GlucoStepPrivacy Policy
Effective November 15, 2026
GlucoStep is a walking and glucose journal made by Honeyground Inc. ("we"). This policy explains what the app and this website collect, where it goes and how to delete it. The short version: your records stay on your phone unless you turn on an account feature, and glucose leaves your phone only when you turn on sync.
1. On your phone by default
Without an account, glucose readings, walks, notes, meal times, reminders and settings are saved only on your device. Steps are read from Apple Health (iPhone) or Health Connect (Android) with your permission; GlucoStep only reads them and does not write to those stores. Widgets read the same on-device data.
2. When the server is used
We use Supabase (a hosted database) only for these optional features:
| Feature | What is stored | Why |
|---|---|---|
| Account (sign in with Apple, Google or email) | Account ID, email address (or the private relay address Apple gives), sign-in method | To recognise you on your phones |
| Backup & Sync (subscription) | Your glucose readings, walks, notes and settings | To back up and sync your records between your phones. This is the only time glucose leaves your phone. |
| Together | The display name you choose, your daily step counts for the last 8 days, your friend list, cheers sent and received (as a phrase number), blocks and reports, and a push token | To show friends each other's steps and deliver cheers. Glucose, walks and notes are never sent for Together. |
| Subscription | Store purchase status (product, start, expiry, trial) | To unlock sync and insights. Payment is handled by Apple or Google; we never see your card. |
3. Analytics and crash reports
The app uses Google Firebase Analytics and Crashlytics to learn which screens are used and to fix crashes. Events describe actions (for example "walk started" or "widget added") and never include glucose values, step counts, notes, your name or email. On iPhone, analytics runs without the advertising identifier. You can turn usage statistics and crash reports off in Settings → Privacy ("Send usage stats and error reports").
This website uses Google Analytics 4 (via Firebase) to count visits and store-button clicks. Advertising features and Google signals are off and we drop query strings from page addresses. If your device is set to a European time zone, we ask first and load nothing until you agree. The invite page (/g/…) uses no analytics.
4. Notifications
Walk and measurement reminders are scheduled on your phone as local notifications. Cheers from friends in Together are delivered as push notifications through Apple Push Notification service or Firebase Cloud Messaging, using the push token described above.
5. What we do not do
- We do not sell or rent your data, and we do not show ads.
- We do not use your health data for advertising or share it with data brokers.
- We do not diagnose or give medical advice. GlucoStep shows what you recorded.
6. Service providers
Supabase (database and sign-in), Google Firebase (analytics, crash reports, push delivery), Apple and Google (sign-in, purchases, Health data on your phone), Expo (push delivery). They process data only to provide their service to us.
7. Keeping and deleting data
- Delete account in the app (Account screen → Delete account) removes your account and everything on our server: synced records, Together profile, step counts, friends, cheers and push tokens.
- Turning off sync stops uploads. Leaving Together removes your Together profile and step counts.
- On-device records stay until you delete them in the app or uninstall it.
- Analytics events are not linked to your account and are deleted by Google after the retention period set for our property.
You can also ask us to access, correct, export or delete your data by writing to support@honeyground.com. We answer within 30 days.
8. Security
Data travels over encrypted connections (HTTPS/TLS). Server rows are protected so each account can read only its own records; friends can read only the step counts and names shared through Together.
9. Children
GlucoStep is not directed to children under 13 and we do not knowingly collect their data. If you believe a child has given us data, contact us and we will delete it.
10. Your rights
Depending on where you live (for example the EU/UK GDPR or US state laws such as California's), you may have the right to access, correct, delete or port your data and to object to processing. Our legal bases are your consent (Health access, analytics where required, Together) and performing our contract with you (account, sync). Contact us to use these rights; you may also complain to your local data-protection authority.
11. Changes
If we change this policy we will update the date above and, for important changes, tell you in the app.
12. Contact
Honeyground Inc., Connecticut, United States · support@honeyground.com