Privacy Policy

The short version

1. What we hold

• Your account: your email address, a hash of your password (never the password itself), and your sign-in sessions.
• Health data from your devices: glucose readings, insulin doses, carbs, pump events, workouts, heart rate, recovery and sleep — whatever the services you connect actually give us. On iPhone, if you allow it, T1Q also reads blood glucose, insulin doses, carbohydrates and workouts from Apple Health (HealthKit) — and heart rate too, only if you add it from the Apple Health card in Settings → Devices, to show you your latest reading and today's low, high and average. It only reads: T1Q never writes to Apple Health. Data from Apple Health is never used for advertising or marketing, never sold, never given to data brokers, and is shared only with the companies in section 5 — and with Anthropic, for the AI features in section 4 once you turn them on — to provide the features you use.
• What you log yourself: meals, boluses, glucose you typed in, workouts, your targets and ratios, your training plan.
• Meal photos you take, and the estimates made from them.
• Coach conversations: what you asked and what the coach answered.
• Your AI-features choice: whether you turned AI features on, when, and which version of the AI notice you accepted (section 4).
• Calendar events, if you connect a calendar: from Google Calendar (read-only access you grant, which you can withdraw in your Google account) or from a calendar link you paste. For each event we keep its title, start and end time, location, whether you declined the invitation (Google Calendar only), and a category we work out (for example training or travel), so your glucose can be lined up with what you were doing and, on the accounts that have plan-ahead meals and notices, so T1Q knows when your next session is. When a sport session on your connected calendar has ended and nothing recorded it — no wearable, no Apple Health workout, no workout you logged yourself — T1Q can log it as a workout marked "from your calendar": its times, its sport and the event's title, with no heart-rate or strain data. You can delete it. Nothing extra is collected for this; it comes from the calendar events above. The calendar link and Google's access tokens are stored like device passwords (section 3).
• Alarms, if you use them: your alarm lines, quiet hours and lock-screen setting, and whether you turned on Show activity, meals and events in alarms (off unless you do); when you turned alarms on and which version of the alarm notice you accepted; and a record of each alarm (the notification text, the reading and the line behind it, and whether it went out). With that switch on and the reading shown, a low or high alarm's text can also name a recent or live workout, a sport event from your connected calendar and your last logged meal — things T1Q already holds; nothing extra is collected for it. For each iPhone where you allow T1Q's notifications: the push token Apple gives the T1Q app on that phone, the app's build, whether it is a development or a TestFlight / App Store build, when the app last checked in, and the result of the last notification sent to it (sent, failed, or no longer accepted — with Apple's short reason code, never your glucose). A phone's push details are removed when you sign out of the T1Q app on it; the rest is part of your data — in your export, and erased with your account.
• Plan-ahead notices, if your account has them: your settings for them in Settings → Plan-ahead notifications (on — the default — or off, how early, their quiet hours) and a record of each one — which session it was for, when it was due, whether it went out and Apple's delivery result. Not its text: the app rebuilds that from your own data when you look. Part of your export, erased with your account.
• The minimum technical exhaust: a session cookie so you stay signed in, your time zone so the numbers land on the right day, and server logs recording that requests happened. We do not run analytics, fingerprinting, advertising pixels, or any third-party script. The app loads nothing from anyone else's servers.

2. Where it lives

T1Q does not keep everyone's data in one big table with a column saying whose row is whose. Each account gets its own database file, in its own directory, on our server. Your glucose history and someone else's are not neighbours; they are separate files. That is a deliberate architectural choice — it means the usual way health apps leak across users (a forgotten filter in a query) has nothing to leak through.

Your meal photos are stored as files inside that same private directory.

The server is a virtual machine rented from DigitalOcean, in its New York data center in the United States. If that changes, we will update this section.

3. Your device passwords

Some services — a CGM cloud, a pump data service, a wearable — have no proper way to give an individual access other than their own login. When you connect one, this is what happens:

• The credentials are encrypted before they touch the disk, with a key stored outside your account's directory. A copy of your account folder on its own decrypts to nothing.
• They are decrypted in memory only when a sync runs, and used only to fetch your data from that vendor.
• No API of ours ever returns them. Once saved, they cannot be read back out of T1Q by anyone, including us through the app.
• They are never written to a log.
• When you disconnect a device, the encrypted file is deleted, not blanked.
• They are excluded from our backups by construction — the backup script cannot copy them even if someone told it to.

What we cannot do is make a third-party login safer than it is. If you would rather not hand over a vendor password, do not connect that vendor.

