Privacy Policy

Effective Date: September 15, 2026

Glypax: GLP-1 Tracker (“Glypax”, the “App”) is developed and operated by Mykhailo-Bohdan Vaskiv, an individual entrepreneur (FOP) registered in Ukraine (“we”, “us”, “our”). We take your privacy seriously, and we built Glypax so that your health data stays on your own device. Please read this Privacy Policy to learn how we treat information about you. By downloading, installing or using the App or any related services (the “Services”), you acknowledge that you accept the practices described below.

Your use of the Services is also governed by our Terms of Use, which incorporate this Privacy Policy. Capitalized terms not defined here have the meaning given to them in the Terms of Use.

We may update this Privacy Policy from time to time as the Services evolve. When we do, we will post the updated version at this address and change the “Effective Date” above. Continued use of the Services after a change takes effect means you accept the updated Privacy Policy.

If you live in Washington, Nevada or Connecticut, please also read our Consumer Health Data Privacy Policy, which supplements this Privacy Policy for consumer health data.

The Short Version

No account, no login. You do not create an account. The App keeps an anonymous local profile on your device.
Your health data stays on your phone. Medications, doses, side effects, measurements, nutrition logs, notes and photos are stored only on your device. We do not upload them to our servers, and we do not have servers that hold them.
What does leave your device is limited to anonymous crash reports, anonymous usage analytics and in-app purchase information, processed by the service providers listed below.
If you contact support, we receive what you choose to send us (for example your email address or WhatsApp number and your message).
If you choose to subscribe to email updates, we keep your email address to send you news and offers about the App. Subscribing is optional, and every email has an unsubscribe link. We never link your email address to your health data.
We do not sell your data and we do not share it for advertising.
You are in control. You can delete everything from inside the App at any time, or by uninstalling it.

What This Privacy Policy Covers

Glypax is a self-tracking tool that helps you record and review your GLP-1 medication schedule, doses, side effects, body measurements and daily protein, fiber and water intake. We are not a medical provider, we do not provide medical advice, and we are not a “covered entity” or “business associate” under the U.S. Health Insurance Portability and Accountability Act (“HIPAA”). Information you record in the App is therefore not “protected health information” under HIPAA. It may, however, be considered health data, sensitive data or consumer health data under other laws, and we treat it with corresponding care.

“Personal Data” means any information that identifies, relates to, or could reasonably be linked to a particular individual, including information referred to as “personal information”, “personally identifiable information” or “sensitive personal information” under applicable privacy laws.

Categories of Personal Data We Collect

The table below describes the categories of Personal Data the App handles, where each category is stored, why it is used, and with whom it is disclosed. Data marked “On your device only” never reaches us or any third party through the App.

Category (and examples)	Where it is stored	Purpose(s)	Disclosed to
Profile Data such as the name or nickname you choose, date of birth, gender, height and starting weight.	On your device only	Providing and personalizing the Services (for example, calculating nutrition goals, addressing you by your nickname)	No one. Only a derived age bracket and gender may be sent to our analytics provider as described under “Analytics Data” below.
Health Data such as GLP-1 medication name, dose, dosing schedule, injection site and time, medication supply, side effects and symptoms, weight, body measurements (biceps, calf, chest, hips, thigh, waist), protein, fiber and water intake, and text notes you write.	On your device only	Providing the Services	No one
Photos such as progress photos you choose to add.	On your device only	Providing the Services	No one
App Settings and Preferences such as units of measurement, reminder times and appearance settings.	On your device only	Providing the Services	No one
Device and Technical Data such as device model, operating system version, App version, language, region, time zone, screen size, and pseudonymous installation identifiers generated by the software development kits (“SDKs”) listed below.	Processed by our service providers	Fixing crashes and bugs; keeping the Services working; understanding how the Services are used	Service Providers (Google Firebase, RevenueCat)
Crash and Diagnostic Data such as crash logs, stack traces, device state at the time of a crash, and non-fatal error reports.	Processed by our service providers	Fixing crashes and bugs; improving stability	Service Providers (Firebase Crashlytics)
Analytics Data such as which screens and features you use, how often you open the App, when you start a free trial or purchase a subscription, and — if you have entered them in your profile — your age bracket (not your date of birth) and gender as pseudonymous user properties. Analytics events never contain your medication names, doses, measurements, nutrition values, notes or photos.	Processed by our service providers	Understanding how the Services are used; improving and developing the Services	Service Providers (Google Analytics for Firebase)
Purchase Data such as subscription status, product purchased, purchase and renewal dates, free-trial status, price and currency, and a pseudonymous purchaser identifier. We never receive your payment card number, billing address or App Store / Google Play account credentials.	Processed by our service providers and the app stores	Providing the paid features you purchased; managing subscriptions and trials; detecting fraud	Service Providers (RevenueCat); Apple App Store and Google Play as independent parties
Support and Communication Data such as your email address; if you contact us on WhatsApp, the phone number, profile name and profile photo associated with your WhatsApp account; the contact name you give us; the content of your messages; any screenshots or files you choose to send; and, when you open a support chat from the App, a prefilled message containing the App version, your platform (iOS or Android) and a technical installation identifier.	In our email account and, where offered, our WhatsApp Business account	Responding to you; providing support; improving the Services	Service Providers (Google for email; Meta Platforms for WhatsApp)
Email Subscription Data such as the email address you enter if you choose to subscribe to email updates, the date and source of your subscription, your subscription status, and standard delivery information recorded by our email provider (for example whether an email was delivered, opened or a link in it was clicked).	With our email delivery provider	Marketing the Services (sending news and offers you asked for)	Service Providers (email delivery provider)

