Privacy Policy — Glucogaze

Glucogaze handles health data, which UK law treats as especially sensitive. This is what we hold, why we may hold it, and how to get it back or get rid of it.

Last updated: 16 October 2026

1. Who is responsible for your data

The data controller is your full name, a sole trader trading as Glucogaze, of business address service address. Registered with the Information Commissioner’s Office, number ICO registration number. Contact for anything here: legal@glucogaze.com.

2. What we hold

We hold what the service needs to show glucose on your own screens, a few security records, and your orders if you buy something. Health data is marked health.

Your account: Email address and a protected form of your password (never the password), held by our authentication provider; the consent you gave at sign-up and which version of this policy it was; preferences; sign-in sessions with their IP address and browser, plus the device model and system version Chromium browsers report, so you can review them; your two-step sign-in secret and protected recovery codes, if you use it; badges, credits, Store choices and ratings.
The people you follow (health): First and last name (from Google, or the part of your email before the @, until you change it), picture, colour and unit; a history of towns (city-centre only, never an address), timezones or countries; glucose thresholds and overnight window; glucose readings with time, trend and source; summaries worked out from them (five-minute averages, days with readings and, where glucose badges are on, a daily score); sensor sessions (sensor serial kept only as a hash); which days the dashboard was opened and the hours each screen checked in; and notifications such as urgent lows and highs, a source failing, a screen linked (with its rough town) or a share accepted. Weather is stored against the town, not the person.
Sharing: Who can see each person (owner, carer or follower), who gave that access and when, and the relationship picked; each invite, with the email address or name you typed for the invitee; handovers of a profile to its own account.
Your public page, if you switch it on: The display name, handle, picture, country, bio, tags (such as Type 1 or Parent of T1, which are health information), social handles, badges, three counts, and the status ring if you turn it on. Follows of public pages. It never shows a reading, your real name, email, town or timezone.
Your data sources: Which provider, its status and history, its references for your account, and your credentials for it (email or username and password, or a Nightscout address and token) with the session it gives back, encrypted before they are stored.
Your screens: Name, type, settings, firmware, Wi-Fi strength, its address on your home network, when it was last seen and its check-in credential (which we can’t read back). While a screen pairs, a short-lived record of its type and the rough town and country its connection is in.
Orders: What you bought, the amount, when, its status and any refund, the card brand and last four digits, the billing country, Stripe’s reference for you, the scrambled identifier of the connection the checkout came from, and your Plus plan and renewal date. Never your card number.
Security records: Rate-limit counters, an activity log of who saw or changed a person’s data, and a security log of sign-ins and refused requests. These hold IP addresses only as a scrambled identifier made with a secret key, emails only as hashes, and never a glucose value. Error logs name at most an internal identifier.
The waiting list (health): If you apply to test: your name, email, injections or pump, glucose source, whether you own a screen, anything you write, and your consent tick. Kept in its own table, never joined to an account. If we invite you, your email goes on the invite list.

It comes from you, from someone who invites or adds you, from Google if you sign in with it (email, name, an account identifier and a picture link we never use), from the sources you connect, from your screens, from Stripe when you pay, and from our host, which tells us roughly where a pairing screen is.

3. Why we may use it

Running your account and showing your data: Article 6(1)(b), our contract with you. For the health data, Article 9(2)(a), your explicit consent, given by ticking its own box on the sign-up page (not a line in the Terms); we record when and which version of this policy you read. Connecting a source, adding a person or sharing one is you acting on that consent. You can withdraw it by disconnecting, removing the person, ending the share or deleting your account; without it we can’t provide the service, because that data is the service.
Your public page: Article 6(1)(a) and 9(2)(a), your explicit consent, given when you switch the page on yourself (only your own login can). Each extra piece of health information on it, a diabetes tag, the status ring or glucose badges, is a separate choice, off until you turn it on.
Payments and orders: Article 6(1)(b) to sell you what you buy, and Article 6(1)(c), our legal duty to keep tax records.
Security, abuse prevention and checking a new screen: Article 6(1)(f), our legitimate interest, and yours, in keeping the service safe and in nobody linking a screen to your account without you knowing.
Site statistics: Article 6(1)(f), our legitimate interest in knowing which pages are used and how fast they load. See Vercel below.
People you invite: Article 6(1)(f), the shared interest in getting your invitation to them, and nothing more.
The waiting list: Article 6(1)(a) and 9(2)(a), your explicit consent, ticked on the form. Email us to withdraw it and we delete your application.

4. What we never do

Sell, rent or trade your data, or use it for advertising.
Track you across other sites, or use advertising cookies or tracking pixels.
Train machine-learning models on it.
Make automated decisions with legal or similar effects. The only automated evaluation is what you can see: your statistics, alerts, badges and status ring.
Give it to your insurer, employer or anyone you haven’t chosen, unless the law requires it or to establish or defend a legal claim.

5. Who else handles it

Our processors act only on our instructions, under contract. Stripe, Google and GitHub act on their own account under their own privacy policies.

