Glycio — Privacy Policy

📋 Information We Collect

We collect only what is necessary to provide the app's functionality.

Account Information

• Username and email address (when you register)
• Password (stored securely as a hashed value — we never store plain text passwords)
• Display name and daily sugar goal
• Profile photo, if you choose to upload one (stored as a compressed image on our server)

Health & Usage Data

• Meals you log, including food name, sugar content, and calories
• Your daily sugar intake totals and streak history
• Water intake logs
• Craving logs (food, intensity, triggers, resistance outcome)

Device Permissions

• Camera — used for barcode scanning, AI food photo scanning, and optionally for capturing a profile photo. Food photos sent to the AI scanner are never saved on our servers. Profile photos are uploaded only if you explicitly choose to set one.
• Photo Library — used only if you choose to select a profile photo from your device's gallery. No other photos are accessed or uploaded.

⚙️ How We Use Your Information

• To provide and sync your meal logs, streaks, and goals across sessions
• To power the AI Coach feature (your recent stats are sent as context — no personal identifiers)
• To display your weekly and monthly progress charts
• To maintain your account and authenticate you securely
• To send password reset codes and weekly email reports when requested

👥 Social Features & Health Data Sharing

Glycio includes optional social features that allow you to share activity milestones (such as streak achievements and daily goal completions) with other users. All social sharing is entirely opt-in and user-controlled:

• Your profile is public by default, but you can switch it to private at any time under Profile → Social Settings
• Only milestone events (e.g. "7-day streak") are shared — raw meal data, exact sugar values, and craving logs are never shared publicly
• Setting your profile to private immediately removes you from other users' feeds and search results
• Deleting your account permanently removes all your social data

We do not share your health data with third parties for social purposes, and we do not facilitate unauthorized sharing of sensitive health information.

🔗 Third-Party Services

Open Food Facts

When you scan a barcode, we query the Open Food Facts public database to retrieve nutritional information. The barcode number is sent to their API. No personal data is shared. See their privacy policy at openfoodfacts.org/privacy.

Anthropic Claude AI

We use Anthropic's Claude AI in three places: (1) The AI Coach sends your recent sugar stats (today's total, streak count, weekly meal count, craving resistance rate) and your message to generate a response. (2) The AI food photo scanner sends your photo solely to estimate sugar content — the photo is not stored by us. (3) The AI recipe generator sends your requested food type and preferences to generate a personalised low-sugar recipe suggestion. In all cases, no personally identifying information such as your name or email is included. See Anthropic's privacy policy at anthropic.com/privacy.

Resend

We use Resend to send transactional emails such as password reset codes and weekly reports. Your email address is transmitted to Resend solely for the purpose of delivering these emails. See Resend's privacy policy at resend.com/legal/privacy-policy.

Railway (Backend Hosting)

Our backend server is hosted on Railway. Your account data and meal logs are stored on a secure server with a private database. See Railway's privacy policy at railway.app/legal/privacy.

RevenueCat

We use RevenueCat to manage Pro subscriptions and in-app purchases. RevenueCat may receive your purchase transaction data from Google Play. See RevenueCat's privacy policy at revenuecat.com/privacy.

🔒 Data Storage & Security

• All data is transmitted over HTTPS (encrypted in transit)
• Passwords are hashed using industry-standard bcrypt before storage
• Authentication uses JSON Web Tokens (JWT) with expiration
• Password reset codes expire after 15 minutes and are single-use
• Your meal and health data is stored on a private database accessible only to your account

While we take reasonable precautions to protect your data, no system is 100% secure. We encourage you to use a strong password.

🗓️ Data Retention

Your data is retained for as long as you have an active account with Glycio.

If you delete your account (available in the app under Profile → Delete Account), all your personal data including meals, streaks, cravings, and account information is permanently deleted from our servers within 30 days.

✅ Your Rights

You have the right to:

• Access your data — all your logs are visible directly in the app
• Delete your account and all associated data — available in the app under Profile → Delete Account
• Correct your information — you can update your goals and profile at any time
• Reset your password — available from the login screen at any time

👦 Children's Privacy

Glycio is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

📝 Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of the app after changes constitutes your acceptance of the updated policy.

For significant changes, we will notify you within the app.