Privacy Policy

• We store your email, your orders, and their delivery address — collected by Stripe for card orders, or typed on our own checkout page for crypto orders.
• We never see your card number or your wallet keys. Card payment happens entirely on Stripe's systems; crypto payment happens entirely on Coinbase Commerce's.
• We use no third-party analytics — no Google Analytics, no tracking pixels, no session replay, no advertising trackers. Not a single one. We do count how the site itself is used, on our own servers, without cookies and without recording anything that identifies you. Detail below.
• Our fonts are served from our own server, so loading a page tells Google nothing about you.
• If you take the protocol quiz, we store your stated research interest. We treat that as sensitive — see below.

Checkmate Peptides is the controller of the personal data described here. For anything on this page, write to privacy@checkmatepeptides.com.

Account

Your email address, and your name if you give one. If you sign in with Google or Apple we also receive the name, email and (Google only) profile picture that provider shares. Passwords are stored only as a bcrypt hash — we cannot read yours, and nobody here can tell you what it is.

Phone number, only if you add one

You can add a phone number to your account to sign in with a one-time SMS code instead of a password. We store the number you verified, and while a code is live we store a hash of it — never the code itself. Separately, if you opt into SMS community updates on the homepage welcome experience, we store that number and your opt-in for marketing texts (see “Email and SMS community updates” below). Stripe may still collect a delivery phone at checkout. Remove a sign-in phone any time from My Account.

Orders

What you bought, when, what it cost, and the reference our payment processor gives us — Stripe for card payments, Coinbase Commerce for crypto (for crypto we also record which asset settled the payment, e.g. USDC). This is how we fulfil the order and how we answer you when you ask about one.

Delivery address

Recipient name, street address, city, region, postal code, country, and phone number if you supply one. For card orders it is collected by Stripe during checkout and copied to us; for crypto orders you type it on our own checkout page and we store it directly. Either way it exists so we can ship the parcel.

Protocol quiz

Which of six research fields you selected, your stated experience level, and how often you intend to order — plus which products we recommended in response.

Supplements waitlist

If you ask to be told when Checkmate Supplements launches, we store your email address and, only if you choose one, which of the four preview categories interests you. Nothing else, and it is not attached to your account even if you have one — it is a separate list, kept so we can send that one announcement.

Ecosystem community (homepage welcome)

If you join through the Health Is Wealth welcome experience, we store your email, an optional phone number only when you opt into SMS, whether you opted into email and SMS updates, a one-time founder-welcome token and unique coupon code used at checkout, and when that welcome was redeemed on a paid order. This list is not attached to your account even if you later create one.

Film viewing progress, only with your consent

If you say yes to the one-time prompt on a film page, we store per film: how far you got, how many seconds you actually played, whether you finished, when you started and last watched, and any films you saved to My List. This exists so Continue Watching, Watched badges and resume work across your devices. You can remove any single entry, clear the history entirely, or stop saving at any time from My Library or the film page. Decline the prompt and films simply play without being remembered. We never use viewing history to infer anything about your health, and it never affects Institute lesson progress.

Referrals

If you arrive through a partner link, we record the code, the page you landed on, and the time, so the partner is credited for a resulting order.

Partner account, only if you activate one

If you claim a partner code, we store the code, your partner rank, when you accepted the conduct standard, and the commission records your referrals generate. This exists only if you activate it, and activation is never required to buy.

Payout and tax details, only if you set up partner payouts

To pay commission and report it as US tax law requires (Form 1099-NEC), we store your legal name, business name if you give one, federal tax classification, address, PayPal email, the date you certified the details, and your SSN or EIN. The tax number is encrypted before it is stored and appears anywhere else only as its last four digits. Tax records are retained for as long as tax law requires, even if you close your account.

Server logs

Our API logs each request in the standard web-server format: your IP address, the URL requested (including any search term you typed), the page you came from, and your browser’s user-agent string. Request bodies are never logged, so passwords and quiz answers do not appear in them.

What we do not collect: we hold no date of birth, age, gender, weight, height, medical conditions, medications, or government identification. There is no field for any of it in our database.

The protocol quiz asks which field of research interests you — metabolic, muscle and performance, recovery, longevity, cognitive, or hormonal. Combined with what you go on to buy, that can imply something about your health, even though we never ask a health question directly and the options describe fields of study rather than conditions.

So we treat it as sensitive. It is never used for advertising — we do no advertising — never sold, and never shared. If you would rather we did not hold it, ask and we will delete it; if you take the quiz while signed out, it is never attached to you at all.

Stripe

Our payment processor. We send the items you are buying, the shipping options, and — if you are signed in — your email address. Stripe collects your card details and delivery address directly, on its own systems. Your card number never reaches our servers and is never stored by us. Stripe returns the delivery address, phone number, and a payment reference, which we keep against the order.

Coinbase Commerce

Our crypto payment processor, involved only if you choose to pay with cryptocurrency. We send the order amount and an order reference; the payment itself happens from your own wallet on Commerce's hosted page. We never see your wallet, its keys, or its balance — only that the payment confirmed, and in which asset. Unlike Stripe, Commerce collects no delivery address; you give us that directly on our own checkout page.