Supabase (London): Database, file storage and sign-in. Holds everything in section 2.
Vercel (London, global network): Hosting. Its access logs hold IP addresses and browsers in the ordinary way, and it tells us a pairing screen’s rough town. Its Web Analytics and Speed Insights count page views and measure page speed: cookieless, aggregate, with no profile of you and no tracking across sites.
Stripe (independent seller): Takes payments as the merchant of record under Stripe Managed Payments, so it is a separate controller for them. It gets your name, email, billing address or country and card details under its privacy policy. We never see your card number.
Resend (Ireland): Sends our email: sign-in and reset links, invites, screen-linked notices, receipts and renewal reminders. No open or click tracking.
Hostinger: Hosts our mailbox, so anything you email us sits there.
Cloudflare: The “are you human?” check on the sign-in, sign-up, password-reset and waiting-list pages, which receives the signals it needs from your browser.
Google: Only if you sign in with Google; it then knows you signed in to Glucogaze.
GitHub: Hosts the screen setup file; downloading it gives GitHub your IP and browser.
Open-Meteo: Gets the town you search for and towns’ coordinates for weather, never who.

At your instruction our server also signs in to the glucose source you connect (Abbott’s LibreLink Up, Dexcom Share or your Nightscout site). They are independent controllers of the data you hold with them.

Transfers. Your account and readings are stored and processed in London. Your glucose source keeps your data where your account with it sits (Abbott: the EU for ours; Dexcom: the US, outside the US or Japan). Vercel, Stripe, Cloudflare, Google, Resend, Hostinger and GitHub may handle the limited data above outside the UK, covered by UK adequacy regulations or the ICO’s International Data Transfer Agreement or Addendum.

6. How long we keep it

Readings, people, account, sources, screens, summaries, badges, Store: Until you delete them or the account. The history is the point of the product.
Orders: 6 years, for tax. When you delete your account they are kept without your name or email.
Sign-in sessions: Until you sign out, end them, change your password or delete the account. The device details beside them go within hours of the session ending.
Activity and security logs: 12 months and 90 days, trimmed automatically. They can’t be edited early, so a line stays until its time is up, even after you delete your account.
Notifications: 30 days; a binned one 30 days after binning. Emptying the bin deletes them.
Invites: An unused invite: 30 days after it runs out or is cancelled. An invitee’s email or name: 30 days after the share ends.
Weather: Hour by hour for 13 months; daily figures for as long as the town is kept.
Pairing records and rate-limit counters: About a day for pairing records; counters within about two days.
The waiting list: Until a week after the closed beta ends, or sooner if you ask. Applications from before 1 October 2026 with no consent tick are deleted on 1 November 2026 unless confirmed by 31 October.
Emails, including receipts and renewal reminders: In your mailbox until you delete them; in Resend’s log for its usual period.
Backups: Daily, the last seven kept. Deleted data leaves them within seven days.

7. Security

We use appropriate technical and organisational measures, including encrypting your source credentials. We don’t publish the detail, which would mostly help an attacker; a regulator can have it. If your data is ever exposed, we report it to the ICO within 72 hours where the law requires and tell you directly if it puts you at risk.

Use a unique password, and think about where a screen sits: in a shared room it shows health data to everyone who walks past.

8. Your rights

You can ask to access, correct, delete, restrict or move your data, object to what we do on legitimate interests, and withdraw consent at any time. Much of it you can do yourself:

Export in Settings: a spreadsheet of readings and a machine-readable file of nearly everything else. Ask us for what it leaves out (your picture, the security log, your orders, a waiting-list application).
Correct names, thresholds and preferences in Settings.
Delete a source’s readings, a person you own (everything under them, and everyone’s access to them), or your whole account (your login and every person you own; people other accounts own stay with them). What goes later is in section 6. Deleting cannot be undone.

For anything else email legal@glucogaze.com. We reply within one month, free of charge, and may need to check it’s you.

9. Children and people you look after

Account holders must be 18 or over. A parent often follows a child’s glucose, so an adult is entering the child’s health data, on the authority the Terms describe. A child or dependant’s badges start off, and glucose badges (which score each day, and never count lows) stay off until a parent switches them on in Settings › Parental controls. A child can never have a public page.

Handing a profile over. Once someone you look after is 18, you can give them a code in person (never by email) to take their profile onto their own new account, with its readings, history and sources, including a source using your sign-in, until they disconnect it or you change that password. You stay on as their carer, seeing their readings but not their sources, names or public page, until they remove you or you step back; then your notifications about them are deleted and screens you linked for them move to their account. Unlink any you don’t want to hand on first.

If someone has added or invited you, this policy is for you too. Email legal@glucogaze.com to see, copy or remove what we hold about you; we check with the account holder that you are who you say, then act.

10. Cookies

We only use cookies that keep you signed in and make the site work, so there is no banner. They are listed on the Cookies page.

11. Changes

The date at the top shows when this policy last changed, and is the version recorded when you give consent. If a change matters, we will try to tell you first, and ask again if it needs your consent.

12. Complaints

To complain about how we handle your data, email legal@glucogaze.com with “Privacy complaint” in the subject. We acknowledge it within 30 days, look into it, and tell you the outcome without undue delay.

You can also complain to the UK regulator at any time:

Information Commissioner’s Office: 0303 123 1113 — ico.org.uk/make-a-complaint. Its postal address is on its website.