Legal · effective August 31, 2026

Privacy notice

This notice states what peptidealliance.org collects, from whom, and for what purpose. Each clause is numbered. A clause states a practice or it states an absence.

P1Scope

This notice governs peptidealliance.org and every page served from that domain. It does not govern any other site.

Sites reached through a link from here run under their own notices. Clause P22 states the consequence.

P2Publication model

This site is a set of pre-built pages served from a content delivery network. There is no database of readers and no application server holding reader records.

The model constrains what can be collected. Most of the absences recorded below follow from it rather than from a promise.

P3What is collected

Three categories, and no fourth:

1. Analytics. Google Analytics 4 records the page address, the referring address, an approximate location derived from a truncated IP address, device and browser characteristics, and the time of the request. IP anonymization is enabled in the tag configuration.

2. Request logs. The hosting provider records the requesting IP address, the user agent string, the path requested, and a timestamp. That is ordinary server and network logging. Its retention period is set by the provider and not by this site.

3. Correspondence. A reader who writes to the published address sends an email address and whatever the message contains. Clause P20 states how long that is kept.

P4What is not collected

There are no accounts on this site. There is no login, no password, and no reader profile.

There is no form on this site that submits data. Contact is by email link only. No payment is taken here and no card data reaches this domain.

No health information is requested, and none should be sent. A reader who volunteers a health detail in an email has sent it voluntarily and it is treated as correspondence under P20.

There is no newsletter, no mailing list, and no subscription. There is no advertising pixel, no remarketing tag, no conversion pixel, and no data broker integration.

P5Cookies and local storage

The cookies set on this domain are the Google Analytics cookies whose names begin _ga. They carry a randomly assigned identifier used to count a returning browser as one browser rather than two.

Two values are written to this browser's local storage. pa-privacy records an opt-out. pa-privacy-seen records that the notice at the foot of the page has been dismissed.

Neither local storage value is transmitted anywhere. Both stay in the browser that wrote them and are readable only by this domain.

P6Google as processor

Google LLC operates Google Analytics and processes the analytics data described in P3 as this site's service provider. Google's own terms and privacy policy govern that processing.

Analytics data is held in a Google Analytics property controlled by this site. It is not shared with any other party and it is not sold.

P7Consent defaults

Google Consent Mode is configured before the analytics library initializes. Four defaults are set on every page:

1. ad_storage: denied. 2. ad_user_data: denied. 3. ad_personalization: denied. 4. analytics_storage: granted.

The three advertising signals are denied for every visitor on every page at all times. No setting on this site turns any of them on.

P8The outbound redirector

A partner link on a seller record points at a path on this domain of the form /go/ followed by a seller slug. That path answers with a temporary redirect to the affiliate network.

The redirect address carries four fixed parameters: an offer identifier, a publisher identifier, a source name, and the seller slug. None of the four identifies the reader.

The receiving network is Katalys, which operates the tracking server the redirect points to. What that network sets, records, and retains is governed by its own notice and not by this one.

The redirector writes no cookie of its own and stores no record of the click on this domain. The path is disallowed to crawlers in the site's robots file.

P9Opt-out posture

This site serves a United States audience. United States privacy law is an opt-out regime, and this site is configured for it.

Analytics runs from the first page view. It is disclosed on that first view and it can be switched off at any point, with effect on the page where the switch is used.

No page is gated behind a consent dialog. A gate that must be dismissed before anything can be read is not a choice and is not used here.

P10Global Privacy Control and Do Not Track

Both signals are honored in code, on every page, before analytics storage is used.

The page checks three things: a Global Privacy Control signal set to true, a browser Do Not Track value of 1, and a stored opt-out from a prior visit. Any one of the three sets analytics_storage to denied.

A reader who sends a Global Privacy Control signal therefore needs to do nothing else. The signal is treated as a valid opt-out request under the state laws listed in P14.

P11On-site opt-out

The control below applies to this browser and takes effect on this page.

The control does three things in order: it writes the opt-out flag to local storage, it sends a consent update denying analytics storage, and it expires the analytics cookies already set.

Denying consent stops future writes. It does not delete a cookie already written, which is why the third step exists.

The opt-out is stored in this browser. Clearing site data clears the opt-out along with everything else, and the choice has to be made again.

P12Browser-wide opt-out

Google publishes a browser add-on that blocks Google Analytics on every site, not only this one.