4. What goes to Anthropic, and what that means

T1Q's AI features use Anthropic's Claude API, and each of them sends data out of our server to do it. None of them runs until you turn on AI features. The app asks first, on a screen that names Anthropic and lists what is sent; you can say no and keep using everything else — your data, charts, alarms and logging. You can turn AI features off again at any time in Settings → AI features, and from then on nothing more is sent. Once they are on:

• The coach. Your question is sent, along with the parts of your own history the answer needs — for example your glucose statistics for a period, your recent workouts, your recent meals, or your low-glucose episodes. The coach fetches those from your database and includes them in the request. Earlier turns of the same conversation are sent too.
• The answer check. Before a coach answer (or the notes of a meal estimate) reaches you, the text may go to Anthropic a second time, with the conversation it answers, to a smaller model that checks it for insulin-dose advice; any sentence that gives such advice is removed.
• Meal photos. When you photograph a meal — one photo, several, or a before-and-after pair of the same plate — the images are resized and sent to Anthropic's API, which returns a carb and macro estimate, with any note you typed. If a photo has your kitchen, your hands, or other people in it, that goes too.
• Typed meal descriptions. When you ask T1Q to estimate a meal from a description you typed, the description is sent as you wrote it.
• Insights explanations. When you open Insights, the glucose patterns T1Q found in your data (for example how your glucose tends to run after a kind of meal or workout), the note about yourself in your profile, and your pump type are sent, so the model can write a short explanation and tip for each pattern. This happens automatically each time Insights loads new patterns, while AI features are on.
• Workout suggestions. When you ask for exercise suggestions, your training plan's day names, the exercises already in it and a summary of your recent workouts are sent.
• The habits review, where your account has it: when you ask for a review, a summary of your recent history — glucose, meals, workouts, calendar events, sleep and recovery — is sent so the model can write notes on it.

Data that came from Apple Health can be part of any of these, except heart rate: no AI feature reads it. Your email address, your password and your device credentials are never included, and Anthropic is not told which account the data belongs to. But anything you write yourself — a question, the note about yourself in your profile, a meal description — is sent as you wrote it, so leave out anything you would not want sent.

Anthropic is a separate company and their handling of that data is governed by their own terms, not ours. As of this draft, their commercial API terms state that inputs and outputs are not used to train their models, and are retained only briefly for safety monitoring. That is their policy and it can change — read it yourself if this matters to you, at anthropic.com/legal.

Until you turn on AI features, nothing about your health goes to Anthropic.

5. Everyone else your data touches

• The device vendors you connect — Dexcom, Glooko, Whoop and the like. We send them your credentials to fetch your data; they see requests coming from us on your behalf. They already have this data; that is why you are connecting them.
• The calendar you connect — Google, for Google Calendar, or whoever hosts a calendar link you paste. We use your Google access, or your link, only to fetch your events; Google or that host sees the requests coming from us on your behalf.
• Our email provider, Resend, to deliver your eight-digit sign-up, sign-in and password-reset codes, and the short notice sent instead of a code when an address already has an account or has none. It sees your email address and the message. We do not send health information by email.
• If you email us, your message is delivered through Cloudflare Email Routing to a Google Gmail inbox.
• Our hosting provider, in the ordinary sense that they operate the machine.
• Our operational alerts. When something on the server needs attention — a data source that stopped syncing, a failed backup, unusual sign-in activity, AI spending — an alert goes to our own phones through ntfy, a push-notification service. An alert can carry a shortened account id (eight characters) and the state of a data source; never your email address, your name, or any health value or reading.
• Apple, only if you allow T1Q's notifications on your iPhone. Each alarm (once you turn alarms on in Settings → Alarms), and each test notification — one you send yourself, or one T1Q support sends at your request — goes through Apple Push Notification service to your phone. Apple receives the notification's text, which kind of notification it is, and your phone's push token — not your email address or your T1Q account. A test notification carries no reading. An alarm's text says what was read, when, and from which source, so it includes your glucose reading, unless you turn off Show the reading on the lock screen in Settings → Alarms; then it only says which alarm fired. With the reading shown, if you also turn on Show activity, meals and events in alarms, a low or high alarm also says what T1Q has around the reading: a recent or live workout (its sport and times), a sport event from your connected calendar (its title, or its sport, and its time), and your last logged meal and its time (its name too, unless you hide how your usual dishes have gone). With the reading hidden, an alarm says none of this. On the accounts that have them, a plan-ahead notice before a session on your calendar or training plan goes the same way. Plan-ahead notices need no alarm notice: they are on as soon as you allow T1Q's notifications on your iPhone, and you can turn them off in Settings → Plan-ahead notifications. Each one names the session, its time and when to eat by, and — unless Show the reading on the lock screen is off (the same switch appears in Settings → Plan-ahead notifications as "Show event names and meals on the lock screen") — the event's title, the names and carb sizes of meals from your history, and a time-in-range figure from your own past glucose. It never names an insulin amount. A notification can appear on your lock screen; to hide its text while the phone is locked, use iPhone Settings → Notifications → T1Q → Show Previews. Apple's handling of it is governed by Apple's own terms.

