How GLPMGR handles your data

1 Overview

GLPMGR is a medication, weight, and symptom tracker built for people on GLP-1 treatment plans. It is designed around a simple idea: information as sensitive as your injection log and body photos should stay under your control, not ours. GLPMGR is provided by iSafeNet.

This policy explains exactly what GLPMGR records, where it lives, and what — if anything — ever leaves your device. There is no account to create and no GLPMGR server to send data to, so most of this policy is a description of on-device behavior rather than a list of things we do with your information.

2 Data you enter

Using GLPMGR, you may choose to record:

All of it is optional — GLPMGR only stores what you choose to type, select, or photograph inside the app.

3 Health app (HealthKit)

GLPMGR can use Apple's Health app in these optional ways, all off by default and all only if you grant permission: it can write the weight you log to Health; it can read today's protein, water and dietary energy (calorie) totals from whichever food-tracking app you already use, to show on the Today screen; it can read your blood glucose readings, from whichever app or monitor writes them to Health, to show a 7-day average, charts and, if you ask for it, a page in your doctor report; it can read weight, body fat percentage, lean body mass and height from a smart scale or another app, to add them to your log; it can read your daily step counts, to show your average steps a day beside your weight; and, with Muscle Support turned on, it can read your daily protein totals for the last 7 days and the strength workouts you've done this week, to show your average protein a day and your strength sessions this week. These exchanges happen through Apple's HealthKit framework directly on your device.

• GLPMGR only requests the specific HealthKit data types it needs — it writes body mass, and reads protein, water, dietary energy, blood glucose, body mass, body fat percentage, lean body mass, height, step count and workouts — never your full health record. Weights GLPMGR saved to Health itself are never read back, and it never writes nutrition data, blood glucose, body composition, height, steps or workouts.
• You can grant or revoke this access at any time in Settings → Privacy & Security → Health → GLPMGR.
• Health data GLPMGR reads is used solely to display and calculate information inside the app. It is never transmitted to us or to any third party, and blood glucose, step counts, and the protein totals and workouts read for Muscle Support are not stored by GLPMGR: they are read when needed, held in memory to draw the averages and charts, and discarded. Weight, body fat, lean mass and height you choose to read from a smart scale are different: they are added to your log and stored on your device like the entries you type, and your height is only read if you haven't entered one. The one place it can appear outside the app is the PDF report you choose to generate (see section 8). Blood glucose readings you type in yourself are different: they are stored on your device with your other entries, like body measurements.

4 Photos

Progress photos are ones you take with the camera inside GLPMGR, or pick through Apple's native photo picker, which does not require GLPMGR to have general access to your photo library — only the specific images you pick. Photos are kept in GLPMGR's own app storage, encrypted there with a key held only in your device's Keychain, and shown to you inside the Journey and Photos views. While you take one, your last photo of the same pose is shown faintly over the camera so they line up; that happens on your device.

A before-and-after image or a timelapse is made on your device from photos you choose. Faces are blurred by default, also on your device (Apple's Vision framework). It's shared only if you share it from the share sheet, and saved to your photo library only when you tap Save — GLPMGR asks for permission to add to your library, not to read it.

If you use Scan a Food Label (Protein), the camera is used only to read a food label's protein figure. The photo is read on your device and never saved or sent anywhere, and a label photo you choose from your library is used the same way. GLPMGR only asks for camera access the first time you use it.

5 Where your data lives

Everything you record is stored locally on your device in a private, sandboxed app database, shared only between the GLPMGR app, its Today/Next Dose widgets and Live Activity, and — if you use the GLPMGR Apple Watch app — your paired Apple Watch. The Watch receives your next dose, medication and recent weights from your iPhone, and can send a weight you log on the Watch back to it; these transfers go directly between your own devices using Apple's WatchConnectivity, never through a server. GLPMGR does not operate any backend servers, and your records are stored locally in the app. The only request the app itself makes to a server is the barcode lookup, and only when you choose to scan one (see below). Files you choose to export, or automatic backups if you turn them on, are written to a place you pick in the Files app; if that place is a cloud service, that service stores the file, not GLPMGR. Your routine records are never synced to iCloud (see iPhone & iPad Sync below for keeping your own devices the same), and the app's data is also excluded from iCloud Backup and from a computer backup — restoring or migrating a device does not bring GLPMGR's data with it. You can, though, choose to put a copy outside the app: a JSON backup, an automatic backup (section 8), or a CSV file or PDF report is saved wherever you pick in the Files app, which may be on your device, a USB drive or a cloud service such as iCloud Drive, and a cloud service stores it under its own terms. A JSON backup, imported on the other device, is the way to move your data or recover it after a lost or wiped device; it is a complete copy, including your photos, dosing schedules and settings, and stays entirely on-device unless you choose where to save or send the file. You set a password when you create a JSON backup, and the file is encrypted with a key derived from that password. CSV files and PDF reports are not encrypted (section 8). GLPMGR never stores the password of a backup you make by hand; if you turn on automatic backups, it keeps that password in your device's Keychain (section 8). Losing the password means the backup can't be recovered, by you or by anyone else.

iPhone & iPad Sync is optional and off until you pair two of your own devices in Settings → iPhone & iPad Sync: one shows a pairing code and the other scans or types it. From then on, the two keep the same entries, including photos, by connecting directly to each other over your Wi-Fi or a peer-to-peer link — never through iCloud, a GLPMGR server or the internet. The connection is encrypted with a key that comes from the pairing code, which is kept only in each device's Keychain, so only your paired devices can connect or read what's sent. Photos are encrypted again on arrival with the receiving device's own key. GLPMGR asks for permission to use your local network for this. Settings stay each device's own, and you can unpair at any time.

