Protocol·One

Privacy · The Data Stuff

Privacy at Protocol One.

We run a reference site about peptides. Here is what we collect, what we don't, and how to ask us to delete anything we have on you.

If you only read one line: we collect your email if you give it to us, plus anonymous behavior and session data so we can see what works and fix what doesn't. We don't collect health information. Everything below is the long version.

What we collect

Your email, if you subscribe. The Beehiiv form at the bottom of pages takes your email address and nothing else. We use it to send the newsletter. You can unsubscribe with one click from any email we send.

Anonymous behavior data. Google Analytics 4 records what pages you visit, where you came from, what device you're on, and how long you stay. It assigns you an anonymous ID. We use it to see which articles people actually read.

Session recordings. Microsoft Clarity records mouse movement, scroll depth, and clicks on the pages you visit. The recordings are anonymous and Clarity masks anything that looks like personal text by default. We use them to find places where the site is confusing or broken.

Affiliate clicks. When you click a vendor link (Apollo Peptide Sciences, Limitless, brands in the Katalys network), that vendor's tracking pixel records the click so they can pay us if you buy. We see aggregated counts, not your identity.

What we do NOT collect

  • No health information. We don't ask about your conditions, medications, weight, labs, or anything else clinical. Don't send it to us either.
  • No payment information. Nothing is sold on this site. Purchases happen on the vendor's site under their own privacy policy.
  • No data from your social or Google accounts. We don't have a login. We have a newsletter.
  • No precise location. GA4 gives us city-level at best, and we don't use it for anything besides knowing roughly where readers are.

Why we collect what we collect

In plain English:

  • Email so we can send you the newsletter and tell you when something on the site changes in a way you'd care about.
  • Behavior data so we know which articles people read to the end and which ones get bounced. That tells us what to write more of.
  • Session recordings so we can see when a button is broken or a layout is confusing on mobile. Most fixes we ship come from watching real sessions.
  • Affiliate clicks so the affiliate networks know the sale came from us. That is how we get paid and how the site stays free.

Who we share data with

We use a few third parties to run the site. Each one has its own privacy policy:

We do not sell your data. We do not rent it. We do not hand it to ad networks for retargeting.

Cookies and tracking

We set a small cookie called p1_consent to remember whether you've seen our cookie notice. That one is essential.

Third parties set their own cookies for analytics and affiliate attribution: GA4 (_ga, _ga_*), Clarity (_clck, _clsk), and affiliate networks (varies by vendor).

To opt out:

  • Use your browser's Do Not Track setting or any privacy extension you already trust (uBlock Origin, Privacy Badger, etc).
  • Install Google's GA opt-out add-on for a permanent block of GA4.
  • Clear cookies in your browser to reset your visit state.

Your rights

If you're in California, you have rights under CCPA. If you're in the EU or UK, you have rights under GDPR. Both cover roughly the same ground:

  • You can ask what we have on you.
  • You can ask us to delete it.
  • You can ask us to correct it.
  • You can ask us to stop using it.

Email hello@readprotocolone.com with the subject line "Privacy request" and tell us what you want. We'll respond within 30 days, usually faster. If you're asking us to delete a newsletter subscription, the unsubscribe link in any email handles that in one click and is faster than emailing us.

How long we keep data

  • Email subscribers: until you unsubscribe, then 30 days for cleanup.
  • GA4 behavior data: 14 months, then automatically purged.
  • Clarity session recordings: 30 days, then automatically purged.
  • Affiliate click data: held by the affiliate network, usually 180 days for attribution.

If you delete your subscription, we delete you from Beehiiv. We can't retroactively pull you out of GA4 aggregates, because those don't identify you in the first place.

Children

The site isn't for anyone under 18. We don't knowingly collect data from minors. If you're a parent and think we have data on your kid, email hello@readprotocolone.com and we'll delete it.

Changes to this policy

We'll update this page when something material changes. If the change affects what we collect or who we share with, we'll send a note to the newsletter so you don't have to check.

Contact

hello@readprotocolone.com. The Editor reads it.

Last updated: May 17, 2026.