Skip to content

Privacy Policy

Last updated: November 2026

1. Data Controller

SugarSmart AI is operated by Starsynq LLC. SugarSmart AI (Starsynq LLC) is the data controller for your personal information. If you have any questions about how we handle your data, contact us at privacy@sugarsmart.ai.

2. What We Collect

We collect the following information:

  • Health data you provide: HbA1c level, diabetes type, weight, height, age, medications, dietary preferences, food restrictions, and pregnancy status (if provided)
  • Glucose readings you log
  • Food and meal logs
  • HbA1c and other lab results you record
  • Account information: name, email address
  • Usage data: pages visited, features used, timestamps
  • Technical data: IP address and device/browser type, recorded with sign-in and security events to protect your account (removed from these records when you delete your account)
  • Chat messages sent to our AI meal planner
  • Meal photos you choose to scan for nutrition analysis
  • Diagnostics: crash reports and app performance data (via Sentry), with your email address and health fields removed before they are sent
  • Device push token, if you enable notifications in the mobile app

3. Legal Basis for Processing

We process your data based on your explicit consent, which you give when you check the disclaimer checkbox when you create your account (or during the assessment on the website). In the mobile app, sending data to our AI providers needs a separate permission, which you can withdraw at any time in Profile → AI processing. You can withdraw all consent at any time by deleting your account.

4. How We Use Your Data

  • Generate personalized meal plans tailored to your health profile
  • Provide AI meal planner chat responses
  • Analyze meal photos you scan to estimate foods, carbs and calories
  • Improve our health-management features using only anonymized, aggregated data (never data that identifies you)
  • Send account and service emails (e.g. email verification, password reset, plan ready)
  • Send a short series of onboarding and tips emails after you sign up. You can unsubscribe from these at any time using the link in each email. These emails never include or use your health data.

5. Who We Share Data With

We share data only with the following service providers, strictly for the purposes described:

  • Anthropic (Claude), Cerebras and Groq — AI processing. Your health profile (such as HbA1c, medications, conditions and goals), your chat messages and meal photos you scan are sent to these providers to generate meal plans, chat answers and photo analysis. In the mobile app this happens only after you allow it, and you can withdraw that permission in Profile.
  • Sentry — Crash reporting and performance diagnostics, so we can find and fix bugs. We remove your email address and health fields from these reports before they are sent.
  • Expo — Delivers push notifications to the mobile app.
  • Stripe — Payment processor for web payments only. They receive only payment information, not health data.
  • Resend — Email provider for account, service and onboarding emails. Resend receives your email address, your name and the content of each email (for example, your weekly meal plan summary if you get plan emails). Onboarding and tips emails never include your health data.
  • Vercel — Hosting provider. Data is encrypted at rest.
  • Neon — PostgreSQL database provider. Data is encrypted at rest.

Each of these providers is contractually required to provide the same or equal protection of your data as described in this policy, and may use it only to provide their service to us.

We do not sell your data to third parties, and we never use your health data for advertising or marketing. We do not show ads or use your data for third-party advertising. We use your email address for account emails and, unless you unsubscribe, for our own onboarding and tips emails about SugarSmart AI. You can unsubscribe at any time using the link in each email, and these emails never include or use your health data.

6. Data Retention

  • Active accounts: Data is retained for as long as your account is active.
  • Deleted accounts: Your personal data is erased immediately when you delete your account. We keep only a minimal deletion record (a one-way hash of your email address and the time of deletion); see Delete your account and data.
  • Backups: Residual copies in encrypted backups are purged within 90 days of account deletion.

7. Your Rights (GDPR Articles 15-22)

You have the following rights regarding your personal data:

  • Right to access — Email privacy@sugarsmart.ai to request a copy of your data.
  • Right to rectification — Edit your profile information at any time.
  • Right to erasure — Delete your account and all associated data in the app (Profile → Danger Zone → Delete my account) or on the website.
  • Right to data portability — Email privacy@sugarsmart.ai to request a copy of your data in a machine-readable format (JSON).
  • Right to restrict processing — Contact us to restrict how we use your data.
  • Right to object — Object to processing of your data for specific purposes.
  • Right to withdraw consent — Withdraw your permission for AI processing at any time in the app (Profile → AI processing), unsubscribe from onboarding emails using the link in any email, or withdraw all consent by deleting your account.

8. How to Exercise Your Rights

You can edit your profile and delete your account directly in the app or on the website (Profile). To request a copy of your data, or for any other request, email privacy@sugarsmart.ai and we will respond within 30 days.

9. Data Security

We take data security seriously. All data is transmitted using industry-standard transport encryption (TLS 1.3). Our database (Neon) and hosting (Vercel) providers encrypt stored data at rest at the infrastructure layer using their default storage encryption. Passwords are hashed with bcrypt. Authentication uses secure JWT tokens with HttpOnly cookies. We implement rate limiting to prevent abuse.

10. International Data Transfers

Your data may be processed in the United States by our hosting (Vercel) and database (Neon) providers. We ensure adequate safeguards are in place through standard contractual clauses (SCCs) with these providers. The AI providers listed in section 5 may also process data in the United States.

11. Cookies

We use essential cookies for authentication and optional analytics cookies with your consent. For full details, see our Cookie Policy.

12. Children

SugarSmart AI is intended for adults aged 18 and over, and is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

13. Medical Disclaimer

SugarSmart AI provides dietary guidance for informational purposes only. It is not a substitute for professional medical advice. Always consult your doctor before making changes to your diet or medications.

14. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of material changes via email. Continued use of SugarSmart AI after changes constitutes acceptance of the updated policy.

15. Contact

For any privacy-related questions or concerns, contact us at privacy@sugarsmart.ai.