Privacy policy

The data controller is Yusuf Demir, İstanbul, Türkiye. You can reach us at [email protected].

Because GlucoMom processes health data, it is subject to the Turkish Personal Data Protection Law (KVKK, Law No. 6698) and, for users in the European Economic Area, the General Data Protection Regulation (GDPR). Health data is "special category" data under both, and we treat it that way everywhere.

Account details: your name, email address, password (stored only as a hash), language, time zone, expected due date and diagnosis date.

Blood sugar readings: the value, the type of measurement (fasting, before or after a meal, bedtime), the time, and any note you add.

Meals: what you ate, when, the estimated carbohydrate range and any note.

Photos: photos of your plate and photos of your glucometer screen, only if you choose to use photo scanning. You can always type instead.

Payment status: whether you have a subscription and until when. Your card details never reach us; they are handled entirely by the payment processor.

Technical data: the session cookie that keeps you signed in, and standard server logs (IP address, time, requested page) kept briefly for security. Health data is never written to logs.

To keep your record: showing your readings and meals back to you, and preparing the weekly report you take to your doctor.

To estimate carbohydrate from a photo, and to read the number on your meter screen so that you can confirm it.

To show anonymous, aggregated figures on food pages, only when at least 30 records exist and never in a way that could identify anyone.

To run the service: sign-in, subscription status, usage limits and security.

We do not sell your data, do not use it for advertising and do not build profiles of you.

Blood sugar readings, meals and photos are health data. We process them only with your explicit consent, which you give when you create your account (KVKK Article 6 and GDPR Article 9(2)(a)).

Account and payment data are processed to provide the service you asked for (KVKK Article 5(2)(c), GDPR Article 6(1)(b)) and to meet legal obligations such as accounting rules.

You can withdraw your consent at any time by deleting your account. Withdrawal does not affect the lawfulness of processing that took place before it.

When you scan a photo, the image is sent to Anthropic PBC (United States), the provider of the AI model that produces the estimate. Only the image and a short description of the task are sent; your name, email address and readings are not.

Anthropic processes the image to return a result and, under its commercial terms, does not use it to train its models.

Photos are deleted from our servers 30 days after analysis. You can delete a meal, and with it its photo, at any time before that.

Sending the image to the United States is a transfer of health data abroad. It happens only with your explicit consent, and you can use GlucoMom fully without ever scanning a photo.

Hosting: Hetzner Online GmbH, Germany. Your data is stored on servers in Germany.

Payments: Paddle.com Market Limited (United Kingdom), our online reseller and merchant of record. It receives your email address and payment details; we receive only the subscription status.

AI analysis: Anthropic PBC, United States, as described above.

Email: transactional messages such as password resets are sent through an email delivery provider, which receives your email address and the message.

We do not use analytics services, advertising networks or social media trackers.

Readings, meals and reports: for as long as your account exists. Free accounts see the last 7 days, but nothing older is deleted; it is shown again if you subscribe.

Photos: 30 days after analysis, then deleted automatically.

Account data: until you delete your account. Deletion is immediate and complete; there is no waiting period and no copy kept for you.

Payment records: for as long as tax and accounting law require, held by the payment processor.

Server logs: at most 30 days.

Food pages may show a line such as "this dish was recorded by 340 people, and in 72% of them the post-meal reading stayed within target".

These figures are calculated from records with no name, date or account attached, and are shown only when at least 30 records exist. They cannot be traced back to you.

GlucoMom uses a single session cookie. It keeps you signed in and protects forms against forgery. It is strictly necessary and needs no separate consent.

There are no advertising, analytics or third-party cookies.

You can see everything you have recorded inside the app, and correct or delete any reading or meal.

You can delete your account from Settings. All of your data is removed at once.

You can withdraw your consent to health-data processing at any time. In practice this means deleting your account, because the service cannot work without that data.

You also have the right to ask what data we hold about you, to receive a copy, to object to processing, and to complain to the supervisory authority (in Türkiye the Personal Data Protection Authority, in the EEA your national authority).

To exercise a right the app does not cover, write to [email protected]. We answer within 30 days.

GlucoMom is for adults. You must be 18 or older to create an account. We do not knowingly collect data from anyone younger, and we delete such an account when we learn of it.

If we change this policy in a way that matters, we will tell you in the app before it takes effect. The date at the top shows the current version.

Yusuf Demir · İstanbul, Türkiye · [email protected]