The one-minute version
- Your progress photos never leave your iPhone. They're stored locally in the app's container. iCloud backup is opt-in and end-to-end encrypted with a key only you hold.
- You can use ShotCheck without giving us your name, email, or phone. First launch generates an anonymous handle.
- Community posts are public. When you post, your post and handle are visible to other users.
- We do not sell your data. Not to advertisers. Not to brokers. Not to anyone.
- No advertising trackers in the app. No Facebook SDK, no Mixpanel, no AppsFlyer. Light, anonymized product analytics only.
- One-tap delete. Profile → Privacy → Delete all my data wipes everything.
- Questions? Email privacy@shotcheck.app any time.
1. Who we are
ShotCheck is an iOS app published by Kyle Zhong, an individual sole proprietor, contactable at privacy@shotcheck.app.
ShotCheck is a "listening tool." We aggregate publicly available discussion of peptides from TikTok, Reddit, YouTube, and Instagram so you can see what other users are saying before making a decision. We are not a healthcare provider, telehealth service, pharmacy, dispensary, or vendor. We do not provide medical advice.
2. What data we collect and why
2.1 Data that stays on your device (we never see it)
| Data | Where it lives | Why |
|---|---|---|
| Progress photos | Application Support / ShotCheck / progress/ | Power the guided photo and time-lapse feature |
| Tracker logs (doses, side effects, weight) | Application Support / ShotCheck / tracker/*.json | Personal log only |
| Camera roll exports | Your Photos library (when you opt to save) | Your choice |
These are stored on your iPhone in the app's sandboxed container. They are not transmitted to our servers. If you delete the app, this data is permanently destroyed by iOS.
2.2 Data sent to our server when you use the app
| Data | When | Why |
|---|---|---|
| The goals and shop names you search | When you run a search | To match them against our database and return relevant results and reviews |
| Reviews you submit | When you post a review | Required to add them to the review database other users see |
| Your anonymous handle | At account creation | Required to attribute community posts |
| Your community posts and replies | When you post | Required to show them to others |
| Your authentication token | Each authenticated request | Required to verify your account |
| Your Apple ID identifier | If you choose Sign in with Apple | Required to keep you signed in across devices |
| Moderation reports (flag / block) | When you flag a reply, flag a thread, or block another user | Routed to our moderation queue so we can act on objectionable content within 24h |
| Apple Health read events | Only if you grant access in onboarding or in the weight log | We read weight and height only. ShotCheck never writes to Apple Health. You can revoke access in iOS Settings → Health → Data Access & Devices → ShotCheck. |
ShotCheck v1.0 has no in-app purchases and no paid subscriptions, so no payment data is collected or transmitted by the app.
2.3 Data we do NOT collect
- Your real name, mailing address, phone number, or government ID
- Your photos, tracker logs, or any other on-device content
- Your location
- Your contacts
- Your other apps
- Your browsing history outside ShotCheck
- Your activity on other apps or websites
2.4 Telemetry
We collect anonymized, aggregated usage data to fix bugs and improve features. Specifically: app version, iOS version, device class (e.g. "iPhone15,3"), session duration, which screens were opened, and crash logs. This data is not linked to your identity and is never sold.
We do not use Facebook, Google, AppsFlyer, Mixpanel, Amplitude, Segment, or any third-party SDK that links behavioral data to identity.
2.5 User-generated content moderation
ShotCheck includes community threads, replies, and submitted reviews. To keep the community safe we operate four layers of moderation:
- EULA gate on first launch. Every new user accepts our Terms of Use before reaching the app, including a zero-tolerance covenant on objectionable content, harassment, and dangerous medical advice.
- Submission-time content filter. A conservative banned-token check runs locally on every thread, reply, and review before submission. Violations are blocked with an inline error and never reach our servers.
- Per-post flag affordance. Every thread and reply has a Report option with five categorized reasons (Spam, Dangerous advice, Harassment, Off-topic, Other). Three flags auto-hide the content pending manual review.
- Block account. Blocking a user instantly removes their content from your feed and also notifies our moderation team so we can review the content within 24h. Your block list is reviewable and reversible at Profile → Privacy & data → Blocked accounts.
3. How we use it
- Provide the search, reviews, community, tracker, and progress features
- Sync your data across your own devices (if you sign in with Apple)
- Read your Apple Health weight and height (only if you grant access) to pre-fill the weight log
- Operate the moderation queue described in section 2.5
- Fix bugs and improve the app
- Comply with legal obligations
We do not use your data to train AI models without your explicit consent.
4. Who we share data with
- Apple, for App Store distribution, Sign in with Apple, Apple Health (read-only weight and height), and crash logs.
- Our cloud hosting providers Vercel (application hosting) and Supabase (database), which store the data described in section 2.2.
- Law enforcement, only when compelled by a valid US court order. We will notify you of any such request unless legally prohibited.
We do not sell, rent, or share your data with advertisers, data brokers, or marketers.
5. Your rights
You can, at any time:
- Access your data by viewing it in the app.
- Correct your data by editing it in the app.
- Delete your account via Profile → Delete account (last section, in red). This is a hard delete: it wipes your account, sessions, community posts and replies, search history, reviews you posted, and authentication tokens server-side in a single transaction. On-device progress photos and tracker logs are destroyed by iOS when you uninstall the app. Some anonymized telemetry may persist in aggregate logs for up to 30 days for fraud prevention.
- Manage your block list via Profile → Privacy & data → Blocked accounts.
- Revoke Apple Health access any time in iOS Settings → Health → Data Access & Devices → ShotCheck.
- Opt out of marketing emails (we don't send any by default; if we do in the future, every email has an unsubscribe link).
If you live in the EU, UK, or California, you have additional rights under GDPR, UK GDPR, or CCPA — including the right to lodge a complaint with your data protection authority. We honor these rights for all users regardless of location.
6. Children
ShotCheck is not directed at children under 13 (or under 16 in the EU). We do not knowingly collect data from minors. If you believe a minor has provided us data, email privacy@shotcheck.app and we will delete it.
7. International data transfers
If you use ShotCheck from outside the United States, your data is transferred to and stored in the US. By using ShotCheck you consent to this transfer. We use Standard Contractual Clauses or equivalent safeguards where required.
8. Security
- All network traffic between the app and our servers uses TLS 1.2+.
- Authentication tokens are stored in the iOS Keychain.
- Server-side data is encrypted at rest.
- We do not process payments. ShotCheck v1.0 has no paid features.
- We perform routine security reviews and follow standard industry practices.
No system is perfectly secure. If you discover a vulnerability, please email security@shotcheck.app.
9. Changes to this policy
We will email you (if we have your email) and post an in-app notice when we make material changes. The "Last updated" date at the top reflects the most recent revision.
10. Contact
Email: privacy@shotcheck.app
App Store privacy "nutrition label"
This is how ShotCheck's data practices are declared in App Store Connect, consistent with the policy above.
Important health disclaimer
ShotCheck shows aggregated information about peptides from public internet discussion. This is informational only. It is not medical advice. We are not your doctor, pharmacist, or healthcare provider. Always consult a qualified clinician before starting, stopping, or changing any health protocol. Peptides used outside of FDA-approved indications carry real risks. ShotCheck does not endorse, sell, distribute, or recommend any peptide, vendor, or compound.