Last updated: November 3, 2026
Everything you log in ApexProtocol is stored only on your device. We never receive it, and we don't use analytics, advertising or tracking. The few things that do go through our server are listed below, so you know exactly what they are.
These are stored only on your phone and never sent to us:
You can delete all of it at any time in Settings → Delete All Data, or by deleting the app. Backup files you export are yours: they go wherever you choose to save or send them.
When a coach or doctor sends you a plan from the ApexProtocol dashboard, the plan is stored on our server so the app can download it with its code. A plan contains the compounds, doses, schedule and notes they wrote, and the name they entered for you.
Plans expire after 30 days and are deleted from our server shortly after. Importing a plan only downloads it to your phone; the app never sends your own data back.
While older versions of the app are still in use, a copy of each plan is also kept on our previous hosting provider's server, which those versions read from. This stops once they are retired.
Payments are handled by Apple (App Store) or Google (Google Play). We never see your card or payment details.
We use RevenueCat to check whether your subscription is active. RevenueCat receives an anonymous ID created by the app and your purchase details (plan, price and dates). It does not receive your name, email address or any of your health data.
If you enter a code from a doctor or coach, we store the code together with your anonymous subscription ID and the plan you buy, so the person who referred you can be credited. They see how many people used their code and the resulting revenue. They don't see your name or any of your health data.
If you have a dashboard account, we store your name, email address, a securely hashed password, and the clients and plans you create. You are responsible for having your clients' permission to enter their information.
We use these companies to run ApexProtocol. They only process data to provide their service to us:
Our server and database are located in the United States. We never sell your data or share it with anyone else.
Dose reminders are scheduled on your phone itself, with no server involved. Camera and photo library access is used only to add the photos you choose, and those photos stay on your device.
If iCloud or Google backup is turned on, your phone may include ApexProtocol's data in your personal backup. Those backups are managed by Apple or Google under their own privacy policies; we have no access to them.
This website doesn't use cookies, analytics or tracking. It loads fonts from Google Fonts, which receives your IP address like any web request.
Your on-device data is yours alone: view, export or delete it in the app at any time. For anything stored on our server (a plan sent to you, a referral code record or a dashboard account), email us and we will send you a copy or delete it.
If you are in the EU or UK, you have the right to access, correct and delete your personal data, to object to its use, and to complain to your local data protection authority.
ApexProtocol is intended for adults and is not directed at anyone under 18. We do not knowingly collect information from children.
When anything changes, we will update this page and the date at the top.
If you have any questions about this privacy policy, reach out at apexprotocol@icloud.com.