Privacy Policy

1. About this policy

This privacy policy describes how The Clav Stack ("we," "us," or "our") collects, uses, and discloses information when you visit theclavstack.com and its subpaths (the "Site"). It applies only to this Site; it does not apply to any third-party site you reach by clicking an outbound link, including the supplier checkout at phiogen.is.

The Clav Stack is an independent editorial resource. We document publicly available research, publish commentary, and link to a third-party supplier under an affiliate arrangement. We do not manufacture, stock, ship, or sell peptides. All compound-purchase transactions occur at the supplier's own website under that supplier's terms and privacy policy.

2. Information we collect

2.1 Information collected automatically

When you load a page, our hosting provider (Vercel Inc.) receives standard HTTP request metadata: your IP address, user-agent string, HTTP referrer, the URL you requested, and a timestamp. This data is used for security, debugging, abuse prevention, and aggregate traffic analysis. Vercel retains request logs under its own retention policies.

We use Vercel Analytics to measure aggregate page views and referral sources. Vercel Analytics is a privacy-preserving analytics product that does not use cookies, does not fingerprint devices, and does not track users across sites. Reports we see are limited to aggregated counts and do not identify individual visitors.

2.2 Information generated when you click an outbound link

Outbound product links on this Site are prefixed with /out/. When you click one, our server briefly receives your request before redirecting your browser to our supplier Phiogen with an affiliate reference parameter (?ref=PEPS). This parameter allows Phiogen — through their affiliate platform (Refersion, Inc.) — to attribute any resulting purchase to The Clav Stack so we can be paid a commission.

The affiliate network typically sets first- or third-party cookies or uses similar mechanisms on Phiogen's domain to record that you arrived via The Clav Stack. We do not see your identity, shipping address, payment details, order contents, or any personal information you provide to Phiogen. We do receive aggregate, de-identified reporting (for example: number of clicks, number of conversions, commission earned) from the affiliate network.

2.3 Information you voluntarily send us

If you contact us by email using the address at the bottom of this policy, we receive your email address and the contents of your message. We use this information solely to respond to your inquiry and retain it only as long as needed to do so.

2.4 Information we do not collect

We do not operate newsletter signups, contact forms, comment sections, or user accounts. We do not process payments, take orders, or store shipping or billing information. We do not run Google Analytics, Meta (Facebook) Pixel, TikTok Pixel, X/Twitter pixel, LinkedIn Insight Tag, or any other ad-network tracking. We do not sell, rent, or trade information about visitors.

3. Cookies and similar technologies

This Site does not set tracking or advertising cookies. Vercel Analytics is implemented without cookies. Your browser may cache static assets (fonts, images, JavaScript) for performance; this is standard browser caching and not a tracking mechanism.

When you follow an outbound affiliate link, the destination site (Phiogen) and its affiliate platform (Refersion) may set their own cookies under their own policies. You can review and control those at phiogen.is and at refersion.com.

4. How we use information

We use the limited data described above to:

• Operate, maintain, and secure the Site.
• Understand which content is being read and which outbound products receive clicks, so we can prioritize editorial updates.
• Attribute affiliate commissions through our supplier's referral system.
• Respond to inquiries you send us by email.
• Comply with law, enforce our Terms, and protect rights, property, and safety.

We do not use information to make automated decisions that produce legal or similarly significant effects about you. We do not profile you and we do not use your data to train machine-learning or artificial-intelligence models.

5. How we share information

We share information only as follows:

• Hosting and infrastructure: Vercel Inc. processes requests on our behalf under their terms of service.
• Affiliate attribution: When you click an outbound link, your browser is directed to Phiogen, and Refersion records that referral. We do not transmit personal information to them beyond what your browser sends through the redirect itself.
• Font delivery: Fonts on this Site load from Google Fonts. Google receives the IP address of requests made to fonts.googleapis.com.
• Legal and safety: We may disclose information if required by law, subpoena, or court order, or when we believe in good faith that disclosure is necessary to protect our rights, comply with legal process, or protect anyone's safety.
• Business transfers: If The Clav Stack is merged, acquired, or sells substantially all of its assets, information may be transferred to the successor subject to this policy or a successor policy.

We do not sell personal information for money. Certain U.S. state laws define "sale" or "sharing" broadly enough that affiliate redirects could fall within those definitions; out of caution we treat all outbound affiliate clicks as "sharing" for purposes of those laws and honor any opt-out request you submit, including through Global Privacy Control.

6. Third-party services referenced

• Vercel Inc. — hosting and privacy-preserving analytics.
• Google LLC (Google Fonts) — font delivery.
• Phiogen — our third-party research-compound supplier; destination of all outbound product links.
• Refersion, Inc. — affiliate platform used by Phiogen to track referrals and commissions.

Each of these parties operates under its own privacy policy, which we recommend you review if you wish to understand how they handle data.

