Privacy Policy

RanchStack (ranchstack.ai, formerly PeptiLogger at peptilogger.com) is a personal research-tracking application operated by 48U Ranch LLC, doing business as 48U Technology Development (“48U”, “we”). It exists to serve its own users, not to monetize them. This page describes, plainly, what the application stores, where it lives, who can see it, and what we will never do with it.

What is stored

Only what you enter or generate inside the application. Specifically:

• Account: your email address, a password hash, your second-factor enrollment (authenticator app), any passkeys you register, and a record of the terms version you accepted and when.
• Researcher profiles: names you give each researcher on the account, and optionally date of birth, height, weight goal, units preference and blood type.
• Inventory: peptides, vials (size, reconstitution, serial, lot number, vendor, provenance), validations and disposals (including reason, sale price or recipient where you enter them).
• Protocols and dose logs: schedules, titration, each dose logged (time, amount, status, notes, syringe draw) and, where you choose to record it, the injection site.
• Health records: weekly body-composition check-ins, monthly researcher check-ins (observations, side effects, ratings), and lab results you enter or import from a lab report file.
• Orders: vendor orders you enter — order number, date, amounts, line items, carrier and tracking number.
• Settings and catalog edits: your preferences and any knowledge-base entries or prices you add or change.
• Session diagnostics: a short journal of sign-in, sign-out and sync events kept in your browser to help diagnose problems. It never leaves your device unless you copy it to us.

In addition to information you enter, our providers process technical information needed to operate and secure the service, including IP addresses, user agents, and authentication events. We also process information you provide in support requests and, where applicable, billing information. There is no behavioral tracking, no device fingerprinting, and no data purchased or inferred from elsewhere.

Where it lives

Your data is stored in a Supabase-hosted PostgreSQL database in the United States, over encrypted connections. Every table is protected by row-level security scoped to your account: one account cannot read another account’s rows, and this is enforced by the database itself, not just the application. The database additionally refuses to answer any data query until the session has completed two-factor authentication.

The application’s static files are served by Netlify. Like any web host, Netlify sees the IP address and user agent of requests in its standard server logs; we do not add analytics, tracking scripts or third-party embeds of any kind. The page loads code only from this site and connects only to its own database.

For offline use and fast start-up, the application keeps a working copy of your data in your own browser’s local storage, on your own device. That copy is stamped to your account. Signing out explicitly clears it. An automatic sign-out (idle timeout or an expired session) keeps it, stamped to your account, so that signing back in on the same device is quick; a different account signing in on the same browser clears it.

Sign-in and security

Every account must enroll an authenticator app (time-based one-time codes) and complete it at each sign-in. Passkeys (Face ID, Touch ID, security keys) can be added as a convenience; the biometric itself never leaves your device, and we store only the public credential. We do not use SMS or phone-based verification. Transactional emails — verification, password reset, security notices — are sent through our authentication provider and contain no marketing.

Sessions end automatically after a period of inactivity. You can see every enrolled factor and remove it from within the application.

What we do not do

• No advertising, analytics, tracking pixels, or third-party scripts.
• We do not sell or rent your personal information or disclose it for advertising. Our hosting, database, authentication, email, and payment providers process information as needed to provide the service. We may also disclose information when legally required.
• No artificial-intelligence or language-model service receives your data. The application contains no AI features.
• No automated collection from third-party websites. The reference list prices shipped with the application are maintained by hand; prices you enter are yours.
• No reading of your records by 48U staff except where you ask us to help with a specific problem, and then only to the extent needed.

Reports generated for you

The clinician report, protocol report, costs and projections are generated inside your browser from your own data. Nothing is sent anywhere to produce them. What you do with a printed or downloaded report is up to you.

Records about other people

An account may hold researcher profiles for more than one person. If you record another person’s data, you are responsible for having their agreement to do so and for honoring their requests to see, correct, or delete it. Each person retains their applicable privacy rights concerning their own information. Before another adult’s information is entered, that person must receive our privacy notice and provide any consent required by law through our authorization process. They may contact security@48uranch.com directly to exercise their rights, whether or not they hold an account.

Retention, backups and deletion

Your records are kept until you delete them. The application offers an optional, user-invoked retention tool that archives dose logs older than 91 days and weekly check-ins older than a year; it never runs on its own, and lab results are never pruned. You can export your complete data as a JSON file at any time, and delete individual records, researchers, or everything from within the application.

Our database provider maintains disaster-recovery backups for up to 7 days. Deleted information is removed from backups as they expire, within applicable legal deadlines. We direct relevant providers to honor deletion requests and reapply deletions if backups are restored.

You can delete all of your records, or your entire account including its authentication records, from within the application (More → Delete all my data / Delete my account). Both require a typed confirmation and take effect immediately. You may also write to the address below from the account’s email and we will do it for you.

If something goes wrong

If we discover a breach involving personal information, we will investigate and provide notices to affected individuals, regulators, and others as required by applicable law, within the applicable deadlines.

Age

RanchStack is for adults. We do not knowingly accept accounts from, or store records about, anyone under 18. If you believe a minor’s data has been entered, contact us and we will remove it.

Changes

This policy is revised when the application changes in a way that affects what is stored or how. The date at the top is the current revision; material changes are shown in the application for you to acknowledge.

Your rights

To exercise applicable rights to access, correct, delete, or withdraw consent concerning your information, email security@48uranch.com. We verify requests and respond within applicable legal deadlines. You may appeal a refusal through the same address. We will explain our decision and provide any required regulator complaint information.

Contact

Questions about this policy or your data: security@48uranch.com.

48U Ranch LLC d/b/a 48U Technology Development, Magnolia, Texas, USA.