Privacy policy

In short

Beet Buddy is a project in development, tested privately and not available to download yet. It's being designed to help a person with diabetes (the Beet) share their glucose with the people they choose (their Buddies). The app sections below describe the app as it's tested privately now. It shows information only. It does not give dosing advice, control a pump, or replace the Omnipod 5 app or a medical alarm.

BEET BUDDY is run by Chris Campbell, an individual in Buckley, Washington, USA. Contact contact@beetbuddy.app. "We" below means Chris.

• A Buddy sees only what their Beet shares.
• We never sell your information, use it for advertising, or give it to anyone else, unless the law requires it.
• No analytics, no crash-reporting services, no ads, in the app or on this website.
• The Stay in the loop list asks for no name and no health readings, and a Buddy-only sign-up gives no health information at all.

What the app collects, and why

Your account

You sign in with Google. We receive and keep your Google account ID, email address and name. In the app you can add a display name, a username, a colour and a contact email. Why: to know who you are and who is linked to whom.

The Beet's health information

• Glucose readings and trends, which our server receives from the Beet's own connected sources. Why: to show them to the Beet and to the Buddies the Beet chose, and to raise alerts.
• Insulin on board. On the Beet's phone, the app can read the notification the Omnipod 5 app shows (only that app's notifications, and only the insulin-on-board line and mode). This needs Android's notification access, which the Beet turns on themselves. It is sent to our server only while the Beet has "Send insulin on board to Buddies who allow it" switched on. A Buddy sees it only if the Beet has also allowed insulin information for that Buddy. Turning the switch off asks the server to remove it.
• Pod and sensor start times, and carb entries the Beet adds to a low (optional). Why: to show device age and what was done about a low.
• Last 7 days. Our server works out a summary of the Beet's last seven days (time in range, lows, highs, patterns). It uses readings we already hold. We keep only the Beet's choice about sharing it with Buddies.

Messages between a Beet and a Buddy

"Nudges" (a preset message, or a short text you write), hearts, and whether a Nudge was seen. Why: so they can be delivered and shown. A Nudge a Beet sends also carries their latest glucose reading and its age when it's sent. That way the Buddy sees it on the notification.

Alert and check-in choices

Which low check-ins a Buddy receives, and the answers and acknowledgements to them. Why: to send the right alerts. Most alert settings, such as levels, sounds and quiet hours, stay on your phone only.

Feedback you send

If you send a bug report or idea: your text, up to four screenshots that you choose, and technical details (app version, phone make and model, Android version, whether you are a Beet or a Buddy, which screen you were on). We do not attach app logs. Why: to fix problems. Feedback stays on our own server. We do not pass it to any other service.

Technical identifiers

A random ID for each install of the app, the phone's make and model, and the app version. Also a push notification token from Google Firebase, stored encrypted. Why: to keep you signed in on the right phone and to deliver notifications.

Update checks

The app asks our server whether a newer version is available. If you choose to update, it downloads the update from our server, checks it, and hands it to Android's own installer, which asks you to confirm.

What we do not collect

No location, contacts, camera, microphone, advertising ID or browsing data. The app no longer takes meal photos or keeps a meal, exercise or note diary. Old meal photos and Log entries (meals, exercise and notes) from a retired feature are still stored on our server. We don't use them, and we're deleting them this week. No analytics or crash-reporting services. No ads.

The watch app

The watch app has no internet access and no account. It only receives from your own phone what that phone may already show (glucose, trend, insulin on board, their ages, alarms) over the link between them.

What the app asks Android for

• Notifications, to show alerts and Nudges.
• Notification access (the Beet's phone only, optional), to read the Omnipod 5 app's insulin-on-board notification, as described above. Other apps' notifications are never read.
• Do Not Disturb access (optional), so an alarm can sound through Do Not Disturb. The app only checks whether Do Not Disturb would silence an alarm, and changes no Do Not Disturb setting.
• Exact alarms, full-screen alerts and start after restart, so an alarm sounds on time, shows over the lock screen and keeps working after the phone restarts.
• Installing updates, for the update step above.

