Blood Sugar app icon

Privacy Policy

Last updated: 21 October 2026

This policy explains what Blood Sugar for iPhone and iPad does with your data. Blood Sugar is made by Serhii Surzhykov (“we”). It is free, with an optional Plus subscription.

In short

  • There is no account to create and no server of ours that stores your readings.
  • Your health records stay on your device and in your own iCloud.
  • A few services receive only what they need for one job: the meal reader, food databases, crash reports, anonymous usage statistics and subscriptions. Each is listed below.
  • Nothing about your health is ever sold, shared with advertisers or used to build a profile of you.

What you create, and where it lives

Everything you log stays on your device: glucose readings, carbohydrates, insulin and other medication, meals and their photos, weight, ketones, lab results such as HbA1c, notes, targets and reminders. If iCloud is on, the same records sync through Apple iCloud (CloudKit private database), so your iPhone and iPad show the same log. That copy is in your Apple Account; we cannot read it. We run no account system and have no database of anyone’s health records.

Permissions

  • Apple Health — with your permission, Blood Sugar reads blood glucose, dietary carbohydrates, insulin delivery, body mass, step count and active energy, and writes blood glucose, dietary carbohydrates (with the food’s name), insulin delivery and body mass. Health data is used only to show your records in the app and keep your log and Health consistent. Readings imported from Health become part of your log, so they sync through your iCloud like the rest. Health data is never sent to us or to any third party.
  • Camera and photos — to photograph a meal, a nutrition label or a barcode, and to attach photos and lab reports. You pick photos with the system picker.
  • Calendar — only if you add care-plan tasks to your calendar. The event, with the task’s title and note, goes to your default calendar and syncs wherever that calendar does. iOS asks for full calendar access, because the app has to find, move or delete the events it created when your plan changes. It looks up only its own events, by the identifier it stored for each task, and does not browse or read your other events.
  • Notifications — reminders are scheduled and delivered by your device, with no server. They never show a glucose reading, but a medicine reminder shows the medicine’s name and strength, and a care-plan reminder shows the name of the check, so they can appear on your Lock Screen.

Blood Sugar does not use your location or contacts.

What leaves your device, and to whom

None of these services receives your health records, your name or your e-mail.

The meal reader (our proxy and Google Gemini)

When you scan a plate or a nutrition label with the AI reader (Plus):

  • One photo, downscaled, is sent over an encrypted connection to a proxy we run on Cloudflare Workers, which forwards it to Google Gemini and returns the estimated carbohydrates. The app also sends its display language, so dish names come back in it.
  • The photo is not stored by the proxy or by us; it is held in memory only for the request. Google processes it under the Gemini API terms. The proxy logs technical statistics (the kind of scan and the processing used), never a photo or an identifier. The copy attached to your meal stays on your device and in your iCloud.
  • No health record, name, e-mail or device identifier is attached.
  • To check that the request comes from an active subscriber and apply a daily limit, the proxy receives your subscription transaction signed by Apple, and keeps a scan counter keyed to the subscription identifier in it. That identifier is a number issued by Apple, not linked to your name and carrying none of your health data.
  • Cloudflare processes your IP address for rate limiting and abuse protection, under its own privacy policy.

Barcodes are decoded on your device and never sent as a picture. If you never use the AI reader, no photo leaves your device.

Open Food Facts and USDA — food databases

When you search for a food (as you type) or scan a barcode, the search term or barcode digits are sent to Open Food Facts and USDA FoodData Central to look up nutrition, with the app’s language for Open Food Facts and an app identifier with our contact address, as these services ask. As with any internet request, they see your IP address. The requests are not linked to your records or to you.

TelemetryDeck — anonymous usage statistics

To see how the app is used, Blood Sugar sends anonymous, aggregated signals, such as that a screen was opened, onboarding was completed, a scan finished, or which kinds of record were logged (never their values), plus Apple’s daily MetricKit performance summaries. They never contain glucose values, doses, carbohydrate figures, weights, lab results, food or medicine names, your diabetes type, or any text you entered. A daily signal includes rounded counts, such as “8–30” readings, never the readings. TelemetryDeck uses no cookies and no cross-app tracking, and processes signals in the European Union. See TelemetryDeck’s privacy policy.

Sentry — crash reports

When something goes wrong, Sentry receives a crash, freeze or error report: the error and its stack trace, the app version and the device model, and for a sample of sessions anonymous performance timings, profiles of the app’s own code and Apple’s MetricKit diagnostics. Name, e-mail and IP address are removed on the device; a random per-install identifier groups reports from one device. Screenshots, view hierarchies and interaction tracking are off, so no screen showing your readings is ever captured. Reports are not collected from development or simulator builds. Sentry processes them in the European Union. See Sentry’s privacy policy.

RevenueCat — subscriptions

See Purchases below.

Purchases

Subscriptions are processed by Apple through the App Store; we never see your payment details. Purchases go through RevenueCat (United States), which is contacted when the app starts and receives the App Store transaction, an anonymous identifier and, as with any internet request, your IP address and basic device information, never your name, e-mail or payment details. See RevenueCat’s privacy policy and Apple’s.

What we never do

  • We do not sell your data.
  • We do not share your health data with advertisers, data brokers or insurers.
  • We do not track you across other apps or websites.
  • We do not use your data for advertising.
  • We do not require an account, an e-mail address or a phone number.

How long data is kept

Your records stay on your device and in your iCloud for as long as you keep them. Meal photos sent to the reader are not kept by the proxy or by us. The scan counter is a small record keyed to the subscription identifier, kept so the daily limit works. Anonymous statistics and crash reports are kept by their providers for a limited period and then deleted.

Your choices and rights

  • Delete any record in the app at any time. Deleting removes it from your device and, through iCloud, from your other devices.
  • Export a backup file or a PDF report for your doctor. These files are yours; the app uploads them nowhere.
  • Withdraw Health, camera, photo and calendar access in Settings. For Health, open the Health app, tap your profile picture, then find Blood Sugar in the list of apps.
  • To remove everything, delete the app, then its data in Settings › [your name] › iCloud › Manage Storage.

If you are in the European Economic Area, the United Kingdom or a place with similar law, you have the right to access, correct, export and erase your data and to object to its processing. Your health records are held on your device and in your own iCloud, so you exercise those rights in the app. For anything else, write to the address below and you will get an answer within 30 days.

Legal bases under the GDPR: your explicit consent for Apple Health, camera, photo and calendar access (withdrawable at any time); the performance of a contract for purchases and the meal reader; and our legitimate interest in a stable app for crash reports and anonymous statistics.

Security

Your data is protected by your device passcode, Apple’s encryption of device and iCloud data, and your Apple Account security. Every network request uses an encrypted HTTPS connection.

Children

Blood Sugar is rated 12+ and meant for adults managing their own condition, or a parent or carer managing it for someone. It is not directed at children, and we do not knowingly collect personal data from them. If you believe a child has given us personal information, write to us and it will be deleted.

Not a medical device

Blood Sugar is a logbook and an information tool. It does not diagnose, treat or prescribe, it does not calculate insulin doses, and the carbohydrate figures it estimates from a photo are approximations. Reference information in the app comes from World Health Organization fact sheets and describes populations, not you. Targets, doses and treatment decisions are set with your doctor. In an emergency, contact your local emergency service.

Changes

This policy may change as the app changes. Each new version is published on this page with a new date, and material changes are also noted in the app’s release notes.

Contact

Questions about privacy, or a request about your data: sandoya1101@gmail.com.