Privacy Policy

1. Information We Collect

a) Health Data (Stored Locally on Your Device)

GlucoAI stores all personal health data exclusively on your device. This includes:

• Blood glucose readings
• Meal logs, carbohydrate estimates, and nutrition data
• Insulin doses and calculator settings
• Weight, A1C, and other health metrics you enter
• Notes, tags, and custom entries

This data is never transmitted to our servers unless you explicitly enable cloud backup (Premium feature), in which case it is encrypted end-to-end.

b) Food Photos (Processed Ephemerally)

When you use the AI Food Scanner, your meal photo is sent to Google's Gemini 2.0 API for analysis. The photo is:

• Transmitted securely over HTTPS/TLS
• Processed in real-time to generate carb/nutrition estimates
• Not stored on our servers or Google's servers after processing
• Not used to train AI models

c) CGM Credentials (Stored Locally, Encrypted)

If you connect a continuous glucose monitor (Dexcom or Nightscout), your credentials are:

• Stored only on your device using Android's encrypted SharedPreferences / EncryptedSharedPreferences
• Never transmitted to our servers
• Used solely to authenticate directly with Dexcom's API or your Nightscout instance

d) Crash Reports and Analytics (Firebase)

We use Google Firebase to collect:

• Firebase Crashlytics: Crash logs, stack traces, device model, OS version, and app version to diagnose and fix bugs
• Firebase Analytics: Anonymous usage events (e.g., feature usage frequency, screen views) to improve the app experience

This data is anonymous and cannot be used to identify you personally. It does not include any health data, food photos, or CGM credentials.

e) Subscription Data (RevenueCat)

We use RevenueCat to manage subscriptions. RevenueCat processes:

• An anonymous app user ID
• Purchase receipts and subscription status
• Transaction history for entitlement verification

RevenueCat does not have access to your health data. For RevenueCat's privacy practices, see revenuecat.com/privacy.

2. How We Use Your Information

• Health data: Displayed to you within the app for tracking, analysis, and reporting. Never accessed by us.
• Food photos: Sent to Gemini API solely to generate nutrition estimates. Discarded immediately after processing.
• Crash reports: Used to identify and fix bugs, improve stability.
• Analytics: Used to understand which features are popular and improve the user experience.
• Subscription data: Used to verify your subscription status and unlock Premium features.

3. Data Sharing and Third Parties

We do not sell, rent, or trade your personal data to any third party.

We share limited data only with the following service providers, solely to operate the app:

• Google Firebase (Crashlytics, Analytics) — anonymous crash and usage data
• Google Gemini API — ephemeral food photo processing
• RevenueCat — anonymous subscription management
• Dexcom / Nightscout — direct device-to-server CGM data retrieval (your credentials, your connection)

We do not use advertising SDKs or share data with advertisers.

4. Data Security

• All health data is stored locally on your device using encrypted storage
• CGM credentials are stored using Android EncryptedSharedPreferences
• All network transmissions use HTTPS/TLS encryption
• Firebase App Check ensures only legitimate app installs can access our services
• Cloud backups (Premium) are encrypted end-to-end

5. Data Retention and Deletion

Local data: Retained on your device until you delete it. You can delete all data via Settings → Delete All Data, or by uninstalling the app.

Firebase data: Crash reports are retained for 90 days. Analytics data is retained for 14 months per Google's default retention policy.

RevenueCat data: Subscription records are retained as long as your subscription is active, plus a reasonable period after cancellation for support purposes.

To request deletion of all server-side data, email support@ignisalgos.com. We will process your request within 30 days.

For full instructions, see our Data Deletion page.

6. Security Incident Notification

If we discover a security breach affecting your data:

• We will notify you within 72 hours of discovery
• Notification will be via email to your registered address
• We will describe what happened and what data was affected
• We will explain what steps we're taking to protect you

7. HIPAA Notice

GlucoAI is a direct-to-consumer health application. Because your health data is stored locally on your device and not transmitted to our servers for storage, GlucoAI is not subject to HIPAA (Health Insurance Portability and Accountability Act) regulations.

What this means for you:

• Your glucose readings, insulin doses, and meal logs stay on your phone
• We cannot access your health data unless you explicitly export it
• We do not share your health data with healthcare providers unless you choose to
• If you share data with your doctor (via export), that transmission is governed by your doctor's privacy practices

If you connect a CGM device:

• Your CGM credentials (Dexcom, Libre, Nightscout) are stored locally on your device
• We never have access to your CGM account or credentials
• CGM data is synced directly to your device, not our servers

Future HIPAA considerations: If GlucoAI adds features that transmit health data to healthcare providers or acts as a business associate of a covered entity, HIPAA compliance will be implemented at that time.

8. Children's Privacy

GlucoAI is intended for adults 18 years and older. We do not knowingly collect personal information from minors under 18.

If you are under 18, please do not use GlucoAI or provide any personal information.

If we discover we have collected information from a minor, we will delete it immediately upon discovery.

9. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict processing of your data
• Data portability (export your data via CSV or PDF within the app)

To exercise any of these rights, contact support@ignisalgos.com.

9a. California Privacy Rights (CCPA)

California residents have additional rights under the California Consumer Privacy Act:

• Right to Know: What personal information we collect and how it's used
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: We do not sell personal information, so no opt-out is needed
• Right to Non-Discrimination: You will not be treated differently for exercising your privacy rights

To exercise these rights, contact us at support@ignisalgos.com.

We do not sell personal information as that term is defined under California law.

9b. European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA), you have rights under GDPR:

• Legal Basis: We process your data based on consent and legitimate interest
• Right to Access: Request a copy of your personal data
• Right to Rectification: Request correction of inaccurate data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Data Portability: Receive your data in a machine-readable format
• Right to Withdraw Consent: You may withdraw consent at any time
• Right to Lodge a Complaint: With your local Data Protection Authority

Since your health data is stored locally on your device and not transmitted to our servers (except for ephemeral AI processing), most GDPR data processing requirements do not apply to your health data.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. We encourage you to review this policy periodically. Continued use of the App after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, please contact us:

Email: support@ignisalgos.com

Privacy Officer: privacy@ignisalgos.com

Business Address:

Ignis Algos LLC
[Business Address]
[City, State ZIP]

Website: ignisalgos.com/glucoai

12. Medical Disclaimer

GlucoAI is not a medical device and is not intended to diagnose, treat, cure, or prevent any disease. Always consult your healthcare provider before making changes to your diabetes management plan.