7. Your privacy rights

7.1 California (CCPA / CPRA, including 2026 updates)

If you are a California resident, you have the right to: (a) know what categories of personal information we collect, use, disclose, and share; (b) access the specific pieces of personal information we hold about you; (c) correct inaccurate personal information; (d) delete personal information we have collected from you, subject to exceptions; (e) opt out of the "sale" or "sharing" of personal information; (f) opt out of automated decision-making technology that makes significant decisions about you (we do not use such technology); and (g) not be discriminated against for exercising these rights.

Categories collected (last 12 months): Internet and network activity (IP address, user agent, referrer, pages viewed, outbound clicks), inferences drawn from that activity (aggregate content popularity), and communications content (if you email us). Sources: directly from your browser. Purposes: operating and improving the Site, affiliate attribution, responding to inquiries, legal compliance. Recipients: the third-party service providers listed in Section 6.

We do not knowingly sell personal information or share it for cross-context behavioral advertising. We do not have actual knowledge that we sell or share personal information of consumers under 16 years old.

To exercise any of these rights, email privacy@theclavstack.com with the subject line "California Privacy Request." You may designate an authorized agent to submit a request on your behalf; we may require you to verify the agent's authority and your identity.

7.2 California Shine the Light

California Civil Code § 1798.83 permits California residents to request a notice disclosing categories of personal information shared with third parties for direct-marketing purposes. We do not share personal information for any third party's direct-marketing purposes.

7.3 Other U.S. state laws (VA, CO, CT, UT, OR, TX, FL, MT, IA, DE, TN, NH, NJ, MN, MD, KY, RI, and others)

If you reside in a U.S. state with a comprehensive consumer privacy law, you generally have rights similar to those above — access, correction, deletion, portability, and opt-out of sale/sharing and targeted advertising — subject to each law's thresholds and exemptions. To exercise these rights, email privacy@theclavstack.com. If we deny a request, you have the right to appeal by replying to our response with the subject "Appeal."

7.4 European Economic Area, United Kingdom, and Switzerland

If the General Data Protection Regulation (GDPR) or UK GDPR applies to our processing of your information, you have the rights of access, rectification, erasure, restriction of processing, data portability, and objection, and the right to lodge a complaint with your local supervisory authority (e.g., the UK Information Commissioner's Office). Our legal bases are our legitimate interest in operating and securing the Site, your consent where required, and compliance with legal obligations.

7.5 Global Privacy Control

This Site recognizes the Global Privacy Control (GPC) browser signal. A GPC signal from your browser is treated as a valid request to opt out of sale and sharing of personal information in all jurisdictions where such an opt-out right exists.

8. Do Not Sell or Share My Personal Information

To submit a Do-Not-Sell/Do-Not-Share request, email us at privacy@theclavstack.com with the subject "Do Not Sell or Share My Personal Information," or enable Global Privacy Control in your browser. Upon receipt we will stop any sharing that could qualify under applicable state law, including disabling affiliate attribution cookies that Phiogen or Refersion may otherwise record based on your click.

9. Do Not Track

Because no standardized response to Do Not Track (DNT) browser signals has been finalized, this Site does not respond differently to DNT signals. We do, however, honor Global Privacy Control (see Section 7.5).

10. International transfers

The Site is operated from the United States and our providers primarily process data in the United States. If you access the Site from outside the United States, your information will be transferred to, stored, and processed in the United States and other jurisdictions in which we or our service providers maintain facilities. Where required by law, we rely on appropriate safeguards such as Standard Contractual Clauses for international transfers.

11. Data security

All traffic to theclavstack.com is served over HTTPS with HSTS enabled. We select providers (Vercel, Google Fonts) that implement industry-standard security controls. No method of transmission over the Internet is 100% secure; we cannot guarantee absolute security and disclaim liability to the extent permitted by law.

12. Data retention

Request logs held by our hosting provider are retained under that provider's schedule (typically 30 days for raw logs). Aggregate analytics are retained as long as they remain useful for editorial planning. Email correspondence is kept only as long as needed to address the inquiry and any reasonable follow-up. If you ask us to delete information we hold about you, we will do so promptly unless a specific legal exception applies.

13. Age restrictions

This Site is intended for adults aged 21 or older engaging in a research context. In line with the U.S. Children's Online Privacy Protection Act (COPPA), we do not knowingly collect personal information from anyone under 13. If you are a parent or guardian and believe your child under 13 has provided us with information, email us at privacy@theclavstack.com and we will promptly delete it.

14. Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Effective" date at the top of this page. Material changes will be flagged with a banner on this page for at least 30 days. Continued use of the Site after a change constitutes acceptance of the updated policy.

15. Contact

For any privacy-related question or request, contact us at privacy@theclavstack.com. We will respond within the time limits set by whichever privacy law applies to your request, typically within 45 days for CCPA/state-law requests and within one month for GDPR/UK-GDPR requests.