We do not collect precise geolocation, contacts, advertising identifiers, or any biometric data.

Our Purposes for Collecting Personal Data

Providing, personalizing and improving the Services
- Storing and displaying the medication, health and measurement records you create.
- Personalizing the App (for example, showing your nickname, converting units, and calculating protein, fiber and water goals from your profile).
- Providing the paid features you purchased.
- Providing support and assistance for the Services.
- Improving the Services, including testing, research, internal analytics and product development.
- Detecting, preventing and fixing crashes, bugs and security issues.
Corresponding with you
- Responding to messages you send us and contacting you when you ask us to.
Marketing the Services
- Sending news about the App, new features and promotional offers by email to people who have chosen to subscribe.

We do not use your Personal Data for third-party advertising, we do not send marketing emails to anyone who has not subscribed, and we do not use your Personal Data to train artificial-intelligence models.

Other Permitted Purposes for Processing Personal Data

To the limited extent we hold Personal Data about you, we may also use or disclose it where required to meet legal obligations or to enforce our legal terms, including: complying with applicable law, regulation, court order or other legal process; preventing, detecting and investigating security incidents, fraud and illegal or prohibited activities; protecting the rights, property or safety of you, us or others; enforcing any agreement with you; and resolving disputes.

We will not collect additional categories of Personal Data or use the Personal Data we have collected for materially different, unrelated or incompatible purposes without giving you notice or obtaining your consent.

Categories of Sources of Personal Data

You
- When you enter information directly into the App (profile, medications, doses, measurements, nutrition, notes, photos).
- When you contact us by email, WhatsApp or another messenger.
- When you choose to subscribe to email updates.
- When you use the App and technical, crash and usage information is collected automatically by the SDKs described below.
Third parties
- Apple App Store and Google Play, which tell us (through RevenueCat) whether a purchase, trial or renewal has occurred.

The App does not currently read from or write to Apple Health, Health Connect or any other health platform. If we add such an integration in the future, it will be optional, will require your explicit permission on your device, and we will update this Privacy Policy before it goes live.

Data Stored on Your Device

All Profile Data, Health Data, Photos, notes and App settings are stored locally on your device in the App's private storage. We do not operate servers that receive, store or synchronize this data, and we cannot access it. As a result, please keep the following in mind:

Device backups. Depending on your operating system settings, the App's data may be included in device backups you control (for example iCloud Backup on iOS or Google backup on Android). Those backups are governed by Apple's or Google's privacy terms and your own settings, not by us.
Export and import. The App may let you export your data (including photos) to a file such as a JSON file or ZIP archive, and import it on the same or another device. An exported file contains your health data in readable form. You are responsible for where you store or share it.
Loss of device or deletion. If you lose your device, uninstall the App, or delete your data in the App, we cannot recover it. Use export or device backups if you want to keep a copy.
Sharing screens or files with us. If you choose to send us a screenshot, an export file or other content when asking for support, we will receive whatever it contains.

