Privacy Policy

Last updated: 22 October 2026

Information We Collect

When you use GLPea, we collect:

• Account information: email address, name, country, and a securely hashed password (or your Apple or Google sign-in identifier if you use those).
• Health information you record: your medication protocol, dose logs (medication, amount, date, injection site, notes), weight and body measurements, water intake, daily check-ins and symptoms, and meals.
• Photos and audio you add: meal photos, dose and injection-site photos, and voice notes.
• Reports you generate: provider reports and data exports, which include your name, email and health records.
• Device and technical information: push notification tokens, device platform, app version, IP address and browser/app user agent (stored with your sign-in sessions and terms acceptance), in-app usage events (for example which screens are opened), and error reports.

How We Use Your Information

• To provide the tracking service, including your history, trends and insights
• To estimate the nutrition content of meals you photograph or describe
• To send dose reminders and other notifications you enable
• To generate reports and exports when you ask for them
• To keep the service secure (for example rate limiting by IP address) and to fix errors
• To provide customer support

Service Providers We Share Data With

We do not sell your personal data and we do not use it for advertising. We share data only with the service providers below, only for the purpose listed, and otherwise if required by law or with your explicit consent.

• Railway (hosting): runs our servers and database, so it stores all account and health information.
• Cloudflare (network and file storage): routes traffic to our servers, and stores your photos, voice notes and generated reports (Cloudflare R2).
• Google Gemini (AI): receives meal photos and meal descriptions to identify foods, and, when AI-written insights are enabled, a summary of your logged trends to word an insight.
• Perplexity (AI): receives the list of identified food items to estimate nutrition.
• Apple: delivers push notifications (Apple Push Notification service) and provides Sign in with Apple.
• Google: provides Sign in with Google, and delivered push notifications to our former Android app (Firebase Cloud Messaging).
• Resend (email): sends account emails such as welcome and password-reset messages, using your email address and name.
• Bloop (error monitoring): receives error reports. Reports sent by our servers have database values removed and your user ID replaced with a one-way pseudonymous identifier. From iOS app version 1.4, reports sent by the app contain only the type and location of the error; earlier versions could include an excerpt of the data the app was loading when the error occurred.

Some of these providers are based in, or process data in, the United States.

Notifications

Notifications we send from our servers show generic text on your lock screen (for example "Time for your dose") and do not include your medication name, dose or symptoms; details are shown only inside the app. From iOS app version 1.4, reminders the app schedules on your device are generic too, and reminders scheduled by an earlier version are updated the first time you open 1.4. Earlier versions may show your medication name in on-device dose reminders until you update.

Data Security

Data sent between the app and our servers is encrypted in transit using HTTPS/TLS. Passwords are stored only as hashes. Access to production systems is restricted. Our infrastructure providers apply their own storage-level protections; we do not currently apply additional application-level encryption to the health information in our database.

Data Retention and Deletion

We keep your health records and account information for as long as your account is active. Some supporting data is deleted automatically sooner:

• generated PDF reports: 8 days after they are created (download links stop working after at most 7 days);
• meal photo analysis requests and their results: 30 days after the analysis finishes (meals you save are kept);
• in-app usage events: after 13 months (summary statistics, such as how many days a month you used the app, are kept);
• expired sign-in sessions: 30 days after they expire; password-reset and similar codes: one day after they expire.

You can delete your account in the app (Settings > Account > Delete Account) or by emailing [email protected]. When you do:

• your account is disabled immediately, you are signed out on every device, and we stop sending you notifications;
• after a 30-day grace period, your account and all associated records are permanently deleted, together with your stored photos, voice notes, meal photos and generated reports.

If you contact us within the 30-day grace period we can restore your account.

Your Rights

You have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Export your data: in the app, go to Settings > Export Health Data. Choose PDF or CSV for a summary of your doses, weight, water and check-ins, or Download all my data (JSON) for a machine-readable copy of all the information in your account. Photos and voice notes themselves aren't in the file; you can view them in the app or email [email protected] for copies
• Withdraw consent, for example by turning off notifications or not using AI meal analysis

To exercise any of these rights, contact [email protected].

Children's Privacy

GLPea is not intended for use by individuals under 18 years of age. We do not knowingly collect data from children.

Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes via email or in-app notification.

Contact Us

For privacy-related questions, contact us at: [email protected]