Privacy policy

Mira Labs LLC runs PepBank.

• Your account. We store your email address, your name, whether your email is confirmed, an optional profile picture and your preferred page view. We use them to sign you in and to run your account.
• Google and ORCID. Signing in with Google is optional. If you use it, Google gives us your name, your email address, your profile picture and whether Google has confirmed that email. We accept only a confirmed Google email. You can link ORCID only to an account that already exists. ORCID can give us your name, and your ORCID ID can give you researcher access. For these links, we store the account ID at the provider, the tokens that keep the link working, the permissions you granted and when they expire. We store Google access and refresh tokens encrypted.
• Sign-in. To sign you in by email, we send you a 6-digit code. It works for 10 minutes and allows 5 tries. We store only a one-way hash of the code. Your session stores a session token, dates, your user ID, your browser's user-agent string and, when our host passes it on, your network address.
• Researcher access. To verify you as a researcher, we store your institutional email, its domain, your institution, your ORCID ID if you add one, the verification status and its dates. We store verification codes only as one-way hashes.
• Chat. We store your questions, the answers, the conversation title, the model you chose and the dates. This also applies when you chat without an account. A new conversation is private. If you turn on sharing, anyone with the link can read it.
• Saved items and API keys. We store the items you save, your notes on them and the dates. For each API key, we store its name, a short visible prefix, its permissions, its expiry date, usage details and a one-way hash. You see the full key only once, when you create it.
• Usage and limits. To apply usage limits, we count requests and keep usage records with the account or a coded network key, the action, the amount, the outcome and the date. Chat, data and contact limits use a one-way code of your network address, not the address itself. Sign-in rate limits are different: they store your network address and the address of the page you called.
• Searches and reports. We store the data searches you run and details of their results. A live search sends your search words to Europe PMC, and its answers can stay in our cache. We keep error reports and ratings so that we can fix problems in the data.
• Contact messages. When you write to us, we use your email, your name if you give it, the topic and your message to answer you. When we know the page you came from, we add its address without the part after “?” or “#”. Our database does not keep contact messages. If you join the Pro waitlist, we use your email only to tell you when Pro opens.
• Logs. Our server logs record request IDs, errors, chat IDs, model IDs and whether an email was sent. We use them to run and repair the site. When a developer runs the site on their own computer without an email service, the log also shows sign-in codes and contact messages.

We do not show ads from other companies, and we do not sell personal data. The site loads no advertising scripts. It uses Google Analytics to measure how people use the site, as described in How we measure site use.

We use cookies to sign you in, to keep sign-in safe and to recognize your browser when you use the site without an account. Google Analytics sets its own cookies, described in How we measure site use. We use no advertising cookies.

• pepbank.session_token keeps you signed in for up to 30 days. When you use the site, the 30 days start again, at most once a day.
• pepbank.session_data holds a short copy of your session details for five minutes.
• pepbank.state protects a Google or ORCID sign-in while it is in progress, for up to five minutes.
• pepbank_anon recognizes this browser for chat and usage limits when you have no account. It lasts up to 365 days.
• pepbank.analytics-consent.v1 is not a cookie. It sits in this browser's local storage and keeps your analytics choice. We set it only when a visitor in the EU, the EEA or the UK chooses Accept or Decline.

On pepbank.io, the sign-in cookie names start with __Secure-. These cookies are HTTP-only and SameSite=Lax, and on pepbank.io they are also Secure.

When you sign out, we delete your session on our server and clear the session cookies in this browser. A copy of the session cache that someone took before you signed out can still work for up to five minutes after sign-out.

Your browser also keeps your theme, recent searches, chat choices, saved items (under pepbank.saved.v1) and a copy of your visitor chats. These copies do not expire on their own.

When you sign in, the conversations and usage of this browser move to your account, and the visitor ID is replaced.

We use Google Analytics 4, a service from Google LLC, to see how people use PepBank. It records:

• the pages you view and how far you scroll
• the links you click to other sites and the files you download
• when you use a form
• your device and browser
• your approximate location (country, region and city), which Google works out from your network address without storing the address

Chat, including every conversation, your account pages and the sign-in page send nothing to Google Analytics.

Google Analytics sets two cookies on this site, _ga and _ga_CTDD6LM4VZ. They let it tell one browser from another. They usually last up to 2 years. Google Analytics keeps event and user data for 14 months.

We do not use Google Analytics for advertising. Ad storage, ad user data and ad personalization are always off. Google signals are off, and we do not send Google Analytics a user ID. When we set up the account, we left all of its data-sharing options off. Google handles this data for us as a service provider.

