Privacy Policy — GlucoTrack

Last updated: 29 May 2026 · Effective: 29 May 2026

1. Who we are

GlucoTrack ("we", "our", "us") is operated by Tom Beadle, based in New Zealand.

Contact: tom.beadle27@gmail.com

2. What data we collect

Data you give us directly

• Name and age (optional)
• Diabetes type and target blood glucose range
• Blood glucose readings you log
• Meals, medications, and activities you log
• Notes you write

Data from connected services (only if you connect them)

• Apple Health / Google Health Connect — glucose, activity, heart rate, workouts
• Strava — workout details, distance, duration, heart rate
• Dexcom — continuous glucose readings
• TrainingPeaks — workout data

Data we collect automatically

• App version, device type, OS version (for crash reporting via Sentry)
• Anonymous usage statistics (Vercel Analytics — page-level only, no personal identifiers)
• Crash reports (no personal health data)

Data we do NOT collect

• We do not access your contacts, photos, location, or anything unrelated to health tracking.
• We do not track you across other apps.
• We do not collect advertising identifiers.

3. Where your data lives

Health data: stored locally on your device using Capacitor Preferences (Keychain on iOS, EncryptedSharedPreferences on Android) and the browser's localStorage on the web.

Optional cloud sync: if you choose to sign in for cross-device sync, your data is stored in Supabase under a user account tied to your email. You can disable sync and delete the cloud copy from Settings at any time.

Connected device tokens: stored locally and encrypted on the device.

AI insights (optional): when you tap "Get AI Insights", we send anonymised summary statistics (averages, time-in-range percentages, age range) to Anthropic's Claude API. We do not send your name, individual readings, or any directly identifying information.

4. How we use your data

We use your data only to:

• Show you charts, statistics, and trends about your own health
• Generate AI insights when you request them
• Generate reports you can share with your doctor (created on your device)
• Improve the app via anonymous crash reports

We do NOT use your data to sell to third parties, train AI models on your specific data, show you ads, or share with insurance companies, employers, or anyone else.

5. Third-party services

When you choose to connect a third-party service, your interaction with that service is governed by their privacy policy:

• Apple HealthKit
• Google Health Connect
• Strava
• Dexcom
• TrainingPeaks
• Anthropic (Claude AI)
• Supabase (optional cloud sync)
• Sentry (crash reporting)
• Vercel (web hosting and analytics)

You can disconnect any service at any time in Settings → Connected Devices.

6. Children's privacy

GlucoTrack has a Kids Mode designed for children with diabetes. We comply with COPPA (US) and GDPR-K (EU):

• No account required — kids can use the app without creating an account or providing personal info to us.
• No social features — kids can't message anyone or share data publicly.
• Parental access — all data is stored locally on the parent's or child's device under their control.
• No advertising — the kids version has no ads.
• AI chat — the Dex chat feature uses Anthropic's API. Messages are sent for response generation only and are not used for training.

If you are under 13, please use this app with a parent or guardian's knowledge.

7. Your rights (GDPR, CCPA, and beyond)

You have the right to:

• Access all data we have about you (most of it is on your device, viewable any time)
• Delete all your data — use Settings → Clear All Data, or contact us
• Export all your data — use the CSV/PDF export feature
• Correct any inaccurate data — edit it in the app
• Withdraw consent for AI features at any time
• Object to processing (contact us)
• Lodge a complaint with your local data protection authority

To exercise any rights, email tom.beadle27@gmail.com. We respond within 30 days.

8. Data retention

• On your device: indefinitely, until you delete the app or clear data.
• Cloud sync (if enabled): until you turn sync off or delete your account.
• Connected service tokens: until you disconnect the service or delete the app.
• AI request logs: Anthropic retains for 30 days per their policy.
• Anonymous crash reports: 90 days.

9. Security

• Data on your device is encrypted using your device's native security.
• API tokens are stored in your device's secure keychain.
• All network connections use TLS 1.2 or higher.
• We follow industry-standard practices for protecting health data.

However, no system is 100% secure. We will notify you of any data breach within 72 hours as required by GDPR.

10. International transfers

If you're outside the US:

• Anthropic (Claude AI) processes data in the US.
• Sentry crash reports may be processed in the US or EU.
• Supabase data is stored in the region you select on sign-up.
• All transfers use Standard Contractual Clauses (SCCs) for GDPR compliance.

If this is unacceptable, you can disable AI features, crash reporting, and cloud sync in Settings.

11. Medical disclaimer

GlucoTrack is not a medical device. We are not a substitute for professional medical advice, diagnosis, or treatment. Always consult your doctor or diabetes care team before making changes to your management. In an emergency, call emergency services immediately.

Insulin dose calculations, time-in-range calculations, A1C estimates, and AI insights are for informational purposes only. They are not prescriptive and should not be acted upon without consulting a qualified healthcare professional.

12. Changes to this policy

We'll update this policy as the app evolves. Material changes will be notified via:

• In-app notice when you next open the app
• Email if you've provided one for cloud sync
• Updated "Last updated" date above

13. Contact us

Privacy questions, data requests, or anything else:

Email: tom.beadle27@gmail.com
Response time: within 30 days (usually much faster)