Privacy Policy

1. Who is responsible for your data

The controller of personal data in GlucoPet is Mike Dexemberg, the developer and operator of the service. Contact details are published on the Legal Notice page. For privacy questions or to exercise your rights, email dexemberg@proton.me.

This policy applies to the GlucoPet web application at glucopet.app, including its installed PWA version.

2. Data we process

Log data

You may provide your pet's name, date of birth, weight, and photo; glucose readings and times; reading type; insulin dose and name; notes; target ranges; schedule; time zone; glucose curve plans; and display preferences. This information relates to a pet, not a person's health. Do not include unnecessary personal information about people in notes or photos.

Account and sign-in

For your account, we process an internal identifier, email address, linked sign-in methods, session information, and security events. When you sign in with Google or Apple, the provider sends Supabase a unique identifier and email address; Apple may provide a private relay address. The provider may also include standard profile data in the identity information, but GlucoPet does not use the name or avatar from a social profile for log features.

Shared access

When an owner invites another person, we process the invitee's email address, the owner's email address, the pet's name, the selected role, the access period, the invitation status, and the owner's optional note. The log owner provides the invitee's email address to us. The owner must use an address only when they have reasonable grounds to expect that its recipient wants to receive the invitation.

Push notifications

If you choose to enable reminders, we process the browser permission, device and subscription identifiers, push service endpoint, public subscription keys, time zone, schedule, and technical delivery status. Push notification text does not contain glucose values, doses, or the pet's name.

Technical data and analytics

When you access the site, hosting and infrastructure providers may process your IP address, date and time, URL, request headers, browser and device type, errors, and security events. Vercel Web Analytics receives page views, referring source, filtered URL parameters, approximate country and city, operating system, browser, and device type. It does not use third-party cookies, does not link visits across different websites, and changes the visitor identifier daily. GlucoPet does not configure custom analytics events using log field contents, email addresses, photos, glucose readings, or doses.

Support requests

If you contact us, we receive your address, the contents of your message, and any attachments you choose to send. Do not send passwords, sign-in codes, private keys, or information that is not needed to resolve your request.

3. Cookies, local storage, and guest mode

Before you sign in, the contents of your log are stored in your browser's IndexedDB. The app also stores a local copy of the cloud log for offline use, photos, the sync queue, version conflicts, the selected pet, and technical settings there. A service worker caches the app shell and static files.

GlucoPet does not use advertising or cross-site cookies. Tab storage is used briefly to complete sign-in, and the account session is stored in a protected area of the app's storage. You can manage local data with the Delete local copy button or through your browser. After a normal sign-out, the local copy remains on the device so that it can be opened when you sign in again.

In guest mode, we cannot restore your log after browser data is cleared or a device is damaged or lost. Create a backup if you want to preserve this data.

4. Purposes and legal bases

Only the email address or provider identifier needed for a cloud account is required. An account, photos, notes, shared access, and push notifications are optional. Without an account, cloud synchronization and shared access are unavailable, but the local log continues to work.

5. Who receives the data

We disclose data only to the extent necessary for a feature to work:

• Supabase, Inc. — authentication, database, private photo storage, and server functions. The primary project is hosted in the AWS eu-central-1 region in Frankfurt.
• Google LLC or Apple Inc. — if you choose the corresponding sign-in method. Their processing is also governed by their own policies.
• Vercel Inc. — hosting, site delivery, technical logs, and de-identified Web Analytics.
• Plus Five Five, Inc. (Resend) — delivery of shared-access invitations; receives the recipient's address and the contents of the email.
• Your browser's push service — Google FCM, Apple Push Notification service, Mozilla Push Service, or Microsoft WNS, depending on the browser and device; it receives an encrypted push message and the technical subscription endpoint.
• Proton AG — processing of emails you send to the support address.
• Users you invite — data from the specific log within the assigned role. The owner sees the invitee's address and status; the invitee sees the owner's email address.

We may also disclose data when required by applicable law or necessary to protect users and the service. We do not sell personal data or provide it to advertising networks.

6. International transfers

Core log data in Supabase is stored in Germany. Some providers are established in, or use subprocessors located in, the United States and other countries. For transfers from the EEA, providers maintain applicable safeguards, including the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. Switzerland, where Proton is based, is recognized by the European Commission as providing an adequate level of protection.

7. Retention and deletion

• Account and cloud log are retained while the account exists. After deletion is confirmed, access is blocked, active sessions are revoked, and entries and photos are removed from production systems. Residual copies in backups and logs may remain for a limited period under provider retention cycles, or longer where required by law.
• Individually deleted entries and replaced photos may technically remain until the account is deleted to support synchronization and conflict resolution between devices.
• Local data is retained until you delete the local copy or clear site data, or until the browser or operating system removes the app.
• Invitations and their technical history are retained in the owner's account until it is deleted. An invitation link is valid for 7 days; a revoked or declined invitation no longer grants access.
• Push subscription stops working after it is disabled, you sign out, or the account is deleted. A technical record of a disabled subscription may be retained until account deletion; delivery results are deleted after 30 days.
• Incomplete technical restore packages are deleted after 7 days.
• Vercel Analytics changes the visitor hash every day. Aggregated events are available within the reporting window of the Vercel plan—usually from 1 to 24 months—and may be retained longer by the provider under its policies.
• Correspondence is retained for as long as necessary to respond, maintain security, and establish or defend legal claims.

8. Your rights

Depending on applicable law, you may request access to, correction or deletion of your data, restriction of processing, and data portability, and you may object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing.

You can take most actions yourself:

• download a CSV, PDF, or full backup under Data;
• disable push notifications in your browser or device settings;
• revoke shared access under Invitations;
• delete the local copy or your entire account under Account.

For any other request, email dexemberg@proton.me. We may ask you to verify your identity and will generally respond within one month. Users in the EEA also have the right to lodge a complaint with a supervisory authority in the place where they live or work, or where the alleged infringement occurred.

9. Security

Data in transit is protected by HTTPS. Access to cloud records is restricted by account and row-level access rules; photos are stored privately and released only after authorization checks; privileged keys are not sent to the browser. Shared access is limited to a specific pet and assigned role. However, no method of storing or transmitting data can guarantee absolute security.

You are responsible for the security of your device and email account and for choosing the people with whom you share the log. Do not forward sign-in codes or invitation links to anyone else.

10. Children and other people's data

GlucoPet is intended for adult pet owners and caregivers and does not knowingly collect children's data. Do not provide information about a child or another person without a lawful basis. If you believe such information has been submitted to the service, contact us so that it can be deleted.

11. Automated decision-making

We do not make decisions that produce legal or similarly significant effects solely by automated means, and we do not create advertising profiles. Charts, reminders, and calculated metrics are provided only to support record-keeping and do not constitute a veterinary diagnosis.

12. Provider policies

• Supabase Privacy Policy
• Vercel Web Analytics: Privacy and Compliance
• Google Privacy Policy
• Sign in with Apple & Privacy
• Resend Privacy Policy
• Proton Privacy Policy

13. Changes to this policy

We will update the date and version of this page when our processing practices change. Where appropriate, we will notify you in the app or by email of material changes affecting user rights or the purposes of processing. The new version applies from the date stated on the page.