Overview
A14Y Labs LLC, a company based in Mercer Island, Washington, USA, operates a14ylabs.com and develops SpikeSmart with privacy in mind. SpikeSmart is a reflection and planning tool for people who already use a continuous glucose monitor. It is not a medical device and does not provide diagnosis or treatment advice.
Information SpikeSmart accesses
With your permission, SpikeSmart reads blood glucose samples, step counts, and workouts from Apple Health. It uses glucose data to calculate summaries, estimate GMI, identify recent glucose spikes, and show trends back to you. It uses steps and workouts to add activity context to your weekly review. SpikeSmart requests read-only access to these data types. You can use the app without granting access, although connected glucose and activity features will not work.
Optional sleep access lets SpikeSmart align glucose windows with your recorded sleep. Sleep samples are also processed on your device.
Your Apple Health glucose, step, and workout samples are processed on your device. SpikeSmart does not upload these samples to A14Y Labs LLC or use them for advertising, sale, or data-broker sharing. Comments or screenshots you choose to send can contain health information; please avoid including it in either feedback channel described below.
Generated food icons
When you request a new food icon or regenerate one, SpikeSmart saves your meal locally first and sends only the icon description through A14Y Labs LLC’s authenticated service to OpenAI’s GPT Image API. Apple Health samples, glucose values, meal timestamps, predictions, Apple credentials, account identifiers, and existing images are not sent to OpenAI for this feature. New icons authenticate automatically with Apple App Attest, which verifies the app and provides a hardware-backed signing key. Only the opaque key identifier and a short-lived enrollment retry record are saved in device-only Keychain storage. Apple sign-in and Optional Backup are not required.
Our icon-generation service does not retain descriptions or generated images. It keeps daily request counts with hashed installation-key identifiers (or account identifiers for older app versions) and day-scoped hashes of network IP addresses to enforce generation limits. Raw IP addresses are not stored in these buckets. Previous day buckets and accepted-request records are removed by scheduled maintenance. Enrolled public keys and monotonic assertion counters prevent replay and are removed after 90 days of generation inactivity. Enrollment is limited to prevent unbounded key creation. Operational logs contain request IDs, route, status and duration, without descriptions or image content. Generated icons and generation descriptions are saved on your device and are included in encrypted backup only if you enable it. OpenAI processes the descriptions and generated outputs under its API data controls.
You can continue logging meals, using saved icons or choosing standard food emojis when signed out, offline or while generation is unavailable. A failed generation keeps your saved meal and its previous icon.
On-device storage
SpikeSmart stores preferences such as your target GMI, spike threshold, weekly target, and labels you add to spikes on your device. Custom food-symbol images are stored as protected local files. The app remains usable without a SpikeSmart account, without optional backup, and while offline.
Signed-out use is the default local-first experience. An account is not required for Apple Health summaries, activity context, planning features, labels, or using saved custom images, and an outage of the optional backup service does not prevent you from using the protected local copy.
An earlier pre-release build used a private iCloud database for spike labels and related images. That transition is retired: current builds do not access CloudKit, and labels and images remain in protected on-device storage unless you separately choose Optional Backup.
Protected local storage also keeps migration sources and prior edit or conflict revisions for recovery. Deleting an individual meal, label, Quest or library record removes it from active use and records its deletion, but does not erase these retained local recovery revisions. They are not uploaded as recovery copies or automatically restored. They remain until the app-container data is removed or an explicit local purge is provided. Disconnecting backup or deleting the remote account keeps this local data.
Free access, subscriptions and beta memberships
The public App Store version offers 60 days of full access, beginning when usable glucose data is available on your iPhone. No subscription commitment or payment is required to begin. The app decides locally whether usable data is available; it does not send glucose readings, Health permissions or sample dates to the access service. Full features require an active free period, subscription or eligible lifetime membership. After access expires, saved records remain available to view and export, along with Settings, privacy and restoration controls.
To keep the same free period across reinstalls and devices, the app sends Apple's signed app-download proof and a Boolean start request to our access service. The service verifies Apple's signature and app identity, then stores only a purpose-separated keyed hash of the verified download identifier and the free period's start and end times. It does not retain the signed proof or raw download identifier. The eligibility record has no automatic expiry: it prevents a reinstall from starting another free period. App Review sandbox records are kept separate from production records. This check does not create a backup account or enable backup or usage sharing.
