Acilar Studio

GlucoFit Privacy Policy

Last edited:

Draft. This document is a draft and is not yet in force. Missing details still have to be added and it needs a legal review.

This policy covers the GlucoFit app. The Acilar Studio website has a separate policy and does not collect glucose records.

1. Data controller

The data controller is publisher's legal name, registered address, company number, if applicable. Contact for questions and requests about personal data: public contact email.

Data protection officer — state whether one is appointed and how to reach them.

2. Guest mode (current version)

In the current version, everything you enter (glucose, meals, workouts, targets) is stored only in your browser's local storage. It is not sent to our server and the publisher cannot access it.

You can delete it at any time by clearing the site's data in your browser.

3. Account and cloud storage (in development)

Account data: email, hashed password, settings and a self-declaration of being 18 or over. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).

Health data (glucose, meals, activity, sleep) is stored in the cloud only after separate explicit consent (GDPR Art. 9(2)(a)). Consent is given on its own screen, with an unticked box, and is not a condition of accepting the terms.

You may withdraw consent at any time. Cloud saving stops immediately, and you choose whether to export and delete your cloud data or your whole account. The app keeps working locally.

Data is stored in the EU (Supabase, Frankfurt region). Confirmation emails are sent through email provider. Emails never contain health data.

4. What we do not do

No ads, analytics or trackers. We do not sell health data or share it with third parties for marketing. We never put health data in URLs, logs or emails.

5. Retention

Cloud data is kept while you have an account, or until you withdraw consent and ask for deletion. Backups are deleted after backup retention, planned 7 days. Inactive account policy: period and measure after legal review.

6. Your rights

Under the General Data Protection Regulation (GDPR) you have the right of access, rectification, erasure, restriction of processing, data portability and objection, and you may withdraw consent at any time without affecting processing carried out before the withdrawal.

Send requests to public contact email. We reply within one month.

You may lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP) or with the supervisory authority in the country where you live.

7. Changes to this document

If we make material changes we will update the last-edited date and, where needed, tell you in the app. Describe how users of each app are notified.