How We Disclose Your Personal Data

We disclose Personal Data only to the categories of recipients listed here.

Service Providers. Companies that process data on our behalf to help us run the Services, including crash reporting and analytics providers, subscription-management providers, the email and messaging services we use to communicate with you (including WhatsApp, operated by Meta Platforms), and the email delivery provider that sends email updates to subscribers on our behalf. They may use the data only to provide services to us and under their own privacy commitments.
App stores. Apple and Google process your purchases independently under their own terms and privacy policies.
Legal obligations. Authorities or other parties where required by law or as described under “Other Permitted Purposes for Processing Personal Data”.
Business transfers. If the App or our business is sold, transferred, merged or reorganized, the limited Personal Data we hold (for example support correspondence and pseudonymous analytics and purchase data) may be transferred to the successor. The successor will be bound by this Privacy Policy unless you are notified otherwise.
Parties you authorize. If you choose to share an export file, a screenshot or other content with anyone, that sharing is under your control.

We do not sell Personal Data, and we do not share Personal Data for cross-context behavioral or targeted advertising.

Aggregated and de-identified data

We may create and use aggregated, de-identified or anonymized data (for example, the percentage of users who use the measurements feature) for lawful business purposes, including analyzing, building and improving the Services and describing our business, provided we will not disclose such data in a way that could identify you.

Third-Party Services Used by the App

The App includes the following third-party SDKs. Each provider processes data under its own privacy policy, linked below.

Google Play Services — required system services on Android devices.
Google Analytics for Firebase — anonymous usage analytics as described under “Analytics Data”.
Firebase Crashlytics — crash and error reporting.
RevenueCat — in-app subscription and purchase management.

These providers may process data on servers located in the United States and other countries. See “Information for Users in the EEA, United Kingdom and Switzerland” for information on international transfers.

If we add new third-party services in the future (for example, an advertising SDK or a health-platform integration), we will update this list before they are included in a released version of the App.

Services we use to communicate with you

These services are not built into the App; they are used only if you contact us.

Google (Gmail) — email support.
WhatsApp Business (Meta Platforms) — support chat, where offered.
An email delivery provider — used only to send email updates to people who subscribed, as described under “Email Updates (Optional)”.

Contacting Support

You can contact us by email at start.app.gear@gmail.com or, where the App offers it, through a WhatsApp Business chat. If you tap “Contact Support” and choose WhatsApp, the App opens WhatsApp on your device with a prefilled message containing the App version, your platform and a technical installation identifier so that we can help you faster; you can edit or delete this message before sending it. No health data is included in the prefilled message. WhatsApp is operated by Meta Platforms under its own privacy policy and terms; by messaging us on WhatsApp you share with us the phone number, profile name and profile photo associated with your WhatsApp account. If you prefer not to use WhatsApp, email is always available. Access to support conversations is limited to the developer and anyone authorized to provide support on our behalf. We use support conversations only to help you and to improve the Services; we do not use them for marketing, and nothing said in a support conversation is medical advice.

Email Updates (Optional)

Where the App offers it, you may enter your email address to receive news about Glypax, such as new features, tips and promotional offers. This is entirely optional: the App works fully without it, and we never require an email address to use any feature, free or paid.

Opt-in only. We add you to the list only when you enter your email address and confirm that you want updates. We do not pre-tick boxes, and we do not take your email address from any other source.
Unsubscribe any time. Every email we send contains an unsubscribe link, and you can also unsubscribe by emailing start.app.gear@gmail.com. We process unsubscribe requests promptly and without charge.
Not linked to your health data. Your email address is stored with our email delivery provider, separately from the App. The App does not send your medication records, measurements, nutrition logs, notes, photos or profile details together with your email address, and we do not personalize email content based on them.
What we know. Our email delivery provider records standard delivery information such as whether an email was delivered, opened or a link was clicked, so that we can see which topics readers find useful and stop sending to addresses that no longer work.
Never sold or shared for others' marketing. We do not sell subscriber email addresses or share them with third parties for their own marketing.

Emails from us identify who sent them and how to contact us. If we run a promotional offer by email, the terms of that offer are stated in the email or in the App.

