GLPily
Privacy Policy
Last updated October 27, 2026
GLPily ("GLPily", "we", "us"), 1025 E Hallandale Beach #15-1655, Hallandale Beach, FL 33009, operates the GLPily apps and website (the "Service"). This policy explains what we collect when you use the Service, why, and the choices you have. GLPily is a self-tracking companion for people using GLP-1 medications. It is not a medical device and does not provide medical advice.
1. What we collect
Account data
Email address, display name and authentication identifiers from Sign in with Apple, Google Sign-In or email/password. We never see your Apple or Google password.
Health and wellness data you enter
Everything you log is stored so it can sync across your devices: weight, body measurements, injections (medication, dose, time, site, status), nutrition and water, symptoms, daily check-ins (appetite, food noise, energy, stomach comfort), journal entries, goals and reminders. This is sensitive data and we treat it as such (see Section 5).
Apple Health and Health Connect
If you connect Apple Health or Health Connect, GLPily reads your weight records and your daily activity totals (steps, walking distance, active energy, exercise minutes) and, if you enable it, writes the weights you log in GLPily. Activity is read-only and stored as one total per day. We use this data only to provide the app's features. We never use Apple Health or Health Connect data for advertising, marketing, or data-mining, never sell it, and never share it with third parties except as needed to sync it to your own GLPily account. You can revoke access at any time in the Health app or Health Connect settings.
Photos
Progress photos you add are stored in private, encrypted storage tied to your account. When you create a Your New Era image, the photo(s) you select, together with a short text description of the requested change (for Your New You, this includes your goal weight), are transmitted to our AI image provider (currently OpenAI) solely to generate the image you requested. Under our agreement with the provider your photos are not used to train models. The generated image is stored privately in your account. If you use Your New Era (Style Lab), the transformed image you choose is sent to the same provider under the same terms to create a styled version. Source photos and results can be deleted by you at any time.
Real stories (optional)
If you choose to share a before & after on Share your story, we store your two photos, the nickname, weight lost, time frame, medication and words you enter, together with your consent. Before uploading you can hide your face; the blur is applied on your device, so the original is never sent. Nothing is public until GLPily reviews and approves it. Approved stories appear on glpily.com/stories with your nickname only (never your name, email or account details). You can withdraw your story at any time from the same page: it is removed from the website and your story photos are deleted. Stories are also deleted with your account.
Food logging, barcodes and food photos
When you search for a food or scan a barcode, the search text or barcode is sent to our servers and, if we do not already know the product, to the Open Food Facts database (an open, community-maintained product database; product data is used under the Open Database License). Neither request carries your name, account id or health data. The foods you log, the portion, and the informational GLPily Grade computed for them are stored with your nutrition log. Custom foods you create are private to your account.
When you use the photo scanner, the food photo you take or choose is downscaled on your device (location and other photo metadata are removed) and sent to our AI provider (currently OpenAI) solely to estimate what food is on the plate or to read a nutrition label. Under our agreement with the provider your photos are not used to train models. The photo is stored privately in your account and automatically deleted 30 days after the scan; the estimate you reviewed and logged stays in your nutrition log. You can delete any logged meal at any time. A photo you attach to one of your own foods (My foods) is stored privately in your account, is never sent to any provider, and stays until you delete that food or your account. Product pictures shown for barcode foods come from Open Food Facts. The GLPily Grade is an informational nutrition score based on GLPily's own methodology; it is not a medical assessment or dietary advice.
GLPily Coach
When you ask GLPily Coach a question, your question, the recent conversation and a summary of your own recent logs (medication and schedule, recent doses, weights, food, protein and water totals, symptoms, daily check-ins and steps) are sent to our AI provider (currently OpenAI) solely to write the answer. Notes you type and photos are not included, and neither is your email or account id. Your journal entries from the last 30 days are included only if you turn on “Let Pily read my Journal” (off by default; you can turn it off at any time in the Journal or in Account settings). Under our agreement with the provider this data is not used to train models. The conversation is stored privately in your account so you can scroll back; you can delete it at any time with Clear chat, and it is deleted with your account. When you tell the coach something lasting (for example foods you avoid or your work schedule), it may save a short note under “What Pily remembers” so later answers can use it; you can see and delete these notes at any time in the app, and they are sent with your questions like the rest of the coach data. If you open a recipe from a meal plan the coach saved (PRO), the recipe is written by the same provider from that meal's description, and a photo of the dish is generated from the recipe title and foods only (no personal data); both are stored privately in your account and deleted with the plan or your account. The coach gives general information, not medical advice.
Purchases
Subscriptions and credit packs are billed by Apple or Google. We receive purchase events (product, time, status, anonymized transaction identifiers) through RevenueCat to grant your credits and PRO access. We never receive your card number.
Device data
App version, platform, and a push notification token if you allow notifications. GLPily does not include third-party analytics, crash-reporting or advertising SDKs and does not use your device's advertising identifier. The app does record a few in-app events on our own servers (for example, which insights were shown to you and whether you opened or dismissed them) so we can improve them. Our purchase provider, RevenueCat, receives basic technical diagnostics from its SDK (such as errors while loading products) and the country of each purchase from Apple or Google. On Android, Google's on-device ML Kit, used by the camera to read barcodes, may send Google anonymous performance data about that feature; your photos are not sent.
