Your information
Privacy, explained plainly.
This policy explains what the GLP Mirror team processes, why it is needed, and the choices you have.
Information you choose to save
We process your sign-in details and the records you enter: your profile, medication and dose history, weight and measurements, meals, symptoms and check-ins, activity and sleep, glucose, lab results, body outlines, and learning progress. You choose which optional modules to use. Your account associates these records across your signed-in devices.
Apple handles App Store payments. We receive subscription identifiers, status, expiry and an account identifier to verify access and restore purchases. We do not receive your payment-card details.
Photos and optional AI
Manual food logging does not require AI. When you request a food-photo estimate, a compressed photo is sent through our server to OpenAI, together with instructions for estimating the meal. Review and correct the estimate before saving it. We do not attach your account name, email or saved medical history to that request.
Our requests disable storage of the generated response at OpenAI. This does not mean zero retention: OpenAI may retain abuse-monitoring data for up to 30 days, with exceptions described in its API data policy. OpenAI states that API data is not used to train its models unless a customer opts in.
Body-outline analysis runs on your device. On Android, optional body-outline analysis uses Google ML Kit. ML Kit processes the image and analysis results locally; its SDK may contact Google for updates and send usage and performance metrics. See Google’s ML Kit privacy information. Derived outlines and measurements can be saved to your account. Food or body photos are retained in your private cloud storage only when you choose to retain them. Temporary processing files are cleared by the app. Estimates and outlines that you save remain part of your records even when a photo is not retained. Dashboard calculations and educational playback do not require AI requests.
Health connections and permissions
Camera, photo-library and Apple Health or Health Connect access are optional. Selected health records you import may be saved to your GLP Mirror account. You can revoke permissions in device settings; this stops future access but does not erase records already imported.
How the service operates
We use Supabase for authentication, account data and private file storage; OpenAI for requested food-photo estimation; Apple for sign-in and purchases; Resend for account email; and Render and Cloudflare for service hosting, website delivery and DNS. These providers process the information needed to deliver their respective services. Hosting and email providers may process technical information such as IP addresses, request times and email delivery details.
We use your information to provide and secure the service, synchronize your records, verify access, answer support requests and meet legal obligations. We do not sell health information, use it for targeted advertising or include it in analytics events. We use no third-party product-analytics provider.
Usage counts
Unless you turn off Share anonymous usage counts on the You tab, the app adds one to a daily total each time you reach certain steps, such as finishing setup or opening the membership screen. Each count records only the step name, the day, the platform (iOS or Android) and the app version. The stored count contains no account, device identifier, health value or IP address. As with any request, our hosting providers may briefly process technical information as described above. You can turn it off at any time.
This website counts page visits on our own server. For each visit we keep a daily total for the page, the name of the website that linked to it (for example, google.com, never the full address), and any campaign tag in the link. We store no cookies, IP addresses, browser details or other identifiers, and the site runs no analytics scripts or advertising pixels.
Launch notification signup
If you request a launch notification, we separately store your email, selected iPhone/Android platforms, consent version and request/confirmation times. Confirmation email is delivered through Resend. You join the launch list only after confirming ownership of your email. This is consent for launch availability messages only, not ongoing newsletters, and does not create an app account or connect your email to app health records. Each confirmation email includes an unsubscribe link. Unsubscribing removes your email and retains a keyed suppression identifier to prevent accidental re-enrollment. Unconfirmed requests are deleted after seven days. Confirmed launch subscriptions are kept until launch notifications are complete or you unsubscribe; contact support to request deletion. This website form sends only the signup fields you submit, not calculator entries or health information.
Security and retention
The app uses encrypted private local storage, authenticated connections and access-controlled cloud records. This is not end-to-end encryption: authorized service systems process data to provide the features you request. No method of storing or sending data is completely secure, so we cannot guarantee absolute security.
International transfers
Our service providers may process data in countries other than yours, including the United States. Where the law requires, we rely on appropriate safeguards such as standard contractual clauses.
We keep saved account records while your account is active unless you remove them. Signing out clears the app’s private local caches; it does not delete your cloud account. Premium expiry does not delete your health records. Backups and limited records needed for security, transaction reconciliation or legal obligations may remain after deletion and are not necessarily erased immediately.
Children
GLP Mirror is not directed at children under 13 (or under 16 where local law sets a higher age), and we do not knowingly collect their personal data.
Your choices and requests
You can correct records using the app and use available export controls. During this beta, contact support@glpmirror.app to request access, correction, an account-data export or account deletion. We may need to verify ownership before acting. Do not send medical records or passwords by email; describe the request and we will explain the next steps. Depending on your location, you may have additional privacy rights and a right to complain to your local data-protection authority.
We will update this page when practices change and identify the new effective date. If we make a material change, we will update the date above and tell you in the app before it takes effect.