This website and the Stay in the loop list

Browsing this website

Our own pages set no cookies. There are no analytics, no trackers and no ads. Pages, fonts and pictures all come from this site. If you pick Light or Dark appearance, that choice is kept in your own browser and never sent to us. While you answer the Stay in the loop questions, your answers are kept in that browser tab too, so a reload doesn't lose them. They're cleared once you finish.

The one exception is the Stay in the loop list. Its spam check, Cloudflare Turnstile, loads from Cloudflare and may use its own cookies or similar browser storage for that check. It loads only when you reach the last step of the list. More on it below.

The site is served by Cloudflare. Like any web host, Cloudflare handles your IP address and browser details to deliver pages and to protect the site from attacks. Cloudflare Web Analytics and script injection are off for this site. Cloudflare keeps its own short-term records of requests under its privacy policy. We don't store request logs ourselves.

The Stay in the loop list: exactly what we collect

Beet Buddy isn't available yet. The list is how we plan a future beta and learn who Beet Buddy is for. From everyone, we collect:

• Your email address.
• Whether you're a Beet (you live with type 1 diabetes), a Buddy (you support someone who does), or both.
• Your phone: Android or iPhone.
• Your US state, or that you live outside the US.
• That you're 18 or older, your OK to this policy and the terms, and when you agreed.

If you're a Beet, or both, we also collect:

• Which CGM you use, and how you take insulin. For some answers about insulin, such as a pump without automation, which pump. If you choose Other, the short name you type.
• Your separate OK, in a box that's never ticked for you: “Use my CGM and insulin answers to help plan the beta. I can ask for them to be deleted anytime.” And when you gave it.

If you're a Buddy, or both, we also collect your relationship to the person you support, such as partner or friend. We ask nothing about that person: no name, age or health details. Choosing “Parent or guardian of a child” does tell us that a child has type 1 diabetes. We don't collect any details about the child.

A Buddy-only sign-up gives us no health information about you. It has no CGM, insulin or pump answers and no health-data consent, and our server refuses one that includes them.

From the phone, CGM and insulin answers, our server also files each sign-up under a private planning group, so we can count which setups to plan for first. It isn't shown to you, and it never decides whether you hear from us.

After you finish, you can help shape Beet Buddy if you like. Every question there is optional, and you can skip them all. If you're a Beet, or both: how you share your glucose today and with how many people. If you're a Buddy: how you see their glucose today, such as which app, and how many people they'd share with. That's about the apps, not anyone's readings, and nothing about your own health. Everyone: your phone model, whether you wear a smartwatch, what you'd want most, and how you heard about us. Your browser gets a one-time code when you finish, so these answers join the right sign-up. Our server keeps only a scrambled form of that code, and it stops working after two hours.

The list never asks for your name, glucose readings, insulin doses or other health readings, and it turns away typed answers that look like one. Knowing which CGM or pump you use shows that you have diabetes, so we treat a Beet's answers as health information, ask for a separate OK first, and follow our Consumer Health Data Privacy Policy.

Why we collect it

To plan a future beta and understand who Beet Buddy is for, and to email you if a beta opens. For planning we only look at totals, such as how many people use each CGM. It's never sold, never shared with anyone else, and never used for marketing. Cloudflare stores it for us, as described below.

Spam protection

The list uses Cloudflare Turnstile to check that a person, not a bot, is signing up. It loads only when you reach the last step. Its script comes from Cloudflare (challenges.cloudflare.com) and runs part of the check in a small frame. Cloudflare handles your IP address and browser signals for that check, under its own privacy terms, and may use cookies or similar storage to do it. Our server checks Turnstile's answer and keeps nothing from it.

To stop floods of sign-ups, our server also counts recent attempts from each network. It uses a one-way scrambled form of the network address (a hash), deletes it within two days, and never stores the address itself.

