Privacy Policy

InjectBuddy is a free dosage-calculator suite built and operated by the InjectBuddy team. You can use the calculators anonymously with no account at all. You can also optionally create an account to save your protocols and track your data — in which case we store that data for you. This policy explains exactly what is and isn't stored in each case, and how to access or delete your data.

The InjectBuddy iOS app has its own policy: InjectBuddy for iOS privacy policy.

Using the calculators (no account)

The core calculators require no account and store nothing about you:

• No login is required to use any calculator.
• The numbers you enter (dose, concentration, height, weight, lab values) are used only to compute your result. They are never sent to a server — every calculation runs in your browser.
• Nothing you type into a calculator is retained once you leave the page, unless you are signed in and explicitly choose to save it (see below).

If you create an account

Accounts are optional. If you choose to sign up (by email and password, or with Google), we store the data needed to provide the account features. It is held in our database (Supabase) and tied to your account so we can show it back to you:

• Account details — your email address, and a display name and profile photo if you add one (signing in with Google supplies your name and avatar).
• Saved protocols and dose data — the calculator protocols, cycles, vial/supply ledger and dose log you save. These can include the dose, concentration and compound values you choose to store.
• Blood-test records — if you use the blood-test analyser, the marker values and test records you upload or enter.
• Body measurements and progress photos — if you use the body-metrics or progress-photo features, the measurements you enter and the photos you upload, stored in private storage that only your account can read.
• Preferences and activity — your unit/display preferences, earned badges, and the active-day counts behind them.
• Reminders — if you turn on dose reminders, your first-dose reminder records and, for browser notifications, your push subscription.
• Support chat — if you message us through the in-app chat, the conversation and its messages. Each message is forwarded, with your display name, to our support inbox in Telegram so we can reply.

We do not sell your data and we do not use your saved health data for advertising. It exists only to power the account features you asked for. So your saved protocols load instantly, a copy is also cached in your browser's localStorage on your own device; that copy is removed when you sign out.

Accessing and deleting your data

While signed in, open Account → Settings → Account, where you can:

• Download your data — export everything we hold for your account as a JSON file, including time-limited download links for your uploaded photos and blood-test files.
• Delete your account — permanently erase your account and all associated data (protocols, cycles, supply ledger, dose log, blood-test records, body measurements, progress photos, profile, preferences, reminders and login). This is immediate and cannot be undone.

If you have any trouble, contact us and we will help.

Optional community survey

From time to time InjectBuddy invites visitors to take an optional, anonymous community usage survey, shared by a direct link. It is the one place where information you submit is stored — and only because you opt in:

• Participation is entirely voluntary and requires ticking a consent box confirming you are 18+ and agree to your anonymous answers being shared.
• We collect only coarse, non-identifying buckets (e.g. an age range, a region, a spend bracket). There are no names, emails, contact details, IP addresses, or free-text fields, so a response cannot identify you.
• Because submissions are fully anonymous we cannot look up an individual response, but if you would like data removed or have any concern, contact us and we will help.

Subscriptions and payments

Paid plans are optional. If you subscribe, payments are handled by third-party processors:

• Stripe — runs web checkout and the billing portal. Your card details go to Stripe and never reach InjectBuddy.
• RevenueCat — keeps your subscription status in sync across web and app.
• Apple and Google — handle purchases made in the app. They reach us as subscription status only.

We store only your Stripe customer ID and your subscription entitlement status (“pro” or not). We store no card data, and we do not use payment data for advertising. Deleting your account removes this data on our side.

Other services that receive your data

• Anthropic (Claude) — only if you use the body-fat estimate or the blood-test reader. The photo or file you choose is sent to Anthropic's API to produce the result. Anthropic is based overseas (United States). Nothing is sent unless you start one of these features.
• Telegram — support chat messages you send, with your display name, are forwarded to our support inbox in Telegram. Telegram is based overseas.
• Resend — sends some of our emails: reminders to confirm your email address (to your address), and a notice to us when someone submits feedback (including the reply email address if you gave one).
• Supabase — hosts the database, file storage and sign-in for your account.

When you delete your account we also ask Stripe to delete your customer record, RevenueCat to delete your subscriber record, and Telegram to delete the support messages we forwarded. Stripe may keep payment and invoice records it must hold for its own tax and legal duties. RevenueCat may keep anonymised purchase records. Telegram only lets us delete messages from the last 48 hours, so older forwarded messages may remain in our support inbox until we clear them by hand.

We keep a private, add-only log of when account data was exported or deleted, or when progress photos were accessed through our servers. It records the date, your account ID and the action, never the content of your data. It is not visible to users.

Analytics

This site uses four analytics tools:

• Ahrefs Web Analytics — cookieless aggregate traffic data (pages visited, approximate geographic region, referrer). No personal identifiers collected.
• PostHog — product analytics (pageviews, events). Before you sign in, PostHog assigns an anonymous distinct ID stored in localStorage. If you create an account or sign in, we identify you to PostHog by your internal account ID (a random UUID), so sign-up and usage steps can be counted. We do not send your email address, name or any health values (doses, compounds, blood-test or body measurements) to PostHog. person_profiles is set to identified_only. On public pages, while you are signed out, PostHog also records session replays: how the page was used (mouse movement, taps, scrolling and what the page showed), so we can find and fix places where visitors get stuck. Anything you type into a field is masked in your browser before it is sent, so typed values are not in the recording; results the page displays are. No replay is recorded on account, sign-in or sign-up pages, or at any time while you are signed in.
• Google Analytics 4 — aggregate traffic and usage analytics through Google Tag. No personal health inputs are sent to Google Analytics.

If you use a browser extension that blocks analytics scripts, the calculators will function identically — analytics is passive and has no bearing on site functionality.

Cookies and local storage

InjectBuddy does not set advertising or cross-site tracking cookies. If you sign in, a standard session cookie keeps you logged in; the analytics tools above may set their own cookies or identifiers as described.

The site uses your browser's localStorage on your own device for things like your theme choice, guide content you have viewed, and — when you are signed in — a cached copy of your saved protocols so they load instantly. This stays on your device; the cached account copy is cleared when you sign out.

Third-party services

InjectBuddy loads fonts from Google Fonts and React from jsDelivr. These are standard CDN resources. Their respective privacy policies govern any data handling on their end. No sensitive data is sent to these services — only the standard HTTP request to load the resource.

Children

InjectBuddy is intended for adults. You must be 18 or older to create an account, and we do not knowingly collect data from children.

Questions

If you have questions about this privacy policy, contact the InjectBuddy team via the details linked from the About page.