FlosForge Glucose — privacy policy

FlosForge Glucose has no internet permission and no network code, so your readings, notes and meal photos cannot leave the phone through the app. They are stored encrypted, excluded from cloud backups, and every statistic is calculated on the device. There is no account, no analytics and no advertising.

What FlosForge Glucose collects about you

Nothing. There is no account, no telemetry, no analytics, no crash reporting and no identifier of any kind. The app has no server of its own to send anything to, and it does not phone home to check for updates — Google Play delivers new versions.

What it stores, and where

An encrypted database on the phone: Readings, tags, reminders and targets, in a database encrypted with SQLCipher. Its random key is protected by a key held in the Android Keystore.
Meal photos, encrypted: Re-encoded to drop location and other metadata, reduced to 1600 pixels, and encrypted with a Keystore key before they are written.
Your settings: Unit, targets, reminders, appearance, and the name for reports if you give one. An app-lock PIN is stored only as a salted hash.
Left out of backups: Every part of the app’s storage is excluded from Google’s cloud backup and from device-to-device transfer. To move to a new phone, use the app’s own password-protected backup.

Everything it can connect to

The app has no internet permission. These are the only things outside it that it ever reaches, and each one is something you choose.

Health Connect, if you turn it on: Off by default. You choose whether the app writes your readings to Health Connect, reads other apps’ glucose readings from it, or both. It only syncs while the app is open. Health Connect is part of Android and keeps its data on the phone; which other apps can see it is controlled in Health Connect.
The camera app: A meal photo is taken by your phone’s own camera app and handed back. The app has no camera permission of its own.
Files you save or share: PDF reports, CSV exports and backups go only where you put them through the system’s save dialog.
Links you tap: The developer link opens flosforge.eu in your browser. The app itself opens no connection.

What never leaves your phone

No reading, note, photo or statistic is transmitted by the app.
Insights are calculated on the phone, not by a cloud service or an AI model.
No analytics, no crash reporting, no advertising, no account.
Reminders and the lock-screen never show a glucose value, and the widget hides its values while the app lock is on.

Safeguards

Encrypted at rest: The database and the photos are encrypted with keys that stay in the Android Keystore.
Encrypted backups: A backup file is encrypted with AES-256-GCM under a key derived from your password, so the file alone reveals nothing.
App lock: A 4 to 8 digit PIN with fingerprint or face unlock, a lockout after repeated wrong guesses, and screenshots and the recent-apps preview blocked while it is on.
Deleting is deliberate: Delete all data asks you to type DELETE first, and removes every reading and photo from the phone.

Your rights, and who to ask

Because the app holds nothing about you, there is nothing for the controller to access, correct or erase on your behalf: everything it knows is in files on your own phone, under your own control. Uninstalling the app deletes its database, photos and settings from the phone. Readings you shared with Health Connect stay there until you delete them in Health Connect. Reports, CSV files and backups you saved are yours to delete. For anything else, write to hello@flosforge.eu. The site-wide privacy policy covers this website, your rights under the GDPR, and the supervisory authority you can complain to.

Changes

This statement is checked against each release. If a version changes what the app stores or what it can connect to, the version and date at the top change with it.