Notifications

The App can send you local notifications and reminders (for example, a reminder that a dose is due). These are scheduled and delivered on your device; no reminder content is sent to us. If we add server-delivered push notifications in the future, a pseudonymous device push token will be processed by a push-notification service such as Firebase Cloud Messaging so that messages can be delivered to your device. You can enable or disable notifications at any time in the App or in your device settings.

Website and Cookies

The App itself does not use cookies. This Privacy Policy, our Terms of Use and our Consumer Health Data Privacy Policy are hosted on a simple web page. The hosting provider may set its own essential cookies and collect standard server logs under its own privacy policy; we do not place tracking cookies or advertising cookies on that page. Because we do not track visitors across sites, we do not respond to browser “Do Not Track” signals in any particular way.

Data Security

The App stores your data in its private, sandboxed storage on your device, protected by your device's operating-system security, including the passcode, biometric lock and disk encryption you have enabled. Because your health data does not leave your device through the App, the most important security measures are the ones you control: keep your device locked, keep the operating system updated, and protect any export files you create. For the limited data processed by our service providers, we rely on providers with industry-standard technical and organizational security measures and encrypted connections. No method of storing or transmitting data is completely secure, and we cannot guarantee absolute security.

Data Retention and Deleting Your Data

Data on your device is retained until you delete it. You can delete individual records, or delete your entire profile and all data at once from the App's settings. Uninstalling the App also removes its local data (a copy may remain in device backups you control).
Crash and analytics data is retained by Google Firebase in accordance with the retention settings of our Firebase project (Google's documented default for user-level analytics data is 14 months) and then deleted or aggregated.
Purchase data is retained by RevenueCat and the app stores for as long as necessary to manage your subscription, handle refunds and disputes, and meet accounting and legal obligations.
Email subscription data is retained until you unsubscribe or ask us to delete it. After you unsubscribe, we may keep your email address on a suppression list solely to make sure we do not email you again.
Support correspondence (email and WhatsApp) is retained for as long as reasonably necessary to help you and to keep a record of the request, and then deleted. You can also delete a WhatsApp chat on your side at any time, subject to WhatsApp's own functionality.

If you want us to delete Personal Data held by our service providers that is linked to your installation (for example, analytics or purchase records), contact us using the details below. Because the App has no accounts, we may need technical details from the App (such as an installation identifier shown in its settings, where available) in order to locate your data, and we may be unable to locate data that cannot be linked to you.

Personal Data of Children

The Services are intended for adults. We do not knowingly collect or solicit Personal Data from anyone under 18 years of age, and you may not use the Services if you are under 18. If we learn that we have collected Personal Data from a person under 18, we will delete it as quickly as possible. If you believe a person under 18 may have provided Personal Data to us, please contact us at start.app.gear@gmail.com.

Information for Users in the EEA, United Kingdom and Switzerland

If you are located in the European Economic Area, the United Kingdom or Switzerland, this section applies to you in addition to the rest of this Privacy Policy.

Controller

The controller of Personal Data processed through the Services is Mykhailo-Bohdan Vaskiv, individual entrepreneur, Lviv, Ukraine, contact: start.app.gear@gmail.com. Data that is stored only on your device and never transmitted to us is processed by you for your own personal purposes, and we do not act as a controller of it.

Legal bases

Performance of a contract (Art. 6(1)(b) GDPR): providing the App and the paid features you purchased, and responding to your support requests.
Legitimate interests (Art. 6(1)(f) GDPR): crash reporting, keeping the Services secure and working, preventing fraud, and understanding how the Services are used in aggregate so that we can improve them. Our legitimate interests are operating and improving a reliable app; you can object to processing based on legitimate interests as described below.
Consent (Art. 6(1)(a) GDPR): where required by law, for example for optional analytics, for age bracket and gender user properties, for receiving email updates, and for any future health-platform integration. You can withdraw consent at any time in the App's settings, through the unsubscribe link in any email, or by contacting us.
Legal obligation (Art. 6(1)(c) GDPR): keeping records required by tax, accounting or other laws.

Special category data

Medication, health and body-measurement information you record is “special category” data under Art. 9 GDPR. This data stays on your device and is not transmitted to us. To the extent you choose to send such information to us (for example in a support message or an export file), we process it on the basis of your explicit consent (Art. 9(2)(a) GDPR), solely to help you, and we delete it when it is no longer needed.