Apple processes subscription payments and manages renewals, cancellations and refunds. SpikeSmart verifies subscription entitlements on your device through StoreKit. Our access service does not receive your payment card, billing information or signed subscription transactions. Free access does not automatically convert to a paid subscription; payment begins only when you choose and confirm a subscription with Apple.
Eligible pre-launch TestFlight testers can register permanent beta access using a verified app-download proof. The service stores keyed identity and recovery-credential hashes, opaque membership identifiers and timestamps so it can restore that access. A recovery credential remains in your iPhone's Keychain. Optional Sign in with Apple links the membership for recovery on another iPhone without requesting your name or email. Closing new enrollment does not expire existing memberships. Settings → Access provides membership restoration and deletion; deleting a membership retains a one-way download tombstone to prevent automatic re-enrollment. Membership records and trial eligibility are separate from optional backup, so deleting a remote backup account does not restart a trial or delete lifetime access.
Optional account and backup
Optional Backup is off by default. In current TestFlight builds with backup enabled, enrollment is automatic after you enable Back up my data and complete Sign in with Apple. No manual approval or enrollment ID is required for these builds. Backup is optional, and local use does not require an account. Builds without backup enabled remain local-only. SpikeSmart does not request the name or email scopes from Apple. Apple supplies a pseudonymous account identifier, identity token, and one-time authorization code needed to authenticate the account.
Automatic enrollment creates an account only when you choose to enable backup and sign in. Earlier restricted test enrollments used time-limited rollout grants containing only an opaque ID, a cohort label, and operator timestamps—not the Apple subject, name, email, or profile data. These existing audit records follow the retention policy below; automatic enrollment does not require a grant. Access and non-destructive backup writes may be paused independently. Pausing writes does not disable remote-account deletion, and the protected local copy remains usable.
For a person who enables backup, the service keeps a bounded set of Apple refresh credentials (at most eight in total across the live account and same-account cleanup work) as authenticated encrypted ciphertext only for account lifecycle functions. It validates only the newest active credential, no more than once per day, to confirm that Apple authorization remains valid, and handles every retained credential when the remote account is deleted. A successful reauthorization may retire an older encrypted generation until that deletion-time cleanup. The credentials are not used to access Apple Health, your Apple Account profile, contacts, name, or email. Apple access tokens and returned identity tokens from the daily check are not stored.
For an enabled backup account, Apple may send the service a signed account-status notification if you revoke consent for SpikeSmart or request deletion of your Apple Account. The service verifies Apple's signature, issuer, app audience, and event timing before acting. An authenticated consent-revoked or account-deleted event stops SpikeSmart sessions and starts deletion of the remote backup; your protected local copy remains on your iPhone. To process and reject duplicate delivery, notification replay/action records retain only one-way replay and account verifiers plus minimal event type, timing, and processing state. A pending action has no expiry while unresolved; a processed replay/action record is retained only through the 14-day period measured from notification receipt. A provider-confirmed deletion separately retains a one-way account-generation status selector with its pending deletion record, then only as part of the 90-day completion receipt. Its read-only status endpoint accepts a canonical device proof only as request/rate-limit material; it never stores or binds that proof. The service does not retain the raw signed notification, Apple subject, plaintext account identifier, or device deletion proof.
If Apple conclusively rejects the active refresh credential, or a cryptographically verified response identifies a different Apple subject, the enabled backup service revokes its app sessions and asks you to sign in interactively again while retaining the remote backup. Temporary network, Apple, key, or configuration failures retry and do not by themselves force reauthentication or delete data.
Standard label backup sends only the label or deletion you created, a custom image you chose to save, synchronization timestamps and metadata, a keyed pseudonymous event identifier, and a randomized encrypted event locator used to match the same labeled event on your authorized devices. The per-account key remains with your authorized devices; the service does not receive it and cannot decrypt the locator. Neither value exposes a raw glucose value or raw event timestamp. Raw Apple Health samples, glucose or activity histories, GMI results, and other on-device calculations are never uploaded as part of backup.
Eligible builds offer one Back up my data toggle, off until you enable it. It covers meals, explicit predictions, food labels and associations, original custom images, recorded Quest activation, manual completion days and acknowledgements, reusable-food catalogue entries and original images, goals, workflow dates and notification preferences. Food history, Quest, library and settings contents are encrypted on your devices using keys bound to your backup account generation; the service does not receive those keys. Meal times, approximate-time provenance, predictions and original image bytes stay encrypted. The service retains opaque event identifiers, encrypted locators, synchronization revisions, deletion markers, content tags and ciphertext sizes. Compatible standard label synchronization also sends the service labels and processed custom images as described above.
