This Cookie Policy explains how THE STACK SOURCE LLC, doing business as Peptavo ("Peptavo," "we," "us," or "our"), uses cookies and similar tracking technologies on peptavo.com and related services (the "Services"). It should be read together with our Privacy Policy and our Terms of Service, each of which is incorporated into this Cookie Policy by reference. By accessing or using the Services, you acknowledge and agree to our use of cookies and similar technologies as described in this policy, subject to any consent or preference mechanism we make available to you.
1. What Cookies Are
Cookies are small text files that a website places on your device when you visit it, allowing the site to recognize your device over time and store information about your preferences or past actions. We use the term "cookies" in this policy to refer collectively to cookies and functionally similar technologies, including browser local storage and session storage, regardless of whether they are stored for a single session or persist across visits. Section 2 describes every category we actually use. Our analytics providers send their measurements from your browser to their own servers, which in one case can take the form of a small tracking pixel. Apart from that, we do not use web beacons, device fingerprinting, or cross-site advertising tags on the Services.
2. Categories of Cookies We Use
Strictly necessary cookies. These are required for the Services to function and cannot be disabled through our systems. Our authentication cookies are issued by Supabase, our authentication provider, and hold the session and refresh tokens that keep you signed in, identify you to our servers on each request, and let us enforce access to paid course content. Your course progress, quiz results, and certificates are stored in our database rather than in any cookie, but without a valid session cookie we cannot identify you in order to read or write those records. Because these cookies are essential, blocking or deleting them through your browser will materially impair or entirely prevent your ability to use the Services, and we are not responsible for any resulting loss of functionality, access, or saved work.
Session storage during signup. If you begin signup and then choose to continue with Google, your browser holds the answers you already gave in session storage under the key peptavo_signup_presignup so that they survive the trip to Google and back. Depending on how far you got, those answers can include your name, NPI number, practitioner type, practice name, and practice address. This is stored by your browser on your own device, is never read by a third party, is removed as soon as it is applied to your profile, and is cleared when you close your browser. We also use local storage in one place unrelated to visitors, to preview unsaved blog drafts inside our own admin tools.
First-party signup funnel cookies. Before you sign in, we may set short-lived first-party cookies so we can measure how visitors move from arrival through signup and Stripe Checkout, and so we can apply a discount and credit whoever referred you:
peptavo_fj stores only a randomly generated journey identifier. It contains no name, email address, IP address, or profile information.
peptavo_fa stores a first-touch marketing attribution snapshot: the domain that referred you (hostname only, never the full referring URL), the utm_source, utm_medium, and utm_campaign values in the link you arrived on, the path of the first page you landed on, and any affiliate referral code in that link. It is written once per visitor and is never overwritten, because only the first touch is recorded.
peptavo_ref and peptavo_gift store only a referral or gift code you arrived with, and nothing else: no referring domain, no campaign values, and no landing page. They exist to give you the discount that the link you followed offers, and to credit the partner or colleague who sent it, so we set them wherever that link is followed. Without them a discount you were promised would not reach checkout.
When a journey is created we also record a broad device category (mobile, desktop, or tablet) read from your browser's user agent string. We do not fingerprint your device, and we do not store your IP address on the journey.
All of these cookies are first-party, are marked HttpOnly so page scripts cannot read them, and expire after seven days. None is used for advertising, cross-site tracking, profiling, or sale to anyone, and none is shared with an advertising network. We set the two measurement cookies, peptavo_fj and peptavo_fa, only in regions where our reviewed policy permits notice-based first-party analytics without a prior consent prompt, and that check fails closed: in every other region, and whenever the region signal is missing or unrecognized, we set neither and rely on post-authentication, server-side milestones instead. For that reason we do not present a cookie-consent banner.
Analytics. We use Vercel Web Analytics to understand aggregate traffic to the Services, including which pages are viewed, what broad device and browser category a visitor used, and what site referred them. Vercel Web Analytics does not set cookies on your device and does not build a persistent profile of you across sites. We use what it reports in our sole discretion to measure, audit, and improve the performance, security, and content of the Services.
We use Ahrefs Web Analytics for the same purpose. It also sets no cookies and stores nothing on your device, reports only aggregate page views, referrers, and broad device and location categories, and does not build a persistent profile of you across sites. Because it stores nothing on your device, it runs in every region.
We also use Google Analytics 4, a service provided by Google, for the same purpose. Where it runs, it sets first-party cookies named _ga and _ga_<container id> that store a randomly generated identifier so that repeat visits from the same browser can be counted as one visitor rather than several. Google receives the pages you view, approximate location derived from your IP address, and broad device and browser information, and acts as our service provider in doing so. We have not enabled Google Signals or any advertising, remarketing, or cross-device feature on the property, and we do not sell or share what it collects for cross-context behavioral advertising.