Those, with Anthropic (section 4, once you turn on AI features) and the encrypted backup copy (section 7), are everyone your data reaches. There is no advertising network, no analytics vendor, no data broker, no "partner". We do not sell your data, and we do not share it for anyone else's marketing. If law enforcement ever compelled disclosure, we would tell you unless legally forbidden.

The companies that process your data on our behalf, and where:

• DigitalOcean, LLC (United States) — runs the server and holds its on-server backups.
• Anthropic, PBC (United States) — the AI features in section 4 (the coach and its answer check, meal photo and text estimates, Insights explanations, workout suggestions, the habits review), only once you turn them on.
• Apple Inc. (United States) — delivers notifications, only if you allow them.
• Google LLC (United States) — Google Calendar, only if you connect it; and the Gmail inbox that email to our contact address lands in.
• Cloudflare, Inc. (United States) — routes email sent to our contact address.
• ntfy (ntfy.sh) — carries our operational alerts, as described above.
• Resend (Plus Five Five, Inc., United States) — delivers our sign-up, sign-in and password-reset emails, as described above.

6. Models, and what we train on

T1Q's prediction models are trained on openly licensed public research datasets, not on the data of the people using the app. If a model is ever personalised to you, it is trained on your data alone, it lives in your account, and it is deleted with your account. Your data is not used to improve anyone else's experience, and it is not sold to anyone who trains on it.

Heart rate from Apple Health never feeds T1Q's forecast models, and no AI feature reads it. T1Q shows it to you — your latest reading on the Apple Health card in Settings → Devices, and today's low, high and average on the Activity tab — and keeps it in your account and your data export. The forecast works without it.

7. Backups

We take a snapshot of the databases every night and keep the most recent fourteen, so a crash or a mistake costs you hours rather than years. Backups deliberately exclude the encrypted credential vault and its key — a stolen backup disk contains no vendor logins.

An encrypted copy of the newest snapshot is also pulled each morning to a computer we control, outside the hosting provider, so losing the server does not lose your history. Copies there are kept for about 15 days — longer only while the server cannot be reached, or while that computer holds back a key update it could not verify. Each account's data in these snapshots is encrypted with that account's own key. When an account is deleted, its key is destroyed on the server and dropped from the off-site key copy at that computer's next successful update, after which every copy of that account's data there is unreadable.

Because backups exist, deleted data does not vanish from every copy the instant you delete it. It ages out of the backup set as those snapshots roll over — currently within about two weeks.

8. What you can do about all of this

• Export everything. Settings → Your data → Download. You get a zip containing what we hold: your readings, doses, meals, photos, workouts, coach conversations and settings.
• Delete everything. Settings → Your data → Delete my account. You confirm by typing DELETE and entering your password. Deletion is then scheduled seven days out and you can cancel any time within that window by signing in. After it runs, your database, your photos, your credentials and your account are erased, and the copies in backups age out as described above. We cannot undo it.
• Disconnect a device at any time — its stored credentials are deleted immediately.
• Change your password, which signs out every other device.

If you are somewhere with statutory data rights (access, correction, portability, erasure, objection), exercise them by contacting us — but note that export and delete already give you most of them, immediately, without asking permission.

9. Security, honestly

What is true: credentials are encrypted at rest, passwords are stored only as hashes, each account is a physically separate database, traffic runs over HTTPS, and backups exclude secrets.

What is also true: T1Q is early software run by a very small operation. There is no security team, no independent audit, and no bug bounty yet. Nobody can promise a system will never be breached, and we are not going to pretend otherwise. If we discover a breach affecting your data, we will tell you what happened, what was exposed, and when — quickly and in plain language.

10. Children

T1Q is not for people under 18. We do not knowingly collect data from children. If a child's data has ended up here, contact us and we will delete it.

11. Changes to this policy

If we change something that matters — a new place your data goes, a new thing we collect — we will tell you in the app or by email before it takes effect, and you will have time to export and leave.

12. Contact

Email fts19@tyoulabs.com — for questions about this policy, a data request, or anything you think we got wrong. T1Q is provided by TYOU LLC.