Privacy
Minimal synthetic data by design.
Local account forms accept reserved test identities only. Final privacy, retention, rights, and data-sharing language remains a launch requirement.
Guest browsing
The guest cart stores only synthetic product IDs and quantities in this browser. It stores no name, email, address, payment detail, health information, or intended-use information.
Synthetic accounts
Account development accepts only an example.invalid email and a conspicuously synthetic name. Passwords are scrypt-derived, raw session and CSRF tokens are not persisted, captured codes stay in the local test harness, and account pages are owner-scoped and no-store.
Upstream separation
The browser does not contact Peptopia and receives no Peptopia credential. Consumer data is not sent upstream in the current bulk-only development contract.
Before launch
A final notice must identify the seller, processors, purposes, retention periods, customer rights, support channel, and approved fulfillment disclosures.