Enabling Global Privacy Control in a browser or extension is the broader equivalent. It is honored here under P10.

P13No sale, no sharing, no targeted advertising

This site does not sell personal information as California law defines a sale. It has never done so.

It does not share personal information for cross-context behavioral advertising as California law defines sharing. The three advertising signals in P7 are the mechanism by which that absence is enforced rather than merely asserted.

It does not use personal information for targeted advertising or for profiling that produces legal or similarly significant effects. It runs no such processing.

P14State privacy rights

Residents of California, Virginia, Colorado, Connecticut and Utah hold rights under their state privacy statutes. Residents of other states with comparable statutes hold comparable rights and are treated identically here.

The rights available include: 1. the right to know what categories are collected. 2. the right to access what is held. 3. the right to correct an inaccuracy. 4. the right to deletion. 5. the right to a portable copy. 6. the right to opt out of sale, sharing and targeted advertising. 7. the right against discrimination for exercising a right.

Exercising a right costs nothing and changes nothing about what this site shows. There is no reader tier and no benefit that can be withdrawn.

The practical scope is narrow. For a reader who has never written in, what is held is analytics and request logs described in P3, and the answer to an access request will say so.

P15How a request is made

There is no data-subject portal on this site, and no automated request form. Requests are made by email to standards@peptidealliance.org.

State the right being exercised and the state of residence. A request is answered within the period the applicable statute sets, which is forty-five days in most states, extendable once where the statute allows it.

A request to opt out of analytics does not need to travel by email. The control in P11 and the signal in P10 are faster and are honored immediately.

P16Verification

A request to access, correct or delete is answered only when the requester can be matched to the data held. That is the statutory requirement and it protects the reader.

Because no accounts exist, there is usually nothing to match a requester against. Where a request cannot be verified, it is declined with a written statement of why, which is what the statutes require in that case.

Identity documents are not requested and should not be sent. A verification exchange uses the email address that made the request.

P17Authorized agents

An authorized agent may submit a request on a consumer's behalf where state law permits it. The agent must provide written authorization signed by the consumer.

The consumer may be asked to confirm the authorization directly. That confirmation step is permitted by California law and is used where the authorization is unclear.

P18Appeals

A requester whose request is refused may appeal by replying to the refusal within sixty days. Write the word appeal in the subject line.

An appeal is answered in writing with the reason for the decision. Where the appeal is denied, the response names the state attorney general to whom a complaint may be submitted, as Virginia, Colorado and Connecticut law require.

P19Children

This site is written for adults and is not directed to children. Nothing here is offered to a person under thirteen.

No age is requested and none is collected, so no age is known. Where it becomes known that data from a child has been received in correspondence, that correspondence is deleted.

The site does not knowingly sell or share the personal information of a consumer under sixteen, and it has no mechanism by which it could.

P20Retention

Analytics data is retained for the period configured in the Google Analytics property, after which Google deletes it on its own schedule.

Request logs are retained by the hosting provider under the provider's schedule. This site does not extend that period and does not copy those logs elsewhere.

Correspondence is retained while the matter it concerns is open, and afterward for as long as a record of the correction or the request is useful. A correction to the ledger is a dated public record and stays published.

P21Security

Pages are served over HTTPS. The site holds no accounts, no credentials, and no payment data, so the categories most often exposed in a breach are absent by construction.

Analytics data sits inside a Google account protected by that account's controls. Correspondence sits in an email account protected by that account's controls.

No transmission over the internet is perfectly secure, and no claim of perfect security is made here. What is claimed is a small surface, stated exactly.

P22Third-party destinations

Outbound links leave this domain. A seller's site, a regulator's site and a journal's site each set their own cookies under their own notices.

This site does not control those practices and does not audit them. Read the destination's notice before entering anything into it.

P23Audience and location

This site is operated for readers in the United States, and the data described here is processed in the United States.

It is not directed at readers in the European Economic Area, the United Kingdom, or Switzerland, and it is not designed for their consent frameworks.

P24Amendment and dating

This notice carries the effective date printed above the title. A change to a practice changes this notice and changes that date on the same day.

The date is the claim. A notice quoted without its effective date is quoted incorrectly, in the same way a ledger disposition is.

P25Contact

Privacy questions, rights requests and appeals: standards@peptidealliance.org.

Related documents: terms of use, funding, medical disclaimer, and trademarks.