Legal

Privacy Policy

Last updated: October 2026

🔒 GlucoTV is built with privacy first. We collect only the data listed on this page, which we use to deliver your glucose data and run your account.

What We Collect

GlucoTV collects the following to operate the service:

  • Your email address and authentication provider (when you create an account), and the date and version of the Terms of Service you accepted
  • Your Dexcom credentials and Share session token (both encrypted), or your Nightscout URL and, if your site requires one, your Nightscout API secret or access token (encrypted)
  • Your most recent glucose reading and trend, and about a day of recent readings (see Data Storage)
  • A unique session identifier for each paired device, the short-lived code shown on your TV while you pair it, and the time each paired session last requested readings (so we can tell which sessions are still in use, and so your account page can show you when each one was last used)
  • Your subscription details: a Stripe customer ID, a subscription ID, your subscription status, and your renewal and cancellation dates (payment details are handled by Stripe — we never store card details)
  • A one-way fingerprint of the email address used for a free trial, so the same address cannot start a second trial. It contains no email address and cannot be turned back into one; it is kept after an account is deleted
  • Display settings you save from your account page or viewer — units (mg/dL or mmol/L), glucose thresholds and alert settings — stored on your session; your Roku also keeps a local copy of its session identifier and display settings (units, thresholds, CGM type and the chart range you last chose) in its own storage, and the GlucoTV Screensaver keeps the style you chose for it
  • Names you give to devices, profiles and share links, the Dashboard group you put each of your devices and followed links in, which of your devices you've switched off for the Dashboard, and the time zone of your browser when you set up a scheduled share link
  • Any email address you enter during desktop setup to receive your viewer link
  • Your choice of whether to receive email updates
  • Referral details: your own referral code, the code you redeemed, which account referred which, and the credits applied to a bill (with their Stripe transaction ids)

What We Do Not Collect

  • Your Dexcom password stored in plaintext — it is encrypted before being written to our database
  • Payment card details — these are entered on Stripe's checkout page and never reach our servers
  • Your device's location (GPS or similar) — we never request it
  • Advertising or third-party analytics trackers — we use none. We do record when each paired session last requested readings, so we can tell which sessions are still in use

Accounts

You need an account to connect your own CGM to GlucoTV. When you create an account we collect your email address and the authentication method you used (email/password or Google sign-in). This information is used to authenticate you and manage your subscription, including checking whether the email address has already used a free trial. If you opt in, it is also used to send occasional product updates.

Account authentication is handled by Firebase Authentication (Google). Your password, if you use email/password sign-in, is never stored by GlucoTV — it is managed entirely by Firebase and is never visible to us.

Read-only view links you share with caregivers or teachers do not require an account. We do not ask viewers for personal information or save anything about them in our database. (As with any website, the viewer's browser contacts our servers and the providers of the fonts and chart library the page loads.)

Subscriptions & Billing

Subscription payments are processed by Stripe. When you subscribe, Stripe collects and stores your payment information. GlucoTV stores only a Stripe customer ID, a subscription ID, your subscription status and your renewal and cancellation dates — we never store or have access to your full card number or security code (CVV).

These details are stored in our database associated with your account. You can cancel an active subscription at any time using Manage Subscription on your account page, which opens Stripe's billing portal.

Email Communications

We send only transactional emails: password reset emails (sent through Firebase Authentication) and, if you enter an email address during desktop setup, an email with your viewer link to each address you list. Stripe may also email you payment receipts. We do not send marketing emails unless you explicitly opt in. You can opt in or out of email updates at any time from your account settings.

How Your Data Is Used

Your CGM credentials are used only to retrieve your glucose readings from Dexcom or Nightscout (including in the background, to keep your recent history up to date), so they can be shown on your paired Roku, in your browser view and through any view links you share. Your email is used for authentication and transactional messages, to check whether the address has already used a free trial, and, only if you opt in, for occasional product updates.

We do not sell your data. We share it only with the service providers needed to run GlucoTV (listed under Third-Party Services), with Dexcom or your Nightscout site to retrieve your readings, and with the people you choose to send a view link to.

Dexcom Share

GlucoTV connects to Dexcom using Dexcom's Share feature — the same feature that allows caregivers to follow a person's glucose in real time. When you pair, you enter your Dexcom username and password directly in your browser over HTTPS.

Your credentials are encrypted using Fernet symmetric encryption (AES-128 with HMAC-SHA256 authentication) before being written to our database. The encryption key is stored separately in Google Secret Manager and is never co-located with your data. This means that even if our database were compromised, your credentials would be unreadable without the encryption key.

Your username and password are decrypted in memory when GlucoTV has to log in to Dexcom Share again — when it has no session token, or Dexcom stops accepting the one it has. They are also decrypted once, the first time each connection reads in each server process, to tell which connections use the same Dexcom login, so that the same reading is not requested from Dexcom several times over; for that, a keyed one-way hash of the login is kept in the server's memory only. It is never written to our database or logs, and it is gone when the server restarts. The plaintext credentials are used for the login or to make that hash and are then discarded. They are never logged or written anywhere in plaintext. The session token itself is also stored encrypted, and is decrypted in-memory each time we request your readings.

Nightscout

When connecting Nightscout, you provide your Nightscout site URL directly. GlucoTV uses this URL to poll your Nightscout instance for glucose readings and threshold settings. Your Nightscout URL is stored in our database, without the extra encryption we apply to credentials, and is used only to fetch your data. If your site requires an API secret or access token, it is encrypted in the same way as Dexcom credentials (see above) before being written to our database, and is used only to read your data from your site.

