Privacy Policy

What the site collects

The site collects only what a feature needs:

• Price-alert emails (if the alert form is shown): your email address, the compound and vial size you chose, and a salted hash of your IP address. You confirm by email before anything is sent.
• COA submissions: the lot or report number, vendor, compound, laboratory, report link, purity and test date you enter. No name or email is asked for. A submission is stored as unverified and is not shown until an administrator checks it.
• API keys (issued by an administrator on request, there is no sign-up form): the email address and the label you give when you ask for a key, a keyed hash of the key and the time it was last used. The key itself is shown once and is not stored.
• Salted IP hashes: used to limit how often a form, a game or the API can be used, and stored with outbound-link clicks. The hash is an HMAC-SHA-256 made with a secret key of the site, and the raw address is not stored.
• Outbound link clicks (Pepcore links): the link, the page it came from, the compound, the time, and salted hashes of the IP address and the browser user agent.
• Game scores: three letters of initials you choose, your score, a round identifier and a salted IP hash.
• Saved plans: if you create a share link for a calculator plan, its inputs and a salted IP hash.
• Server logs: the web host records each request (IP address, time, address requested, browser) as part of running the service.