Scanning a food barcode (Protein) is optional, and is the only request GLPMGR itself makes over the internet. To look the product up, GLPMGR sends the number under its barcode to Open Food Facts, a nonprofit, open food database. Nothing else is sent: nothing about you, your medicine or what you've logged. Like any web request, Open Food Facts can see your device's IP address; its privacy policy explains how it handles requests. The app says this before you scan, and searching for a food, reading a nutrition label and photo or voice logging all work on your device instead.

6 Notifications

Dose reminders, low-supply alerts and any other reminders you turn on (such as a weekly weigh-in reminder) are scheduled entirely on-device using Apple's local notification system. No reminder data is sent to a server to trigger these notifications — your phone handles the whole thing offline.

7 Subscriptions & payment

GLPMGR is free to use. Its optional Premium features are sold as an auto-renewable subscription (monthly or yearly, with a 7-day free trial on the yearly plan for eligible new subscribers) through Apple's App Store using StoreKit. All payment details — card numbers, billing address, and purchase history — are collected and processed by Apple, not by GLPMGR. The app checks with Apple's StoreKit, on your device, whether an active subscription exists, so it can unlock the Premium features; we don't receive your payment details or purchase history.

8 Exporting your data

GLPMGR lets you export your entries as a JSON or CSV file, or as a PDF report, at any time from Settings. This export is generated entirely on your device and handed to iOS's native file-saving screen — no network request is made and no copy is sent to us. Where you send that file afterward (email, Files, iCloud Drive, AirDrop, a doctor's portal) is entirely up to you. Only the JSON backup is encrypted, with the password you set; the CSV file and the PDF report are not password-protected, so anyone who can open them can read them. GLPMGR asks you to confirm before making a CSV file, and lets you leave your notes out of it. Exports include everything you entered in GLPMGR, including blood glucose readings you typed in. Blood glucose read from Apple Health is never in the JSON or CSV file; it can appear only on the blood glucose page of the PDF report, if you turn blood glucose on and generate a report. You can also import a previously exported file; it is read entirely on your device.

Automatic backups. If you turn them on in Settings, GLPMGR saves the same password-locked JSON backup by itself, daily or weekly (when you open the app and one is due), to a folder you choose in the Files app — for example On My iPhone, a USB drive, or a cloud folder of your own such as iCloud Drive. They are off by default. The backup is made on your device and written only to that folder; nothing is sent to us. If the folder you choose is in a cloud service, that service stores the locked file under its own terms, and it can't be read without your password. GLPMGR keeps the newest five of its own backups in the folder and removes older ones, and never touches any other file there. So that backups can run without asking you each time, your backup password is kept in this device's Keychain (on this device only, never synced), and it is never written into the backup itself. Turning automatic backups off removes the saved password and forgets the folder; backups already saved stay where they are until you delete them.

9 No analytics, ads, or tracking

GLPMGR contains no analytics SDKs, no advertising networks, and no third-party trackers of any kind. We do not know how often you open the app, which screens you visit, or anything else about your usage. There is nothing to opt out of, because nothing is being collected. The app itself makes no network requests to us. Its only network request is the optional barcode lookup at Open Food Facts (section 5), which sends the barcode number and nothing else. The links in the app to the Terms of Use and this Privacy Policy open web pages hosted on GitHub Pages in your browser; like any website visit, that request is visible to the web host, and it is separate from anything you record in GLPMGR.

10 Sharing your data

We don't share, sell, or rent your data to anyone — there is no data on our servers to share in the first place. The only parties who ever touch your information are:

11 Retention & deletion

You control retention directly: delete any entry or photo inside the app at any time; files you exported earlier, and automatic backups saved to your chosen folder, are copies that stay where you saved them (in a cloud service, too), so delete those yourself. GLPMGR keeps its newest five automatic backups in that folder and removes the older ones it made; turning automatic backups off does not delete the ones already saved. Deleting the GLPMGR app removes its entire local database from your device. A backup of your device that you made earlier may still contain GLPMGR's data; you can remove old device backups in your device settings.

12 Children's privacy

GLPMGR is intended for adults managing their own GLP-1 treatment and is not directed at children. We do not knowingly collect information from children under 13 (or the relevant minimum age in your region). Since GLPMGR keeps data on-device with no account system, we have no practical way to identify a user's age — if you believe a child has used GLPMGR to store personal information, the data in the app can be removed by deleting the app, and any exported files or backups can be deleted from where they were saved.

13 Security

Your data benefits from iOS's standard app sandboxing and device-level encryption. Because there is no GLPMGR server or account, there is no central database of users' data that could be breached on our end. iPhone & iPad Sync is encrypted end to end between your own paired devices.

14 Changes to this policy

If GLPMGR's data practices change — for example, if a future version introduces an optional server-backed feature — this policy will be updated and the "Effective" date above will change accordingly. Material changes will be noted in the app's release notes.

15 The GLPMGR 1.8 launch list

Before GLPMGR 1.8 came out, this website let you leave your email address to be told when it was released. That list has closed. Nobody joined it, so no email was sent and no email addresses are kept. It was separate from the app, which has no account and no server.

If we open a list like it again, this section will say what it keeps, how it's used and when it's deleted, before anyone can join.

16 Contact

Questions about this policy or your data can be sent to iSafeNet at info@isafenet.app.