Apple Health samples, glucose and activity calculations, automatic Quest progress, permissions, onboarding completion and account credentials are excluded. Retained local recovery revisions and migration sources are not uploaded. On a new device, backed-up settings restore automatically after you choose backup and sign in with the same Apple Account. Existing devices keep their current preferences. Apple Health access, onboarding completion and Share app usage choices remain local and are not enabled by a restore. Existing backup sessions and earlier partial backup choices do not turn on the new toggle. Turning backup off stops synchronization and retains your local data, saved account link and remote backup. Account recovery and deletion remain available with backup off.
When the internal or canary backup service is enabled, A14Y Labs LLC uses Cloudflare to authenticate accounts and process and store optional backup data. Data is encrypted in transit. Backup data is associated with a pseudonymous account identifier so it can be returned only after authentication. Standard label backup is not end-to-end encrypted: A14Y Labs LLC and its infrastructure provider can process the labels, images, and metadata to provide, secure, troubleshoot, and delete the service.
SpikeSmart does not include third-party advertising or analytics SDKs. Builds with optional app usage sharing send the limited interaction events described below directly to PostHog through SpikeSmart's own code. We do not use backup or usage information for advertising, sell it, or share it with data brokers.
Optional app usage sharing
In builds where Share app usage appears during onboarding and in Settings, you can help improve SpikeSmart through PostHog product analytics. New TestFlight builds enable sharing by default unless you have already chosen otherwise. App Store builds default to sharing off. An explicit on or off choice is preserved across updates; the TestFlight default alone does not enable sharing after an update to an App Store build. Sharing works independently of sign-in and Optional Backup, is not required to use the app, and can be turned off anytime in Settings. Earlier builds without this choice do not send these events.
While sharing is enabled, SpikeSmart sends app opens, session starts, onboarding completion, tab and Settings views, successful meal saves or edits, Quest starts, insight views and backup-toggle enablement. Each event contains its event time, a random installation identifier, a random session identifier, app version/build and fixed feature names. We use these events to understand usage frequency, feature adoption and daily, weekly and monthly return rates. These measurements describe installations with sharing enabled, not a count of identified people across devices.
Events do not contain Apple Health samples, glucose values, health calculations, meal names or times, predictions, photos, free text, name, email, Apple identifiers or backup account identifiers. SpikeSmart does not record your screen, automatically capture controls, create identified person profiles, or send advertising identifiers. IP-based location enrichment is disabled. PostHog still receives connection information, including your IP address, to deliver its service. The current enabled release uses PostHog Cloud in the United States.
A14Y Labs LLC uses PostHog as a service provider for these measurements. Access is limited to authorized product administrators. PostHog's current free plan provides one year of event history; that allowance is not a guarantee of deletion from every provider copy exactly at one year. See PostHog's retention information and privacy policy.
Turning Share app usage off stops new collection, cancels pending uploads and clears the in-memory queue and installation identifier. A request already in flight may have reached PostHog. Events already sent are not automatically deleted, and later opting in creates a new identifier. While sharing is on, Settings shows your Usage data ID. Include that ID when contacting support@a14ylabs.com for deletion, ideally before turning sharing off. We handle identified copies under our control within 30 days of a verified request unless a documented legal obligation requires otherwise; provider recovery records follow PostHog's own processes. Deleting your optional backup account does not delete these separate usage records.
TestFlight beta testing
If you install SpikeSmart through TestFlight, Apple automatically collects crash reports and usage information and shares them with A14Y Labs LLC. You cannot opt out of this collection while using the TestFlight beta. This applies even when you use SpikeSmart signed out or leave Optional Backup off; those app choices do not disable TestFlight collection. We use beta data for tester administration, support and technical troubleshooting, including resolving crashes and performance problems. We do not use these beta records for advertising, audience measurement or behavioral feature-planning analytics. See Apple’s TestFlight privacy notice.
Tester information can include invitation status, installs, sessions, crashes, app/build versions, device and operating-system details, and a device identifier. Email invitations can also make your invitation email and the name entered for the invitation visible to us. With a public-link-only invitation, Apple does not show us your name or email in tester information; an email you voluntarily include in feedback can still identify that submission.
TestFlight feedback is optional and separate from SpikeSmart’s Share feedback form. Apple shares the comments, screenshots, crash feedback, and related device information you submit through TestFlight with us. A screenshot may reveal glucose readings, meal details, or other personal information. Please omit health details and crop or cover identifying information before sending it. TestFlight feedback is handled through Apple’s beta-testing tools, rather than the app’s Cloudflare feedback endpoint.