In the EU, the EEA and the UK. A banner asks you first. You also see it when we cannot tell where you are. Google Analytics sets no cookies until you choose Accept. If you choose Decline, Google Analytics stays off. To change your choice later, use the Cookie settings link at the bottom of the page. We keep your choice in this browser's local storage, not in a cookie.

Everywhere else. When we can tell that you are outside these places, there is no banner. Google Analytics runs with the cookies above.

• Vercel and Neon. We host PepBank on Vercel and keep its records in a Neon PostgreSQL database. The hosting request logs hold full IP addresses.
• Resend. Resend sends our sign-in emails and delivers contact messages to our mailbox. Your email becomes the reply address of your contact message.
• Vercel AI Gateway and model providers. To write a chat answer, we send the conversation so far, our instructions and data from PepBank to a language model through the Vercel AI Gateway. The models we can use come from Anthropic, OpenAI and Google. The gateway also receives a coded account ID, the chat ID and labels, and it can cache requests and answers.
• Google and ORCID. They handle your sign-in or your researcher link when you choose them.
• Google Analytics. Google measures site use for us as a service provider. See How we measure site use.
• Europe PMC. It receives the search words of live literature searches.

Each provider's own settings and terms decide how long it keeps data and how it uses it. This page does not yet confirm their terms on model training, backups or deletion.

Do not put medical records or other sensitive personal information in a chat or a contact message.

You can connect an AI app, such as Claude or ChatGPT, to your PepBank account so that it can use PepBank for you. Before the app connects, PepBank shows you what it asks for, and you choose Allow or Cancel.

What a connected app can do

An app can do only what you allow:

• Search PepBank. It searches studies, trials and study results for you. These searches count toward the daily limits of your plan.
• See your account. It sees your plan, your usage, your limits and the permissions you gave it. It does not see your email address.
• Stay connected. It can renew its access without asking you again.

A connected app cannot see your chats, notes, folder names or email address, and it cannot delete your account.

What we store

For each app, we store its ID, its name, its web addresses and the other details it gives us when it registers. For each connection, we store the permissions you gave, the date you connected the app and the date it last used PepBank. Your usage records show which app made each request.

Access passes

An app gets access passes that work for 10 minutes and renewal passes that work for 30 days. Each renewal replaces the old renewal pass. We store only one-way hashes of these passes. For 30 seconds after a renewal, we also keep an encrypted copy of the new passes, so that a repeated request gets the same answer.

The company behind the app

The company that runs the app receives the PepBank data that the app asks for. For example, Anthropic runs Claude and OpenAI runs ChatGPT. That company uses the data under its own terms and keeps its own copies. PepBank cannot delete those copies when you disconnect the app.

Disconnecting an app

Open your Account page and choose Disconnect under Connected apps. The app loses access at its next request, and its passes stop working. If you delete your account, all of your connections end and we delete their records.

How long we keep it

We do not delete connection records or expired passes automatically. To ask us to delete them, write to us through the contact page.

• Sign-in codes expire after 10 minutes. Sessions end after 30 days, unless you use the site and renew them.
• A cleanup task can delete expired sign-in records one day after they expire. It can also delete visitor sign-in records that have had no live session for 30 days. It does not delete the chats of those visitors.
• Your account details, chats and saved items stay until you delete them. Chat history has no automatic end date.
• Google Analytics keeps event and user data for 14 months.
• Chat, data and contact limits reset at midnight UTC, and so do the daily limits on emails we send. Email code limits use one-hour and 24-hour windows. A reset does not delete the usage records.
• We have set no automatic deletion period for usage counters and records, sign-in rate records, search records, contact emails or server logs.

This page makes no promise yet about the cleanup schedule on the live site, how long our mailbox and our providers keep data, or when backups are deleted.

• Read without an account. Peptide pages need no account. Chat without an account still stores your conversations and usage.
• Delete a chat. In your chat history, open the menu of a conversation and choose Delete. Do this for each conversation that you want to remove.
• Delete your account. Open Account and choose Delete account. Type your email to confirm. You may need to sign in again first.
• Remove browser copies. Clear this site's data in your browser to remove its local copies and cookies. Deleting something on our server does not remove the copy in your browser.
• Change your analytics choice. In the EU, the EEA and the UK, use the Cookie settings link at the bottom of the page to accept or decline Google Analytics.
• Manage access. On your account page, you can revoke API keys and remove saved items.

When you delete your account, we delete your chats, saved items, API keys, plan access, usage counters and researcher verification. We also delete your sessions and your linked Google or ORCID records.

Error reports stay, without the link to your account. Usage events keep a coded account key. Deleting your account does not delete contact emails, search records, export files or backups.

For other data requests, or if you cannot get into your account, use the contact form.

For privacy questions and data requests, use the contact form.