International transfers

We are located in Ukraine, and our service providers (Google, RevenueCat, Meta Platforms) may process data in the United States and other countries. Where Personal Data is transferred outside the EEA, the UK or Switzerland, we rely on an adequacy decision, on Standard Contractual Clauses (or the UK International Data Transfer Addendum) entered into with the provider, or on another lawful transfer mechanism. Each of these providers publishes its transfer safeguards in the privacy documentation linked above.

Your rights

Subject to applicable law, you have the right to access, rectify, erase and receive a portable copy of your Personal Data, to restrict or object to its processing, to withdraw consent at any time (without affecting processing that occurred before withdrawal), and to lodge a complaint with a supervisory authority, in particular in the EU member state, or the UK, of your habitual residence, place of work or the place of an alleged infringement. Data stored only on your device can be accessed, corrected, exported and deleted directly in the App. For data held by our service providers, contact us using the details in “Contact Information”.

Automated decision-making

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

U.S. State Privacy Rights

Depending on where you live in the United States (for example California, Colorado, Connecticut, Delaware, Iowa, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah or Virginia), you may have some or all of the following rights, subject to conditions and exceptions under the applicable law. Whether a particular state law applies to us depends on thresholds set by that law; regardless, we will honor the following requests as a matter of practice.

Access: to confirm whether we process Personal Data about you and to obtain a copy of it, including, for Oregon residents, a list of the specific third parties to which we have disclosed Personal Data.
Deletion: to have Personal Data we hold about you deleted.
Correction: to have inaccurate Personal Data corrected.
Portability: to receive a copy of your Personal Data in a portable and, where technically feasible, readily usable format.
Opt-out: to opt out of the sale of Personal Data, of sharing for targeted advertising, and of profiling in furtherance of decisions with legal or similarly significant effects. We do not engage in any of these activities, so there is nothing to opt out of.

Sensitive personal data

Health-related information you record in the App may be “sensitive” under some state privacy laws. It is stored only on your device and is not collected by us. The only sensitive Personal Data we may receive is health-related information you choose to include in a support message; we use it only to help you and delete it when no longer needed. We do not sell sensitive Personal Data or use it for advertising or profiling. If you are a California resident, our use of any sensitive personal information is limited to the purposes permitted under section 7027(m) of the CCPA regulations.

Anti-discrimination

We will not discriminate against you for exercising your privacy rights. We will not deny you the Services, charge different prices, or provide a different level of quality because you exercised a right.

Other state-specific notices

Under California Civil Code Sections 1798.83–1798.84 (“Shine the Light”), California residents may ask about disclosures of Personal Data to third parties for their direct marketing purposes; we do not make such disclosures. We do not sell Personal Data as “sale” is defined in Nevada Revised Statutes Chapter 603A. Our email updates comply with the U.S. CAN-SPAM Act: they identify the sender, include a working unsubscribe mechanism, and we honor opt-out requests promptly.

Exercising Your Rights

Most of your data is on your device, where you can view, edit, export and delete it yourself in the App. To exercise rights regarding the limited data held by us or our service providers, email us at start.app.gear@gmail.com with (1) a description of your request and (2) enough information for us to locate the data, which may include technical details from the App's settings (where available) and, for support correspondence, the email address or WhatsApp number you used. Because we do not hold accounts or names, this identifier is usually the only way we can link data to you. We may ask follow-up questions to verify a request. A request that meets these criteria is a “Valid Request”. We will respond within the time required by the applicable law. We will not charge a fee for a Valid Request unless it is excessive, repetitive or manifestly unfounded, in which case we will tell you before proceeding.

Residents of states that allow it may authorize an agent to submit a request on their behalf; we may ask for written proof of that authorization.

Appeals. If we decline to act on your request and you live in a state that provides a right to appeal (for example Colorado, Connecticut, Delaware, Iowa, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas or Virginia), you may appeal by replying to our decision and stating the basis of your appeal. We will respond within the period required by law. If we deny your appeal, you may contact your state Attorney General.

Contact Information

If you have questions or comments about this Privacy Policy, how we handle Personal Data, or your choices and rights, please contact us:

Mykhailo-Bohdan Vaskiv, individual entrepreneur (FOP)
Lviv, Ukraine
Email: start.app.gear@gmail.com