Website visits
On glpily.com, each blog article sends one view count to our server when it is opened. It carries only the article address; we store the day and a code made from your IP address and browser that changes every day, so a reader is counted once per day and cannot be followed from one day to the next. Your IP address itself is not stored and no cookie is set. If you accept the cookie banner, Google Analytics also counts page views and broad events (which calculator was used, which store button was tapped); nothing typed into a calculator and no health data is ever sent.
How you found GLPily
The first time the app opens, it creates a random install identifier (not a device or advertising identifier) and records it with the platform, app version and app language, plus, on Android, the install referrer Google Play passes on (the campaign link that led to the install, if there was one). During sign-up we ask how you heard about GLPily (with an optional free-text answer if you pick "Other") and offer an optional field for a creator or source code; all of these can be skipped. When you create your account, these details are linked to it so we can count which channels bring people who go on to use GLPily. On iPhone, the app also asks Apple's AdServices framework for an attribution token, which RevenueCat uses to tell whether the install came from an Apple Search Ads campaign; Apple provides this without tracking you across other companies' apps. None of this includes your health data, and none of it is used to target ads at you.
2. How we use data
- To provide, sync and secure the Service across your iOS, Android and web sessions.
- To generate the Your New Era images you explicitly request, and to keep an accurate record of credits used.
- To answer the questions you ask GLPily Coach using a summary of your own logs.
- To look up the foods and barcodes you search for, estimate the contents of food photos you choose to scan, and compute the informational GLPily Grade for what you log.
- To send injection reminders and service notifications you enable.
- To create doctor reports and exports you ask for (generated on your device).
- To operate billing, prevent fraud and abuse, and comply with law.
- To learn which channels (for example a search ad, a video or a friend) bring people to GLPily and lead to purchases, using only the install, sign-up and purchase details described above. This is how we measure our own marketing; it is never used to show you ads or shared with ad networks.
- To understand which features and insights are useful, using the in-app events described in "Device data".
- To keep the Service reliable using server-side records only (for example, how many image generations fail). Internal AI cost data is never shown to or associated with individual users beyond what is necessary for billing integrity.
We do not sell personal data. We do not use your health data or photos for advertising.
3. Who we share data with
| Processor | Purpose | Data |
|---|---|---|
| Supabase | Hosting, database, authentication, private file storage | Account, health logs, photos (encrypted at rest) |
| RevenueCat | Subscription and credit-pack purchase processing; attributing installs to campaigns | App user id, purchase events (including the purchase country), SDK diagnostics, install source and campaign, your answer to "How did you hear about GLPily?" and any code you entered, the Apple Search Ads attribution token (iPhone) |
| Apple App Store / Google Play | Billing | Purchase and payment data (held by them) |
| OpenAI (AI provider) | Generate the Your New Era images you request; estimate the contents of food photos you scan; read nutrition labels you photograph; answer the questions you ask GLPily Coach | The photo(s) you select, a text description of the requested edit or estimate, your app language and country; for the coach, your question and a summary of your recent logs (never your email or account id) |
| Open Food Facts (product database) | Look up packaged products by barcode or name | The barcode or search text only |
| Google ML Kit (Android only) | On-device barcode reading in the camera | Anonymous performance data about the feature (no photos) |
| Expo (push notification service) | Deliver notifications you enable | Push token, notification content |
We may also disclose data when required by law, to protect the rights and safety of users, or as part of a merger or acquisition (with notice to you).
4. Retention and deletion
Your data is retained while your account exists. Delete individual photos, transformations or logs in the app at any time. Delete your whole account from More → Account → Delete account: the app deletes your account, every log, photo and generated image immediately and permanently. You can also email support@glpily.com from your account email and we will do it for you within 30 days. Anonymised purchase records that we must keep for billing and legal compliance are the only exception. Photos transmitted to the AI provider are not retained by us after generation beyond the result stored in your account; the provider's transient processing retention is governed by its API data policy. Food photos from the scanner are deleted automatically 30 days after the scan.
5. Security
Data is encrypted in transit (TLS) and at rest. Photos and results are stored in private buckets with per-user access rules and are served through short-lived signed links. Sessions on your device are stored in encrypted storage protected by the operating system keychain. Credits and purchases are validated server-side and cannot be altered from a device.
6. Your rights
Depending on where you live (including under GDPR and CCPA/CPRA) you may have the right to access, correct, export, restrict or delete your data, and to object to certain processing. You can export your data as CSV in the app (More → Doctor report → Export CSV) and delete it as described above. For anything else, contact us; we respond within 30 days. You may also lodge a complaint with your local data protection authority.
7. Children
GLPily is intended for adults aged 18 and over. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.
8. International transfers
Our processors may store data in the United States or other countries. Where required, transfers are protected by standard contractual clauses or equivalent safeguards.
9. Changes
We will post updates here and, for material changes, notify you in the app. Continued use after the effective date means you accept the updated policy.
10. Contact
GLPily, 1025 E Hallandale Beach #15-1655, Hallandale Beach, FL 33009 · privacy@glpily.com