If you buy the course while Google Analytics is running, we also send Google the order reference Stripe assigned to that payment, the amount paid, the currency, whether a partner or gift discount applied, and the partner code where one did. We send this so we can tell which marketing channels lead to enrollments. We do not send your name, email address, or anything about your account, your progress, or your certification, and the order reference identifies a payment only inside our own Stripe account.
The Google Analytics tag is subject to the same regional gate as the signup funnel cookies described above, and the check fails closed: we load it only in regions where our reviewed policy permits notice-based analytics without a prior consent prompt, and in every other region, and whenever the region signal is missing or unrecognized, the tag does not load and no Google Analytics cookie is set. You can also opt out of Google Analytics in any region by installing Google's browser opt-out add-on.
Marketing and advertising cookies. We do not currently set advertising or cross-site tracking cookies on the Services. If we introduce them, we will update this policy and, where applicable law requires it, obtain your consent before setting them.
3. Third-Party Cookies
Certain cookies and similar technologies used in connection with the Services are set or controlled by third parties that provide infrastructure to us, including authentication and database infrastructure through Supabase, hosting and traffic analytics through Vercel, and audience analytics through Google Analytics and Ahrefs. Google's use of the information it collects is governed by Google's Privacy Policy, and Ahrefs' by Ahrefs' Privacy Policy. We do not load Stripe's scripts on peptavo.com and Stripe sets no cookies on our site. When you pay, we send you to a checkout page hosted by Stripe on Stripe's own domain, where Stripe sets and controls its own cookies under its own policies, and then return you to peptavo.com. We may engage other analytics or infrastructure providers from time to time. Third parties set and control their own cookies independently of us, in accordance with their own privacy and cookie policies, and we do not control, and are not responsible or liable for, how any third party collects, uses, or protects information gathered through its own cookies. We encourage you to review each third party's policies directly, and any interaction you have with a third-party cookie or service is at your own risk.
4. Cookie Duration
Some cookies are session cookies that are automatically deleted when you close your browser, while others are persistent cookies that remain on your device for a set period, or until you delete them, in order to recognize you on return visits. Our signup funnel cookies, peptavo_fj, peptavo_fa, peptavo_ref and peptavo_gift, expire seven days after they are set. The Google Analytics cookies described in Section 2 expire two years after your most recent visit, unless you delete them sooner. Authentication cookies last for the life of your signed-in session and are refreshed while you remain active. The specific duration of any other cookie is determined by us or by the applicable third party in our or its sole discretion and may change at any time without notice.
5. Managing and Disabling Cookies
Most browsers allow you to control cookies through their settings, including blocking new cookies, deleting existing cookies, or receiving a warning before a cookie is set, and you can find instructions for doing so in your browser's help documentation. In regions whose law requires prior opt-in consent for non-essential cookies, we do not set our measurement cookies at all, so there is nothing for you to consent to or withdraw. A referral or gift code you arrived with is still stored in those regions, because it is what delivers the discount you asked for by following that link, and it records nothing about your visit beyond the code itself. If we later introduce cookies that require consent in your region, we will request that consent before setting them and will provide a mechanism to withdraw it going forward. You acknowledge and agree, however, that disabling or deleting strictly necessary cookies will prevent you from signing in, completing the Course, or otherwise using core features of the Services, that we bear no responsibility for any loss of access, functionality, or saved progress that results from your browser settings or from your decision to block or delete cookies, and that it is your sole responsibility to manage your browser and device settings as you see fit.
6. Do Not Track
Some browsers offer a "Do Not Track" signal. Because there is no common industry standard for how to interpret such signals, we do not currently respond to them, and your use of the Services after enabling a Do Not Track setting will be treated the same as any other use.
7. Limitation of Liability
TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, WE DISCLAIM ALL LIABILITY ARISING OUT OF OR RELATING TO COOKIES AND SIMILAR TECHNOLOGIES, INCLUDING ANY LOSS OF ACCESS, FUNCTIONALITY, SESSION DATA, OR SAVED COURSE PROGRESS RESULTING FROM YOUR BROWSER OR DEVICE SETTINGS OR FROM YOUR DECISION TO BLOCK OR DELETE COOKIES, AND ANY COLLECTION, USE, OR DISCLOSURE OF INFORMATION BY ANY THIRD PARTY THROUGH ITS OWN COOKIES. Any liability that is not excluded is subject in all respects to the disclaimers, releases, exclusions, aggregate liability cap, and time limit on claims set out in our Terms of Service, which are incorporated into this Cookie Policy by reference.
8. Changes to This Policy
We may update this Cookie Policy at any time and in our sole discretion, including to reflect changes in the cookies or similar technologies we use, changes in our service providers, or changes in applicable law. We will post the updated policy on this page, and your continued use of the Services after any update constitutes your acceptance of the revised policy. It is your responsibility to review this page periodically.
9. Contact Us
If you have questions about this Cookie Policy, contact us at privacy@peptavo.com, or write to:
THE STACK SOURCE LLC, doing business as Peptavo
1908 East 11th Street
Austin, Texas 78702
