This page is maintained by the PeakMe team to answer common questions about the service's security and privacy. It describes our current practices; it is not an independent certification.
1. Shared responsibility model
PeakMe relies on established providers (hosting, database, payment, AI). We configure these building blocks and write the application; providers manage the security of their infrastructure; you manage the confidentiality of your password and the device you use.
2. Authentication & access
- Login via email/password or Google.
- Passwords stored in hashed form by our authentication provider — never in plain text.
- Encrypted sessions, revocable from your account.
- Each user can only access their own analyses, plans and tasks (database-level isolation).
3. Data & encryption
- All traffic between your device and PeakMe goes over HTTPS (TLS).
- Data is stored with our sub-processors, which encrypt data at rest.
- Your original photo is automatically deleted after 30 days (see Privacy).
4. Payments
Payments are processed by Stripe. PeakMe never sees your full card number and does not store it on its servers. The transaction appears on your bank statement under the descriptor "NOVEXA STUDIO" (or a shortened form such as "NOVEXA").
5. Main sub-processors
- Edge hosting: Cloudflare.
- Database & authentication: Supabase.
- AI analysis: OpenAI and Google Vertex.
- Payment: Stripe.
Details and legal bases in the Privacy page.
6. Retention & deletion
You can request the deletion of your account and your photo at any time via the contact form. Detailed retention periods are set out in the Privacy page.
7. Cookies & advertising
PeakMe uses only strictly necessary technical cookies for the operation of the service (session, security). No advertising pixel, no analytics cookie, no third-party tracker is placed. Our occasional advertising campaigns are delivered without behavioral targeting based on your browsing and without site-side conversion tracking — that is why no consent banner is required.
8. Reporting a security issue
If you think you have found a vulnerability, contact us via the contact form with a description and, if possible, steps to reproduce. Please do not disclose publicly before we have had a chance to fix it.
9. Compliance
PeakMe is published by NOVEXA STUDIO - FZCO (trade license No. 90184, issued by the Dubai Integrated Economic Zones Authority), registered office at DSO-IFZA, IFZA Properties, Dubai Silicon Oasis, Dubai (United Arab Emirates), operating internationally. The service is governed by the law of the United Arab Emirates (Federal Law No. 15 of 2020 on consumer protection, PDPL No. 45 of 2021, Decree-Law No. 14 of 2023 on e-commerce) and complies with international data protection standards. Payments are processed by Stripe as Merchant of Record: Stripe collects, invoices, handles local taxes and refunds in each jurisdiction. We do not claim SOC 2, ISO 27001, HIPAA or PCI certifications; our sub-processors' certifications belong to them.
10. Updates
This page is editable and may evolve with the product. For any question, use the contact form.