Google

Only if you choose “Continue with Google”. Google then tells us your email, name and profile picture. If you never use that button, Google receives nothing about you from this site.

Apple

Only if you choose “Continue with Apple”. Apple tells us your name and email — which may be a private relay address if you choose to hide yours, and that is fine by us. If you never use that button, Apple receives nothing about you from this site.

Twilio

Only if you add a phone number for sign-in. Your number and the text of the one-time code pass through Twilio, which delivers the SMS. Twilio is not told who you are, only the number and the message.

Anthropic

Only if you use the Checkmate Concierge chat. We send the messages you type, plus the recent messages of that conversation held in your own browser, so the assistant has context — and nothing else. No account details, order history, or identifiers are attached, and we store no copy of the conversation on our servers. Anthropic processes the messages to generate the reply, retains API inputs and outputs for a limited period (up to around 30 days) for abuse monitoring, and does not use them to train its models. The conversation itself lives only in your browser's local storage; the chat's “Clear conversation” button erases it. Please do not type personal or health information into the chat — it is not built to hold either.

Nobody else

There are no analytics providers, no advertising networks, no marketing platforms, no third-party chat vendors beyond the AI concierge described above, no error-reporting services, and no content delivery networks loading anything into your browser. Our usage measurement is first-party: it runs on our own servers, nothing about it leaves them, and no third party receives it. We do not sell personal data, and we do not share it for cross-context behavioural advertising.

We currently keep account, order, quiz and waitlist data indefinitely, and we have no automated deletion. Orders are the main reason: we have accounting and product-traceability obligations that make deleting a sales record the wrong default.

Being straight about the consequence: erasure requests are handled by hand rather than by a button in your account. We are telling you that rather than implying an automation that does not exist. A published retention schedule is still to be defined.

Depending on where you live, you may have the right to access a copy of your data, correct it, delete it, object to or restrict how we use it, take it elsewhere in a portable format, and complain to your data protection regulator.

Email privacy@checkmatepeptides.com and we will action it. We do not charge for this and will not make you justify the request. Where we must keep an order record for accounting reasons, we will say so and delete everything we are not obliged to keep.

This section needs review against GDPR/UK GDPR and US state privacy law for the markets you actually sell into, including statutory response deadlines.

Passwords are hashed with bcrypt and never stored in a readable form. Your session is held in a cookie your browser will not expose to JavaScript. Personal endpoints require a valid session; none of them accept an email address as proof of identity.

One thing worth knowing: an order confirmation page can be opened by anyone holding its link, so that guests can see a receipt without an account. Treat an order link like a receipt — anyone you send it to can read it.

Order email is separate from marketing. When an order is paid we send a confirmation to the address on the account: what you bought, what you were charged, and a link to the order. When it ships you will get the tracking details the same way. Those messages are transactional.

Community email is opt-in only. If you join through the homepage welcome experience (or a similar explicit signup), we may email you about education, training, science updates, product information, and offers. Joining the waitlist for Checkmate Supplements is a separate, single-purpose list. Placing an order alone does not add you to a marketing list.

SMS is opt-in only, with clear permission. If you provide a mobile number and check the SMS consent box, we may text you workout reminders, science releases, training insights, product education, and exclusive offers. Consent is not required to buy. Message frequency varies; message and data rates may apply. Reply STOP to cancel, HELP for help. We do not send marketing SMS unless you opted in.

Because order confirmations are part of the transaction rather than promotion, there is no unsubscribe link on them — the way to stop receiving them is to stop placing orders. Guest checkouts have no account address, so nothing is sent for them. Stripe may also send a payment receipt of its own. To stop community email or SMS, write to privacy@checkmatepeptides.com.

This site is not intended for children, and nothing sold here may be supplied to one. See our Terms of Sale.

We count what happens on the site so we can tell which pages help and which get in the way. It runs on our own servers. It sets no cookies, it involves no third party, and it is not used for advertising.

Each event records: what happened (a page was viewed, an item was added to a bag, checkout was started), the path it happened on, a timestamp, and a random identifier that lives in your browser tab's temporary storage and is destroyed when you close the tab. That identifier lets us see that four steps belonged to one visit. It cannot be matched to you, it is not stored in a cookie, it is never sent to anyone else, and it does not persist to your next visit.

We do not record your name, email, address, IP address, card details, or anything you type. We do not follow you to other sites, and there is nothing here that could.

The video library at /science/videos lists films hosted on YouTube. Opening that page contacts nobody. The thumbnails are fetched by our server and served from our domain, so browsing the library tells Google nothing about you.

Pressing play is different. At that point, and only then, a YouTube player loads into the page and your browser connects to Google, which can set its own cookies and will know you watched that video — exactly as if you had opened it on YouTube. We use the youtube-nocookie.com host, which reduces what is stored before you interact with the player, but it does not make the connection private. If you would rather not, do not press play: every film also links out, and you can decide there.

Covered separately and in full on our Cookie Notice, which lists every cookie by name.

If we change what we collect, we change this page with it. The effective date at the top tells you when it last moved.