GlucoBuddy Privacy Policy

1. Overview

GlucoBuddy ("we", "our", or "us") is a personal wellness journaling app that helps you track your meals and glucose readings. This Privacy Policy explains what information we collect, how we use it, and the choices you have.

GlucoBuddy is not a medical device and does not provide medical advice. All data you log is your personal wellness journal. By using GlucoBuddy you agree to the practices described in this policy.

2. Information We Collect

2.1 Information You Provide Directly

When you use GlucoBuddy, you provide the following information:

• Diabetes type and personal wellness targets ("comfort zone") that you set during onboarding.
• Meal logs, including food names, serving sizes, portion amounts, and carbohydrate counts.
• Glucose readings, including the value, the time after a meal or fasting context, and the date and time of the reading.
• Doctor name and email address (optional). If provided, used only when you explicitly tap "Send report to doctor" in the app — see Section 2.5 for what data is sent and how reports are composed.

2.2 Information We Collect Automatically

When you create an account or sign in, we receive limited information from the sign-in provider you choose:

• Apple Sign In: your email address (or an Apple-generated relay address if you choose "Hide My Email") and your display name, if you choose to share them.
• Google Sign In: your Google account email address and display name.

We do not receive your Apple or Google password. We do not access your contacts, photos, location, or any other device data.

2.3 Information Collected From Third-Party Services

Food search results: when you search for a food, your search query is sent to the USDA FoodData Central API (a free public service operated by the U.S. Department of Agriculture). We do not share your user identity with the USDA — only the search term is transmitted. Results may be cached to improve speed.

2.4 Information We Do NOT Collect

• We do not use advertising tracking or sell data to advertisers.
• We do not collect your precise GPS location.
• We do not access your device camera, microphone, or contacts.
• We do not use third-party analytics SDKs that track your behaviour across other apps.
• We do not collect insulin doses, CGM (continuous glucose monitor) data, or prescription information.

2.5 AI Processing (Premium features only)

Some premium features use Anthropic's Claude AI service to process your data. Each is opt-in by you tapping the corresponding action in the app:

• Plain-language meal logging ("Type your meal with AI"): the meal description you type is sent to Anthropic to parse into individual food items with estimated nutrition.
• Glycemic Index estimation: for foods not in our curated database, the food name and per-100g macronutrient values are sent to estimate a GI value.
• Serving-size resolution: for uncommon serving units, the food name and serving label are sent to estimate grams.
• Weekly insights summary: your aggregated glucose stats, daily nutrition averages, and the names of your three best/worst foods (by post-meal glucose impact) are sent to draft a personalized recap.
• Doctor report (premium): the same aggregated stats plus your diabetes type are sent to draft the email body. The attached CSV is generated locally and is not sent to Anthropic.

Anthropic processes this data solely to generate the AI response. Per Anthropic's commercial API terms, your data is not used to train Anthropic's models. We do not send your name, email, account identifiers, or precise event timestamps to Anthropic — only the specific values listed above.

If you stay on the free tier, no data is ever sent to Anthropic. On the premium tier, you can avoid sending data to Anthropic on a per-action basis by not using the AI-powered actions (typing meals manually, not refreshing the weekly insight, not tapping "Send report to doctor").

2.6 Subscription Information (Premium users)

If you subscribe to GlucoBuddy Premium, payment is handled entirely by Apple via the App Store. We do not receive your payment method, billing address, or other payment details. After Apple confirms a purchase, our backend verifies the receipt with Apple and stores:

• Your subscription tier (free or premium)
• The subscription's expiration date
• The Apple-generated product ID and transaction identifier (for receipt re-verification on restore)

This is the minimum information needed to correctly unlock or lock premium features in the app. Apple's StoreKit handles renewals, cancellations, refunds, and family sharing — to manage your subscription, open Profile → Manage Subscription in the app or go to your Apple ID Settings → Subscriptions.

3. How We Use Your Information

We use the information you provide solely to operate and improve the app:

• To create and maintain your account.
• To display your meal and glucose logs in the app.
• To calculate your personal wellness statistics (average readings, time within your comfort zone, carb totals). These calculations happen on our servers but are only accessible to you.
• To show you historical patterns across your own data (e.g., the 7-day patterns chart).
• To provide after-meal and after-glucose context cards based on your own prior logs.
• To generate your CSV data export on request.
• To respond to your support requests.

