What we collect, and what we don’t.

WhatPeptidesDo is a static research library. Every peptide profile, vendor card, dosing protocol, synergy explanation, and comparison page is generated at build time from JSON and TypeScript files committed to the repository. There is no user database, no account system, no login, no password reset, no newsletter, no checkout, no payment processor, and no message board.

Because there is nothing to log into and nothing to buy, the site has nothing it needs to know about you in order to function. The lists below describe what does get collected — incidentally, in service of measuring whether the site is useful — and the explicit limits on how any of it is used.

We use PostHog for product analytics. PostHog records that an event happened — for example, that someone selected a goal on the homepage, adjusted the budget slider, viewed a peptide profile, or filtered the browse page — and aggregates those events to tell us which surfaces of the site are getting used. The captured events on WPD are:

• --goal_selected — which goals you chose on the homepage stack-builder
• --budget_set — the dollar value you set on the budget slider
• --stack_generated — the recommendation engine produced a stack
• --peptide_viewed — a peptide detail page was loaded
• --category_viewed — a category page was loaded
• --search_used — debounced search query on the browse page
• --filter_applied — any filter changed (category, evidence, route, price)
• --compare_started — the Compare button was clicked
• --affiliate_clicked — a vendor link was clicked (covered in detail below)
• --synergy_explored — a synergy arc on the synergy map was clicked
• --learn_page_viewed, blog_post_viewed, faq_expanded — content engagement

No email, name, phone number, address, or account identifier is attached to any of these events, because WPD does not collect any of those. PostHog may set its own cookies or use browser storage to associate repeated visits with the same anonymous session — that is the entire identity model. We do not call PostHog's identify API, we do not link sessions to any external profile, and we do not export PostHog data into any other system.

Vercel Analytics and Vercel Speed Insights run alongside the site for traffic measurement and page-performance telemetry (Core Web Vitals). Both are configured for aggregate measurement. Vercel acts as a processor for us under its own data-processing terms; we do not authorize Vercel to sell or share what it collects on our behalf.

Server logs from the underlying Vercel runtime capture request metadata (IP, user agent, path, timestamp) for the standard hosting purposes — debugging, abuse mitigation, capacity planning. These logs are retained on Vercel's default schedule and are not exported into any analytics or marketing system.

When you click a vendor link — every Buy or vendor URL on the site routes through getAffiliateUrl in src/lib/affiliate.ts — we fire an affiliate_clicked event into PostHog noting which vendor, which peptide, and the destination URL. That event lets us see which vendor cards are actually getting traffic. The click itself takes you to the vendor's own website, at which point you have left WPD and are governed by that vendor's privacy practices, not ours.

Some vendor URLs include a referral parameter (the affiliateParam field on the vendor record) so the vendor knows the visit came from WPD. When you subsequently transact on the vendor's site, the vendor may pay WPD a referral commission. We do not see your order, your shipping address, your payment information, or anything else you submit to the vendor. The vendor sees what its own privacy policy says it sees.

Editorial independence is a hard rule, not a soft one. Which peptides get profiled, how dosing protocols are written, which evidence level a compound is assigned, and which vendor sits at the top of a price-comparison table are determined exclusively by the research and the data — not by which vendor pays the highest referral, not by whether a vendor is paying at all. Vendors with active FDA warning letters or reported federal raids stay listed with the warning displayed, in the same rank position the data places them. We do not stack the deck and we do not surface AggregateOffer schema that would pretend the vendor pricing is endorsed by us; the relationship is informational, and the affiliate disclosure in the footer of every page makes that explicit.

We do not run an email newsletter and do not ask for your email address anywhere on the site. We do not have signup forms, contact forms, comment systems, account-creation flows, or paywalls. We do not collect health information, body measurements, blood test results, or any sensitive personal data, because the site does not have fields that ask for it.

We do not run advertising on the site, so there are no ad-network trackers, no third-party retargeting pixels, no Facebook Pixel, no Google Ads conversion tag, no LinkedIn Insight Tag. We do not embed third-party social-media widgets that phone home with your browsing history. The only third parties that receive anything from your session are PostHog (anonymized events), Vercel (analytics and hosting), and — only when you click a vendor link — the vendor whose site you are about to visit.

We will tell on ourselves about one thing. The codebase contains a LeadCaptureModal component and a /api/leads endpoint that, if wired into a page, would collect name, email, phone, US state, and selected goals/stack for the purpose of connecting users with licensed telehealth partners. As of the date above, the component is not imported or rendered anywhere on the live site, and no link or button on the live site opens it. The route handler is part of the deployed application code, but the UI surface that would call it does not exist on any page.

If we ever turn that surface on, this section will be replaced with an honest description of what gets collected, where it goes, and which licensed telehealth partner receives it — before the form goes live, not after. We mention it now because the code exists in the public repository and we would rather you find out from us than from a curl against the API.

WhatPeptidesDo is a research-and-education resource intended for adults. The peptide compounds discussed on this site are not consumer products, are not FDA-approved for the uses described, and are not appropriate subjects of independent investigation by anyone under 18. We do not knowingly collect information from anyone under 18, and the analytics described above are not designed to identify a user's age in any case.

Because we do not collect personal identifiers, the standard subject-access regime largely does not apply — there is no account record to export and no profile to delete. If you want PostHog to forget the anonymous session identifier it associates with your browser, clear cookies and site storage for whatpeptidesdo.com in your browser settings; both will be regenerated as fresh anonymous identifiers on your next visit. PostHog and Vercel honor their own data-subject-request channels for the data each holds as a processor.

If you are a resident of California, the EEA, the UK, or another jurisdiction with statutory data-subject rights and you believe we hold something about you that we should not, email info@whatpeptidesdo.com from a clear description of what you are asking for. A real person will respond within thirty days.

When the site's data practices change — for example, if the dormant lead-capture surface is activated, if a new analytics provider is added, or if the affiliate-link routing changes — this page is updated and the date at the top is bumped. We do not silently change what gets collected without saying so here.