detail below.

01About Pepza

Pepza is a personal tracking and organization tool. It does not provide medical advice, prescribe, recommend, or endorse any substance, dose, timing, or combination, and does not supply or sell any product. Always consult a licensed healthcare professional. Use Pepza only to log treatments prescribed to or legally obtained by you.

02Data we store locally

  • Treatment entries: the doses, schedules, vials, reminders, symptoms, weight, water, protein, and other entries you log.
  • App settings: language, theme, notification preferences, and similar configuration.
  • Custom entries: any custom treatments or items you add to your personal catalog.

All of the above is stored locally on your device. On iOS (coming soon), if you enable iCloud sync, your data is synced privately through your own iCloud account — BBXLabs cannot read or access the contents. On Android, data remains on-device unless you explicitly use an export feature.

03Third-party SDKs and services

Pepza includes the following third-party SDKs on both Android and iOS. Each collects only the data described below. We never sell your personal data to anyone. Your logged health data (doses, vials, symptoms, weight, photos) is never sent to any of these services.

3.1 Firebase Analytics

  • What it collects: anonymous usage events (app launches, screen views, taps, feature usage), approximate device location (country-level), and an app-scoped device ID.
  • Purpose: to understand which features are used and to improve the App.
  • Linked to you: yes, via device ID.
  • Used for tracking: no.
  • Health data: never sent to Firebase.

3.2 Firebase Crashlytics

  • What it collects: crash logs, stack traces, hang diagnostics, and performance metrics (launch time, hang rate).
  • Purpose: to identify and fix crashes and performance issues.
  • Linked to you: yes, via a Crashlytics installation ID.
  • Used for tracking: no.
  • Health data: never sent to Crashlytics.

3.3 Firebase Cloud Messaging (push notifications)

  • What it collects: a push notification token used to deliver reminders and vial storage age alerts.
  • Purpose: to deliver scheduled dose, supplement, and water reminders even when the App is in the background.
  • Linked to you: yes, via push token.
  • Used for tracking: no.
  • Health data: never sent to FCM.

3.4 Google AdMob (advertising — free version only)

  • What it collects: device advertising identifier (Android advertising ID or iOS IDFA, subject to your platform's tracking settings), ad impressions, ad clicks, and coarse device information.
  • Purpose: to serve and measure ads in the free version of the App. Ads are removed when you purchase Premium.
  • Linked to you: yes, via advertising identifier.
  • Used for tracking: on iOS, only if you grant tracking permission via the App Tracking Transparency (ATT) prompt. On Android, subject to your "Ads personalization" setting in Google Account. If you opt out, only contextual (non-personalized) ads are shown.
  • Health data: never shared with AdMob.

3.5 RevenueCat (purchases)

  • What it collects: an anonymous app user ID, purchase history, subscription status, and entitlements.
  • Purpose: to manage subscriptions, restore purchases, and unlock Premium features.
  • Linked to you: yes, via app user ID.
  • Used for tracking: no.
  • Payment details: never — payments are processed by Google Play Billing (Android) or Apple App Store (iOS); RevenueCat only receives transaction confirmations.

04Platform-specific notes

Android (currently available): Pepza is offline-first and stores all data locally. It includes Firebase (Analytics, Crashlytics, Cloud Messaging), Google AdMob (free version), RevenueCat, and optional Health Connect integration — all described in sections 3 and 5. Your logged health data never leaves the device.

iOS (coming soon): The iOS version will include the same third-party SDKs plus optional Apple HealthKit and iCloud sync, subject to iOS privacy permissions. Health data is never sent to Firebase, AdMob, or any other third party.

05Optional integrations

5.1 Health Connect (Android)

If you choose to enable Health Connect sync, Pepza may read and write data types such as weight, steps, calories, and sleep to the Health Connect framework on your device. This data is controlled by Android's Health Connect permissions and is never sent to BBXLabs, Firebase, AdMob, or any other third party. You can revoke this permission at any time from Android Settings > Health Connect.