Where it is kept, and who sees it

Sign-ups are stored in a database in our own Cloudflare account (Cloudflare D1). Only Chris, who runs Beet Buddy, can see them, on a private page that Cloudflare Access protects. For each new sign-up Chris gets a short email through Cloudflare's own email routing. It says only that someone joined and the running total: none of your answers, and not your address. We don't email you when you join. The screen you see is your confirmation, and we'll email you if a beta opens. To work through sign-ups, Chris may download a copy to Chris's own computer, keep it private and delete it when done.

How long we keep it

Until it's no longer needed for these plans, then we delete it. Sooner if you ask.

Joining by email instead

If you'd rather not use the list, or it doesn't work for you, you can email contact@beetbuddy.app instead. Email to that address is forwarded by Cloudflare Email Routing to our own inbox at Gmail, Google's email service. We keep what you write the same way as a sign-up, and only Chris reads it. Please don't send glucose readings or other health details.

Your choices

To be removed, email contact@beetbuddy.app from the address you signed up with. You can also ask to see your answers or withdraw your consent. We'll check it's you by replying to that address. We only email you about Beet Buddy's plans. Removing a sign-up doesn't touch an app account, and the other way round.

Who can see your information

• Your Buddies, only if you are a Beet and you linked them with your Beet code. They see what the link allows, and insulin on board only with both your switch and your allowing insulin information for that Buddy. You can remove a Buddy at any time, and a Buddy can unlink.
• Service providers that carry it for us, never for their own use:
  • DigitalOcean, which hosts our server in the United States.
  • Google, for sign-in, and for Firebase Cloud Messaging, which delivers notifications. A notification carries only a message ID and type, never glucose, insulin or message text. Google's Gmail also holds the emails sent to contact@beetbuddy.app.
  • Cloudflare, which carries the encrypted connection between the app and our server, serves this website and forwards email sent to contact@beetbuddy.app. It also stores the Stay in the loop list.
• Beet Buddy uses no AI service. Our summaries, including Last 7 days, are made by our own rule-based code.
• A Beet can copy a text summary of their own past 24 hours from the app and paste it into a tool of their choosing. That is the Beet's own choice. We do not send it anywhere.
• We never sell your information, use it for advertising, or give it to anyone else, unless the law requires it.

Where it is stored and how it is protected

App data is on our server, a cloud server in the United States (DigitalOcean, San Francisco region) that Chris runs. The app talks to it only over HTTPS (encrypted). Push tokens are stored encrypted.

Who can get into the server: only Chris, who runs Beet Buddy. The automated tools that help maintain the server are set up so they can't read your health data.

Stay in the loop sign-ups are in our Cloudflare account, as described above.

How long we keep it

• Account, profile, links and settings stored on the server: until you delete your account.
• Raw copies fetched from Nightscout: about 6 hours, then only the processed readings are kept.
• Nudges, low events and carb entries: until you delete your account.
• Feedback reports: until you ask us to delete them, or delete your account.
• Glucose readings uploaded directly to us: until you delete your account.
• Server backups: deleted within 30 days.
• Sign-in sessions: 30 days, then you sign in again.
• Stay in the loop sign-ups: see This website and the Stay in the loop list.

Deleting your account

Email contact@beetbuddy.app from the address of the Google account you use with Beet Buddy. We check with you first, then delete within 30 days. Here's what gets deleted. You can also do it in the app Coming soon under Settings, Profile and account, Delete account. Signing out alone doesn't delete anything.

Children

Beet Buddy is meant for adults (18 and older), and the Stay in the loop list is for adults only. A parent or guardian who supports a child can join the list as a Buddy and choose “Parent or guardian of a child”. That tells us a child has type 1 diabetes, and we collect nothing else about the child.

Changes

If this policy changes, we update the date above and tell you in the app's What's New.

Contact

Chris Campbell, contact@beetbuddy.app.