Privacy Policy

1. Who We Are

MyGlow ("we," "us," or "our") is an independent developer of the MyGlow mobile application (bundle ID: com.myglow.myglow). MyGlow is a GLP-1 medication and wellness tracking application designed to help users manage their health journey.

For all privacy-related inquiries, you can contact us at: support@myglow.app.

2. Information We Collect

2.1 Account Information

When you create an account via Google Sign-In, Apple Sign-In, or email/password, we collect:

• Email address
• Display name (as provided by your sign-in provider or entered by you)
• Profile photo URL (if provided by your sign-in provider)
• Authentication tokens (stored securely on your device)

2.2 Health and Medication Data

As core functionality of the app, we collect the following health-related information that you voluntarily enter:

• Medication tracking: medication name, dosage, injection site, injection date and time
• Side effects: any side effects you log (nausea, fatigue, etc.)
• Weight entries: weight measurements and dates
• Daily check-ins: mood, energy level, sleep quality, and water intake
• Food logs: meals and nutritional information you record

2.3 Photos

If you choose to upload progress photos, those images are transmitted to and stored on Cloudinary (our cloud media storage provider). Photos are linked to your account and are not publicly accessible.

2.4 Usage and Analytics Data

We use Firebase Analytics to understand how the app is used. This may include:

• App screens viewed and features used
• Session duration and frequency of use
• Device type, operating system, and app version
• Country-level location (not precise GPS location)

Analytics data is collected in an aggregated and anonymized form where possible.

2.5 Crash and Diagnostic Data

Firebase Crashlytics automatically collects crash reports when the app experiences an error. This data includes stack traces, device state at the time of the crash, and app version. It does not include your personal health information.

2.6 Subscription and Payment Data

If you purchase a subscription, payment processing is handled entirely by Apple App Store or Google Play. We do not collect or store your payment card information. RevenueCat manages subscription status on our behalf and may receive your anonymized app user ID and subscription state.

3. How We Use Your Information

We do not use your health data for advertising, sell it to third parties, or share it with insurance companies, employers, or government entities (except as required by law).

4. Data Storage and Security

4.1 Cloud Storage

Firebase Firestore (operated by Google) stores your account profile and all health records you enter. Data is encrypted in transit using TLS and at rest using AES-256 encryption.

Cloudinary stores your progress photos. Photos are accessible only via authenticated, private URLs tied to your account.

4.2 On-Device Storage

• Hive is used as a local cache on your device to allow offline access and improve performance. This data mirrors what is stored in Firestore.
• Flutter Secure Storage stores your authentication tokens in the device's secure enclave (iOS Keychain / Android Keystore). These tokens are never transmitted to our servers.

4.3 Security Measures

• All data transmitted between the app and our servers is encrypted using TLS 1.2 or higher.
• Authentication is managed by Firebase Authentication with industry-standard OAuth 2.0 and PKCE flows.
• Access to production databases is restricted to authorized personnel only.
• We conduct periodic security reviews of our infrastructure and dependencies.

No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. Please notify us immediately at support@myglow.app if you suspect unauthorized access to your account.

5. Third-Party Services

MyGlow relies on the following third-party services. Each has its own privacy policy:

We select third-party providers that maintain high standards of data protection and are compliant with applicable privacy regulations. We do not authorize these providers to use your data for their own marketing purposes.

6. Health Data Handling

• Your health data is used only to provide the features you request within the app.
• We do not sell, license, or monetize your health data in any form.
• We do not share your health data with advertisers, data brokers, insurance companies, or employers.
• We do not use your health data to train machine learning models without your explicit, opt-in consent.
• Health data stored in Firestore is logically isolated per user account and protected by Firestore security rules that prevent cross-user access.
• MyGlow is not a covered entity under HIPAA. However, we voluntarily adopt similar standards of care for health information.

7. Sharing and Disclosure

We do not sell your personal information. We share data only in the following limited circumstances:

• Service providers: As described in Section 5, we share data with our third-party infrastructure providers solely to operate the app.
• Legal requirements: We may disclose information if required by applicable law, court order, or governmental authority.
• Protection of rights: We may disclose information to enforce our Terms of Service, protect the safety of users, or defend against legal claims.
• Business transfers: If MyGlow is acquired or merges with another entity, your data may be transferred as part of that transaction. We will notify you via email or in-app notice before your data becomes subject to a different privacy policy.
• With your consent: We may share information with your explicit consent for purposes not covered by this policy.

8. Data Retention

We retain your data for as long as your account is active or as needed to provide the service.