5.2 Apple HealthKit (iOS — coming soon)

If you choose to enable HealthKit, Pepza may read weight, steps, active calories, and workouts, and may write water intake and body weight to the Health app. This data is controlled by iOS HealthKit permissions and is never sent to BBXLabs, Firebase, AdMob, or any other third party. You can revoke this permission at any time from iOS Settings > Privacy & Security > Health.

5.3 iCloud sync (iOS — coming soon)

If you enable iCloud sync, your data is synced through your private iCloud account using Apple's CloudKit. The data is encrypted in transit and at rest by Apple. BBXLabs cannot read, view, or access the contents of your synced data.

5.4 Photo Picker (progress photos)

Pepza uses the system Photo Picker (Android Photo Picker / iOS PhotoKit) when you add progress photos. The App receives only the photo you select — it does not request full photo library access. Photos are stored locally on your device and are never uploaded to any server.

5.5 Home screen widgets

Pepza's widgets show a small preview of your next dose, progress, water, or weight directly on your device's home or lock screen. This information is read from the App's local database and is not transmitted anywhere.

5.6 Data export

If you use the data export feature (Premium), the App generates a file on your device containing your data. You decide where to save or send that file. BBXLabs does not receive a copy.

06Purchases

On Android, purchases are processed by Google Play Billing and managed via RevenueCat. On iOS (coming soon), purchases are processed by the Apple App Store and managed via RevenueCat. BBXLabs receives only a confirmation of the transaction (such as the product ID and purchase date) for the purpose of granting the purchased entitlement. We never receive your full payment card details — those are handled exclusively by Google or Apple.

07Permissions requested by the App

  • Notifications: used to deliver dose, supplement, and water reminders that you configure. On Android, push notifications are delivered via Firebase Cloud Messaging.
  • App Tracking Transparency (iOS, coming soon): requested before serving personalized ads. You may deny — the App will still function with contextual ads only.
  • Android advertising ID: used by Google AdMob in the free version, subject to your Google Account "Ads personalization" setting. You can opt out at any time in Android Settings > Google > Ads.
  • HealthKit (iOS, coming soon, optional): used only if you enable HealthKit integration.
  • Health Connect (Android, optional): used only if you enable Health Connect sync.
  • Photo Picker (optional): used only when you add progress photos. The App uses the system Photo Picker and does not request full photo library access.
  • Storage / files (optional): used only when you choose to export your data to a file.

08Children's privacy

Pepza is not directed at children under 13 (or the minimum age in your jurisdiction). We do not knowingly collect personal information from children.

09Data retention and deletion

Because your data is stored locally on your device, it remains until you delete it within the App (for example, by deleting individual entries or clearing the App's data) or until you uninstall the App. Uninstalling Pepza removes all locally stored data. On iOS (coming soon), if you have enabled iCloud sync, synced data remains in your iCloud account until you delete it from within the App or via iOS Settings > Apple ID > iCloud > Manage Storage.

10Your rights

Depending on where you live (EU/EEA, UK, California, and other jurisdictions), you may have rights to access, correct, delete, or port your personal data. Because Pepza stores data locally, you can exercise these rights directly inside the App or by uninstalling it. For any data we may hold (such as purchase confirmations or support emails), contact us at legal@bbxlabs.us.

11Security

Pepza's local-first design keeps your data on your device, which minimizes the attack surface. We do not operate servers that store your logged data. We use reasonable technical and organizational measures to protect any data we do process (such as purchase confirmations).

12International users

BBXLabs is based in Europe. When we process personal data, we do so in accordance with the GDPR.

13Changes to this Policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date above and, for material changes, we will also notify you within the App or on the App's listing page.

14Contact

Questions about this Privacy Policy? Email legal@bbxlabs.us.

See also the BBXLabs Privacy Policy for the studio and website.