Privacy Policy

We keep the list of what we hold deliberately short:

• Account email. The address you sign up or check out with. It's your login, and where receipts and account notices are sent.
• Membership & purchase state. Which books you've licensed and whether your membership is active, trialling, past-due, or cancelled. The billing itself is handled by Stripe — see §03.
• Newsletter email & country. Only if you opt in. We also record that you consented and when, so it's clear the sign-up was your choice.
• Support messages. If you write to us — through the support form or straight to the inbox — we hold your email and what you wrote, so we can answer and so a failed delivery can be re-sent. Please don't include health details you wouldn't want kept; we only need enough to help.
• Minimal analytics. Aggregate, privacy-respecting page counts so we know which references get read. We don't sell behaviour to anyone.
• Advertising measurement. On our shop pages only — the home page, the books and membership pages, our shop site at shop.thebookofpeptides.com, and the order-confirmation page — we use Meta's advertising pixel to tell whether an ad led to a purchase. It is never loaded on the peptide, stack or knowledge pages, so what you read here is never sent to an advertiser. See §05.

Only for running the thing you signed up for:

• Give you access to the books and membership you bought.
• Send transactional email — receipts, renewal reminders, and login or security messages.
• Answer you when you write to support.
• Send the newsletter, only if you opted in.
• Keep the service working, and decide which content is worth writing next.
• Meet our tax, accounting, and legal obligations.

We do not sell your personal information. To measure our own advertising (§05), we share a small set of events with Meta: a purchase or subscription (including its renewal payments), a newsletter confirmation, and an account creation. Each carries the amount where there is one, the product identifier, and a one-way hash of your email — never for anyone else's advertising, and never including anything about what you read. If you are somewhere that requires consent and you declined, none of these are sent at all.

Card numbers are never stored or processed by us. All payments — one-off eBook purchases and recurring membership — run through Stripe, a PCI-DSS Level 1 payment processor. Stripe holds and processes your card details; we only receive back a token, the last four digits, and your subscription status.

If you want to review or remove the card data Stripe holds, you can do that from your account or through Stripe directly.

Every marketing email carries a one-click unsubscribe. Unsubscribing also adds you to a suppression list, so we don't email you again by mistake.

Transactional messages — receipts, security notices, renewal reminders — aren't marketing and are sent while you hold an account regardless of your newsletter choice. Closing the account stops those too. You can update or correct your email anytime from your account, or by emailing us.

We use the minimum cookies needed to keep you logged in and remember your session. Our own analytics are aggregate.

We also run Meta's advertising pixel, and we are deliberate about where. It loads on our commercial pages only: the home page, /books, /ebooks, /membership, our shop site at shop.thebookofpeptides.com (internally /shop) and the order-confirmation page. It is never loaded on the peptide, stack, knowledge or reader pages.

That distinction is the important one. Those reference pages have addresses like /peptides/semaglutide, and loading an advertising tag there would tell an advertiser which compound a person was reading about. We treat that as health information and do not collect or transmit it — not with consent, not without it.

When you buy — and when a membership renews, when you confirm the newsletter, or when you create an account — we send Meta the amount where there is one, the product identifier (for example book-one), our internal order and account references, your country code, and a one-way hash of your email so the event can be matched to an ad. Hashes cannot be reversed into your address. We never send the pages you viewed, and never a compound name. Failed sends are retried from a queue that stores only those hashed values, and is purged after 30 days.

If you are in the UK, the EEA or Switzerland we ask first, and nothing loads unless you accept. Elsewhere you can decline at any time using your browser's cookie controls or an ad blocker, and Meta's own ad preferences let you limit how your data is used across their services.

We keep account and purchase records while your account is open, and for as long afterwards as tax and consumer-law rules require. Newsletter data is kept until you unsubscribe.

Our infrastructure providers and Stripe may store data on servers outside Australia. We only work with providers that offer comparable protection to what Australian law expects.

You can ask us to show you the personal data we hold, correct it, export it, or delete it — subject to records we're legally required to keep. Australian users are covered by the Privacy Act 1988 and the Australian Privacy Principles. Email us and we'll action it.

This is an adult harm-reduction reference and isn't directed at anyone under 18. We don't knowingly collect data from minors; if you believe a minor has given us data, email us and we'll remove it.

If we change this policy, we'll update the date at the top of this page and, for material changes, notify account holders by email.