GlucoTV Screensaver

The GlucoTV Screensaver is a separate Roku screensaver that shows the readings of the GlucoTV channel paired on the same Roku. It has no account or pairing of its own:

  • It reads the session identifier the GlucoTV channel saved on your Roku, and the units the channel was set to, which it uses only if no units are saved on your account. Roku lets it read these because both come from the same developer.
  • While it is on screen, it sends that session identifier to GlucoTV over HTTPS to get your latest reading about once a minute, and your units and thresholds about every 10 minutes. These are the same requests the channel makes, and like the channel's they count as the session being in use.
  • It saves one thing on your Roku: the style you choose for it (Minimal Dark, Ambient Glow, Float or Clock Combo).

It does not read or send anything else from your Roku, and it does not show or use anything from the programs you watch.

Data Storage

Session and account data is stored in Google Cloud Firestore, in Iowa (the us-central1 region) in the United States. Our data is stored with Google Cloud, which encrypts stored data at rest and publishes independent SOC 2 audit reports for its infrastructure.

Your glucose reading history is kept per session for about a day (readings older than 26 hours are removed by a clean-up that runs about once an hour) to support the 3, 6, 12 and 24-hour chart views. Your most recent reading and the three hours of values before it stay on your session record for as long as the session exists.

Display preferences such as units, threshold values, and alert settings are stored on the session in our database so that all viewers of a shared link see consistent settings. Your Roku also keeps a local copy of its session identifier and display settings in its own storage, and the GlucoTV Screensaver keeps the style you chose for it. Pairing codes are shown on your TV and stored in our database; a code stops working after 10 minutes.

Data Retention

Session data is kept until you delete your account or the session is removed. An hourly clean-up removes sessions that no TV or viewer has requested readings from for 90 days, and sessions whose paid period has ended after an account was deleted. Account data is kept while your account exists.

You can delete your account at any time with Delete Account on your account page, or by contacting support@glucotv.com. Deleting cancels every subscription first (if we cannot confirm one was cancelled, nothing else is deleted and you can try again), then removes your account record and sign-in, your profiles, your group view link, the share links you created or follow, your Dashboard settings, your referral code and referral records, your Stripe customer record, and the devices linked to your account (including any you have unlinked since this was introduced), together with their stored credentials and readings. If you have no subscription - paid or in its free trial - this happens straight away. If you have, the devices keep working until the end of the period you have already paid for and are then removed; the email addresses and share links attached to them are removed straight away, and after that date they no longer show readings. If part of a deletion fails, the rest stays to be finished the next time you press Delete.

What deletion does not remove: a one-way fingerprint of the email address used for a free trial (so a deleted account cannot claim another trial; it holds no email address); Stripe's own payment and tax records, which it keeps as the law requires; server logs and backups until their retention periods end; and emails we have already sent. A referral reward that is still waiting to be paid to the person who referred you is kept, with no name or email, until it is paid; settled ones are removed. Devices paired before accounts were linked to devices are not tied to an account, so deleting an account cannot find them — email us and we will delete them.

When a subscription or trial ends without the account being deleted, the account and its devices stay in our database but stop showing readings. Devices that no TV or viewer has requested readings from for 90 days are removed by our regular clean-up.

Third-Party Services

GlucoTV uses the following third-party services to operate:

  • Firebase Authentication (Google) — account authentication
  • Google Cloud Firestore — data storage
  • Google Cloud Run — backend infrastructure
  • Stripe — subscription billing
  • Google Secret Manager — storage of the encryption key and other service secrets
  • Gmail — sending the desktop viewer-link email

To fetch your readings, GlucoTV also connects to Dexcom or to your own Nightscout site. Our pages load fonts from Google Fonts and a chart library from a public CDN (cdnjs or jsDelivr).

Each of these services operates under its own privacy policy. We send Stripe only your email address and account ID, and Google (Firebase, Firestore, Cloud Run) only the data needed to sign you in, store your data and run the service. The desktop link email is sent through Gmail to the addresses you enter.

Security

Connections between your browser or Roku and GlucoTV, and from GlucoTV to Dexcom, Google and Stripe, use HTTPS. GlucoTV connects to your Nightscout site at the address you enter, so use an https:// address — an http:// address is not encrypted. Dexcom and Nightscout credentials, and the Dexcom login tokens we hold, are stored encrypted.

Session identifiers are random UUIDs, which cannot realistically be guessed. Anyone who has your viewer link can see your readings, so share it only with people you trust. Requests for glucose readings are rate limited per session, and repeated incorrect referral codes are throttled per account.

Children's Privacy

GlucoTV is designed for use by parents, caregivers, and adults managing diabetes. You must be 18 or older to create an account, unless you are a parent or legal guardian creating an account on behalf of a minor. We do not verify age; by accepting the Terms of Service when you sign up, you confirm that you meet this requirement. We do not knowingly collect personal information directly from minors.

Medical Disclaimer

GlucoTV is for informational purposes only and is not intended for use in medical treatment decisions. Always confirm glucose readings with an approved medical device and consult your healthcare provider before making any treatment decisions.

Changes to This Policy

We may update this privacy policy from time to time. Any changes will be reflected on this page with an updated date. Continued use of GlucoTV after changes are posted constitutes acceptance of the updated policy.

Contact

For any privacy concerns, data deletion requests, or questions about this policy please contact us at support@glucotv.com