A14Y Labs LLC is responsible for our use of beta data. Access is limited to people authorized to manage the beta and investigate feedback. We do not use it for advertising or sell it. Service providers process information for us as described on this page; we do not otherwise share beta data with third parties. We retain developer-held copies only while needed for these purposes, for no longer than 90 days after the beta ends, and remove copies under our control within 30 days of a verified deletion request unless a documented legal obligation requires otherwise. Service providers' recovery copies and Apple-held TestFlight records have separate retention limits, described below. Contact support@a14ylabs.com about access or deletion.
Apple controls retention in TestFlight: its notice states that feedback is retained for one year and crash/usage data may be kept until bugs are resolved. Our developer-copy period does not shorten Apple’s retention. Stopping testing, disconnecting backup, or deleting your SpikeSmart remote account does not erase TestFlight records already collected. For Apple-held data, see Apple’s Data and Privacy page; we can handle requests for our own copies and explain the limits of deletion through Apple’s tools.
Early-access information
If you submit the early-access form on this website, we collect the name, email address, CGM setup, and goals you provide. We use that information only to evaluate interest, communicate about SpikeSmart, and organize beta access. Do not include medical records or detailed health information in the form.
Form submissions are delivered to A14Y Labs LLC by Resend, our email delivery provider. Cloudflare hosts this website and may process limited technical information, such as IP addresses and request logs, to deliver and secure it. We do not use website information for targeted advertising.
Early-access and support mail reaches an owner-managed Gmail inbox, including mail routed through our domain's Cloudflare Email Routing service. Our Resend sending domain has email-open and link-click tracking off. Cloudflare email preview is off for future support mail; this does not immediately erase previews retained before that setting changed.
Website performance analytics
Our websites, a14ylabs.com and spikesmart.com, use Cloudflare Web Analytics to measure visits and page performance. Its browser script sends page and referring-page information, a generated page identifier, and performance measurements to Cloudflare. Cloudflare says this script does not use cookies or browser storage, and its RUM service discards connection IP addresses at the receiving data center. This does not describe all Cloudflare security logs. Our current setting excludes measurement through Cloudflare's specified European data centers. See Cloudflare's RUM information.
Cloudflare documents seven days of unsampled beacon data, followed by reduced data for longer-term storage, and six months of accessible analytics history. Seven days is not a guarantee of complete deletion. These website measurements are separate from SpikeSmart's native app and optional backup. See Cloudflare's analytics retention information.
SpikeSmart app feedback
This section describes SpikeSmart’s own Share feedback form, separate from TestFlight. If you choose Share feedback in the app, we receive your positive or negative feedback choice, description, selected app area, app version, iOS version, and device model, plus a reply email or reviewed screenshot only if you add one. Apple Health records, glucose history, meal labels, account identifiers, and diagnostic logs are not attached automatically. Please do not include personal health details; screenshots usually are not needed. Crop or cover identifiable information before sharing.
Reports are submitted over HTTPS to our Cloudflare Worker and sent through Cloudflare Email Service to our support inbox. They are not stored in the app's backup database. The endpoint does not log report contents, reply emails, or screenshots. Cloudflare processes connection information, including IP addresses, to operate the service and limit abusive submissions. Support emails are retained while needed to investigate and respond, then removed when no longer needed. You can contact support to request deletion.
Retention and deletion
Early-access submissions are retained while we evaluate and operate the SpikeSmart beta, for no longer than 90 days after the beta ends, unless you ask us to delete yours sooner. We remove information when it is no longer needed for that purpose. We remove identified copies under our control within 30 days of a verified deletion request unless a documented legal obligation requires otherwise; provider recovery limits remain separate.
For individually invited friend testing, we review support messages, feedback and any investigation copies when the issue closes. We keep them only while needed, for no longer than 90 days after that test ends. Within 30 days of a verified deletion request, we remove identified copies under our control and request provider removal where available, unless a documented legal obligation requires otherwise. This includes attachments and any local copies we deliberately create. Removing our copy does not remove copies held by someone who sent or received the message.
Outside beta testing, support messages are kept only while needed, for no longer than 12 months after the issue closes. We remove identified copies under our control within 30 days of a verified deletion request unless an active dispute or documented legal obligation requires retention. Beta support and investigation copies follow the earlier beta deadline above. Ashok Kuppusamy is responsible for beta administration, support, privacy requests and recovery-copy handling at A14Y Labs LLC.
