sugardash App Privacy Policy
Effective date: September 16, 2026
Overview
sugardash LLC ("sugardash," "we," "us," or "our") provides the sugardash iOS and Android companion apps and physical sugardash display. This policy explains how the app handles information when you create an account, link a sugardash, display glucose information, configure CGM connections, or enable notifications.
sugardash is a secondary display and companion service. It does not measure glucose and is not intended to diagnose, treat, or make treatment decisions. Use your prescribed CGM or blood glucose meter and follow your clinician's guidance.
This app policy applies to the sugardash app, linked sugardash devices, and the companion relay service. Website visits, purchases, checkout, and shipping are covered by the separate sugardash Store Privacy Policy at https://mysugardash.com/policies/privacy-policy.
Information We Handle
Account information, including your name, email address, account identifier, authentication provider, and sign-in tokens.
Linked-device information, including sugardash device IDs, pairing codes, device names, firmware/protocol information, settings, online state, and command status.
Health-related display information, including glucose values, trends, timestamps, alert state, glucose units, and related CGM or pump status displayed by the app or reported by a linked sugardash.
Notification information, including platform push tokens, Firebase installation identifiers on Android, notification permission state, and linked-device alert state.
CGM connection information you provide, such as a CGM account username, password, access token, selected patient or follower identifier, or service region. Reusable app-side credentials are stored in the iOS Keychain or Android Keystore-backed encrypted storage. Supported user connections and preferences are synchronized between apps signed into the same account. Reusable credentials for app-supported CGM connections are encrypted in account-scoped cloud records and on each phone. CareLink synchronization stores setup and identity metadata without a reusable CareLink token. Some credentials may also be sent directly to a sugardash on your local network or carried temporarily by a supported command you request.
Operational information needed to provide and protect the service, such as request results, timestamps, compatibility metadata, and error diagnostics.
The app does not use advertising trackers, sell personal information, or use health information for advertising.
How We Use Information
We use this information only to provide app functionality: authenticate your account, link and identify your sugardash devices, show current device and glucose status, deliver alerts, apply settings or snooze commands you request, troubleshoot reliability and compatibility, prevent unauthorized access, provide support, and delete your account when requested.
CGM Services and Independent Providers
If you connect a CGM-related service, the app or your sugardash communicates with that provider according to the credentials and permissions you supply. Supported services may include Dexcom, LibreLinkUp, Nightscout, Twiist Insiight, CareLink, Sugarmate, Tandem Source, or related services.
For supported services other than CareLink, an app can fetch glucose display data using the connection you add. CareLink sign-in and patient-availability checks happen during setup; afterward, only the single configured physical sugardash fetches CareLink data. Mobile apps do not display CareLink readings. Those providers are independent of sugardash, and their own terms and privacy policies apply. Availability may change, and mentioning a service does not imply sponsorship, endorsement, or an official relationship.
Service Providers
We use service providers to operate the app, including:
Apple for iOS, Sign in with Apple, Keychain, and Apple push notifications.
Google for Android app distribution, Android platform services, Google sign-in when you choose it, and Firebase Cloud Messaging to deliver Android device alerts. Firebase processes installation identifiers and notification tokens. Alert messages sent through Firebase include account/device identifiers, timing information, and alert text that may include a user’s display name and a condition such as high or low glucose. We do not include CGM passwords, raw CGM account usernames, or glucose measurements in Firebase messages. The app does not include Google Analytics or Firebase Crashlytics.
Amazon Web Services for account authentication and the sugardash relay/API, including Cognito, API Gateway, Lambda, DynamoDB, SQS, CloudWatch, Secrets Manager, and related infrastructure.
The CGM or health-data services you choose to connect.
These providers process information only as needed to provide their services, subject to their agreements and privacy terms.
Storage, Security, and Retention
The app stores account sign-in tokens and reusable app-side CGM credentials in the iOS Keychain or Android Keystore-backed encrypted storage. App preferences and sanitized display caches may be stored on your phone. Account-synchronized CGM connection records use authenticated encryption and are separate from live device status. Cloud and supported provider connections use HTTPS; direct communication with a sugardash uses HTTP on your local network. Relay records use account and device identifiers and hashed CGM user keys. Live status records do not retain raw CGM usernames or reusable CGM passwords.
We retain account and linked-device records while your account is active and for as long as reasonably necessary to operate, secure, and troubleshoot the service. Device status is overwritten as new status arrives.
Credentials carried temporarily by a requested relay command are removed when that command completes, fails, expires, or is replaced. The remaining terminal command metadata expires within seven days.
Deleted or overwritten relay records may remain in encrypted disaster-recovery backups for up to 35 days and are not used for normal service operations. Operational logs may remain for a limited period for security and reliability. Legal obligations may require limited records to be retained longer.
Your Choices and Account Deletion
To request deletion without installing or opening the app, use our contact form and write “Delete my sugardash app account.” Include the email address used for your app account so we can identify it and verify the request. Do not send passwords, CGM credentials, or glucose readings. This route also supports access and correction requests. Account deletion does not delete your separate shopping account or reset data stored on physical devices.
You can disable notifications in your phone’s Settings, unlink a sugardash in the app, remove users or credentials from connected devices, and revoke access through a connected CGM provider where that provider supports it. Android uses a Firebase installation identifier while signed in even when notification display permission is disabled. Signing out stops account alert display and attempts to remove the notification registration; Firebase’s own retention terms apply to its installation records.
You can delete your app account in sugardash under Settings > Delete Account. Deletion removes the account's relay profile, device-ownership links, push registrations, account-scoped user records, owned relay status, and queued account or device commands. It then deletes the authentication account where applicable.
To prevent an already-issued sign-in token from recreating deleted cloud data, we retain only an opaque account identifier and deletion and expiry timestamps for up to 31 days. This security-only marker expires automatically.
Device configuration stored on a physical sugardash is not automatically erased. Use the device's reset or unlink controls if you also want to remove data stored on the device.
You may also request access, correction, or deletion through https://mysugardash.com/pages/contact.
Children
The app is intended for use by adults and by caregivers managing a supported setup. It is not directed to children who create their own accounts. A parent or guardian should contact us if they believe a child submitted information without appropriate permission.
Changes
We may update this policy as the app, integrations, or legal requirements change. We will post the updated effective date with the revised policy.
Contact
For privacy questions or requests, contact sugardash LLC through https://mysugardash.com/pages/contact.