We do not use your health data to train machine-learning models or share it with third parties for research without your explicit opt-in consent.

4. How We Store and Protect Your Data

4.1 Storage Location

Your data is stored in a PostgreSQL database hosted by Supabase, Inc., on servers located in the United States. All data is encrypted at rest and in transit (TLS 1.2 or higher). Supabase's privacy and security practices are described at supabase.com/privacy.

4.2 Access Controls

Your health and meal data is protected by Row-Level Security policies that prevent any user from accessing another user's records. Our infrastructure is configured so that only your account can read, write, or delete your own data. GlucoBuddy staff do not routinely access individual user records.

4.3 Infrastructure

The following third-party services process your data as part of delivering the app:

4.4 Error Monitoring

We use Sentry for crash reporting to help us identify and fix bugs. Sentry is configured to exclude health data (glucose values, food names, carb counts) from all error reports. Only technical error context (device type, OS version, app version, stack trace) is transmitted.

5. Data Retention

We retain your data for as long as your account is active. If you delete your account (see Section 7), all your personal data — including all meal logs, glucose readings, comfort zone settings, and account information — is permanently and irrecoverably deleted from our systems within 30 days.

We do not retain backups of deleted user data beyond 30 days after deletion. Anonymous, aggregated statistics (e.g., total number of app downloads) that cannot be linked back to you are not subject to this deletion.

6. Your Rights and Choices

You have the following rights regarding your data:

6.1 Access and Portability

You can download a copy of all your data at any time in CSV format. Go to Settings → My Data → Download my data in the app.

6.2 Correction

You can edit your comfort zone targets, diabetes type, and doctor information at any time in the Profile screen. You can edit or delete individual meal logs and glucose readings from the Daily View.

6.3 Deletion

You can permanently delete your account and all associated data at any time. Go to Settings → Delete account. You will be asked to type "DELETE" to confirm. Deletion is permanent and cannot be undone.

6.4 Opt-Out of Communications

GlucoBuddy does not currently send marketing emails. If we introduce optional email communications in the future, you will be able to opt out at any time.

6.5 GDPR Rights (EEA and UK Residents)

If you are located in the European Economic Area or the United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR), including the right to object to processing, the right to restriction of processing, and the right to lodge a complaint with a supervisory authority. To exercise any of these rights, contact us at support@glucobuddy.live.

6.6 California Residents (CCPA)

California residents have the right to know what personal information we collect, to request deletion, and to opt out of the sale of personal information. GlucoBuddy does not sell personal information. To submit a CCPA request, contact us at support@glucobuddy.live.

7. Children's Privacy

GlucoBuddy is not directed to children under the age of 13 (or under 16 in the EEA). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at support@glucobuddy.live and we will delete it promptly.

8. Sharing of Information

We do not sell, rent, or trade your personal information. We share information only in the following limited circumstances:

• Service providers: we share data with the third-party services listed in Section 4.3 solely to operate the app. These providers are contractually prohibited from using your data for any purpose other than providing services to us.
• Legal requirements: we may disclose information if required to do so by law, court order, or governmental authority.
• Business transfers: if GlucoBuddy is acquired or merged with another entity, your data may be transferred as part of that transaction. We will notify you via email or in-app notice before your data is transferred and becomes subject to a different privacy policy.
• With your consent: we will share information for any other purpose only with your explicit consent.

9. International Data Transfers

GlucoBuddy stores data on servers located in the United States. If you are located outside the United States, your data is transferred to and processed in the US. We rely on Standard Contractual Clauses for transfers from the EEA and UK.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this document and notify you via an in-app notice. Your continued use of GlucoBuddy after the effective date of the updated policy constitutes your acceptance of the changes.

11. Contact Us

If you have questions, requests, or concerns about this Privacy Policy or your data, please contact us:

• Email: support@glucobuddy.live
• Website: eureast.digital/glucobuddy/privacy
• Mailing address: EurEast Digital LLC, 15333 Culver Dr, Ste 340 #2216, Irvine CA 92604