Legal

Privacy Policy

Last updated: March 20, 2026

1. Introduction

Zajaly LLC ("we", "us", "our") operates PharmKit. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

2. Information We Collect

2.1 Account Information

  • Email address (for account creation and communication)
  • Display name (optional, user-provided)
  • Authentication provider data (Google, GitHub, or email/password via Supabase Auth)
  • Avatar URL (if provided via OAuth)

2.2 Usage Data

  • Calculation inputs and outputs (for registered users, stored in calculation history)
  • AI interpretation requests and credit usage
  • Tool usage patterns and frequency
  • Favorite tools and preferences

2.3 Analytics Data

  • Page views and navigation patterns (via PostHog analytics)
  • Feature flag evaluations
  • Device type, browser, and operating system
  • Approximate location (country/region level, from IP address)

2.4 Payment Data

  • Stripe customer ID (stored in our database)
  • Subscription tier and billing status
  • Payment details are processed and stored exclusively by Stripe; we never store card numbers

2.5 Server Logs

  • IP addresses (in server logs only, not stored in user profiles)
  • API request logs (for rate limiting and debugging)

3. How We Use Your Information

  • To provide and maintain the Service
  • To manage your account and subscription
  • To process AI interpretation requests
  • To store your calculation history and favorites
  • To enforce rate limits and prevent abuse
  • To improve our tools and user experience via analytics
  • To communicate service updates, security alerts, and billing notifications

4. Data Storage and Security

Data is stored in Supabase (PostgreSQL) with Row Level Security (RLS) policies. All data is encrypted in transit (TLS) and at rest. API keys are hashed before storage; raw keys are shown only once at creation.

5. Third-Party Services

  • Supabase: Authentication and database hosting
  • Stripe: Payment processing
  • Anthropic (Claude API): AI interpretation processing
  • PostHog: Product analytics and feature flags
  • Vercel: Frontend hosting and deployment

Each third-party service has its own privacy policy. We recommend reviewing their policies.

6. Data Retention

Account data is retained while your account is active. Calculation history is retained for 12 months. Server logs are retained for 30 days. You can request deletion of your account and associated data at any time.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access, correct, or delete your personal data
  • Export your data in a portable format
  • Opt out of analytics tracking
  • Withdraw consent for data processing

To exercise these rights, contact us at privacy@pharmkit.dev.

8. Cookies

We use essential cookies for authentication and session management. Analytics cookies (PostHog) are used to improve the Service. See our Cookie Policy for details.

9. Children's Privacy

The Service is not directed to individuals under 16. We do not knowingly collect data from children. If you believe we have collected data from a child, contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or a prominent notice on the Service.

11. Contact

For privacy inquiries, contact privacy@pharmkit.dev.