• Account and health data: Retained until you delete your account. Upon deletion, your data is permanently removed from Firestore within 30 days, and from Cloudinary within 30 days.
• Analytics data: Firebase Analytics retains event-level data for 14 months by default. Aggregated reports may be retained indefinitely.
• Crash reports: Firebase Crashlytics retains crash reports for 90 days.
• Backups: Firestore automated backups may retain deleted data for up to 7 additional days before permanent deletion.
• Legal holds: We may retain certain information for longer periods if required by law or for legitimate business purposes such as fraud prevention.

To request deletion of your account and data, see Section 9 or contact support@myglow.app.

9. Your Rights

Regardless of your location, you have the following rights with respect to your personal data:

Access

You can view all data you have entered directly within the app. You may also request a complete export of your data by contacting support@myglow.app.

Correction

You can edit or correct your data directly within the app at any time.

Deletion

You can delete individual records within the app. To delete your entire account and all associated data, go to Settings → Account → Delete Account within the app, or email support@myglow.app. We will complete deletion within 30 days.

Data Portability

You may request a machine-readable export of your health data (JSON format) by contacting support@myglow.app.

Opt Out of Analytics

You can opt out of Firebase Analytics data collection in Settings → Privacy within the app, or by enabling the "Limit Ad Tracking" option on your device.

Withdraw Consent

Where we rely on consent as a legal basis, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, contact us at support@myglow.app. We will respond within 30 days.

10. GDPR — European Users GDPR

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, additional rights apply under the General Data Protection Regulation (GDPR) and equivalent laws.

Legal Bases for Processing

We process your personal data under the following legal bases:

• Performance of a contract (Article 6(1)(b)): Processing necessary to provide the app features you use.
• Legitimate interests (Article 6(1)(f)): Analytics and crash reporting to improve app quality.
• Legal obligation (Article 6(1)(c)): Compliance with applicable laws.
• Explicit consent (Article 9(2)(a)): For processing special category data (health information). You provide this consent when you voluntarily enter health data into the app.

Special Category Data

Health data is a "special category" under GDPR Article 9. We process it only with your explicit consent, solely to provide the services you request. You may withdraw this consent at any time by deleting your data or your account.

Additional GDPR Rights

• Right to restrict processing: You may request that we restrict processing of your data in certain circumstances.
• Right to object: You may object to processing based on legitimate interests.
• Right to lodge a complaint: You have the right to lodge a complaint with your local data protection authority (e.g., ICO in the UK, or your national DPA in the EU).

To exercise your GDPR rights, contact us at support@myglow.app.

11. CCPA — California Users CCPA

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the CPRA, provides you with additional rights.

Categories of Personal Information Collected

In the past 12 months, we have collected the following categories (as defined by CCPA):

• Identifiers (email address, name)
• Health and medical information (medication data, weight, mood, etc.)
• Internet or network activity (app usage, crash data)
• Commercial information (subscription status)

We Do Not Sell or Share Your Personal Information

MyGlow does not sell your personal information, and does not share it for cross-context behavioral advertising purposes. You therefore have no need to submit a "Do Not Sell or Share My Personal Information" request, but you may contact us if you wish to confirm this.

Your CCPA Rights

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete: Request deletion of personal information we have collected, subject to certain exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt Out: Opt out of the sale or sharing of personal information (not applicable as we do not sell data).
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise these rights, contact us at support@myglow.app. We will respond within 45 days as required by law.

12. Children's Privacy

MyGlow is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If you are under 13, please do not use the app or submit any personal information.

If we become aware that we have inadvertently collected personal information from a child under 13 without verifiable parental consent, we will take steps to delete that information as quickly as possible. If you believe we may have collected data from a child under 13, please contact us at support@myglow.app.

Users between the ages of 13 and 18 should review this policy with a parent or guardian before using the app.

13. International Data Transfers

MyGlow is operated from the United States. If you are located outside the United States, your data will be transferred to and processed in the United States and other countries where our service providers operate.

For users in the EEA, UK, or Switzerland, we ensure that such transfers are protected by appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) adopted by the European Commission, where applicable through our service providers.
• Reliance on providers that participate in recognized data transfer frameworks.

By using the app, you acknowledge that your data may be transferred internationally as described in this policy.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or app features. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page.
• Send an in-app notification or email to registered users.
• For significant changes affecting how we process health data, we will request fresh consent where required.

Your continued use of the app after the effective date of the updated policy constitutes acceptance of the changes. We encourage you to review this policy periodically.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We are committed to resolving privacy concerns promptly and will respond to all inquiries within 30 days.