Providers can retain operational records and recovery copies after information is removed from the active service. Our current Resend plan retains emails and logs for 30 days and backup copies for seven days; earlier removal of an identified message requires a request to Resend support. Cloudflare retains email delivery and routing event metadata for 31 days and Workers Paid logs for seven days. These periods do not apply to every provider security or audit record. See Resend's retention information, Cloudflare email analytics and Cloudflare Workers Logs.
Gmail's Trash normally retains deleted messages for 30 days unless they are permanently removed sooner. For an approved deletion request, we permanently remove the identified mailbox copies rather than relying on Trash expiry. Google describes a general deletion process of about two months and disaster-recovery backups lasting up to six months, with possible delays and exceptions. These are Google's published limits, not a promise that every Gmail copy is erased on a specific date. See Gmail deletion and Google's retention information.
For an enabled backup account, local labels and images remain on your iPhone when you disconnect backup or delete the remote account. Disconnect Backup revokes only that app refresh-token family, removes the saved service credential from that iPhone, and stops synchronization. It does not revoke the Sign in with Apple authorization or delete the remote account or its backup data.
Delete Remote Account in Settings first records a durable deletion request, then revokes the Apple authorization and deletes the account, backed-up labels, images, and service sessions. A verified Apple consent-revoked or account-deleted notification can also start remote deletion and does not make a redundant revocation request for authorization Apple has already ended. Temporary Apple or storage failures remain pending and retry instead of being reported as complete. The protected local copy stays on your iPhone. Synchronization tombstones may be retained while an account exists so an offline device does not restore something you deleted.
If the app loses the final response, a device-held deletion receipt lets it check whether deletion finished without asking you to recreate the account. The service retains only a one-way completed-receipt verifier for 90 days, then purges it. If, after at least a 24-hour recovery window, every stored Apple credential is proven absent or unrecoverable, SpikeSmart finishes deleting the remote backup rather than retaining it indefinitely. The app then persistently tells you that Apple access might still need manual removal in your Apple Account’s Sign in with Apple settings until you acknowledge that guidance. Temporary provider, key, and configuration failures continue retrying and do not take this fallback.
Optional Backup stores account-safety identifiers and encryption keys in device Keychain, with some keys synchronized through iCloud Keychain to your authorized devices. After remote-account deletion, compatible builds stop using the deleted backup's keys and remove them as they become available on each device. Older encryption keys may remain while older compatible builds still need them. Retained account-safety records prevent accidental attachment to a different backup account. These safety records have no time-based expiry, and removing app-container data does not prove that Keychain or iCloud Keychain records have been erased on every device.
Deletion from the active backup service does not immediately erase recovery copies. Cloudflare's database recovery history can retain earlier database state for up to 30 days on our current plan. Separate recovery copies we create for a specific operation have restricted access and an expiry of no more than 30 days from creation, sooner when no longer needed. They may contain the same encrypted data, service-readable labels, processed images and metadata described above. We review deletion state before any restoration so that recovery does not reintroduce deleted accounts or content. These operator-copy deadlines do not apply to protected recovery revisions on your own device. See Cloudflare's database recovery limits.
Deleting SpikeSmart removes its app-container data from that device, subject to device and operating-system backup behavior. For an enabled backup account, deleting the app alone does not request deletion of remote backup data; use Delete Remote Account before deleting the app if you also want the remote copy removed.
To request deletion of an early-access submission or other information held by A14Y Labs LLC, email support@a14ylabs.com from the address you used to contact us.
Your choices
- Decline Apple Health access or revoke it in your device’s Health privacy settings.
- Use SpikeSmart signed out; if you have an explicitly enabled internal or canary build and are admitted to its cohort, choose whether to enable optional backup.
- Disconnect an iPhone from backup without removing its local copy.
- Delete your remote backup account from Settings without removing the local copy.
- Remove SpikeSmart manually from your Apple Account’s Sign in with Apple settings if automatic authorization revocation cannot be completed.
- Choose not to submit the early-access form.
- Ask us to stop emailing you or delete your early-access submission.
- Remove app-container data from a device by deleting the app.
Children
SpikeSmart and its early-access program are not directed to children under 13, and A14Y Labs LLC does not knowingly collect personal information from children under 13 through this website.
Changes
We may update this policy as SpikeSmart develops. We will publish changes on this page and update the effective date. Material changes to app data practices will also be reflected in the app and its App Store disclosures.
Contact
For privacy questions or requests, contact A14Y Labs LLC at support@a14ylabs.com.