Privacy Policy

Short version: the ZuckerDings app collects nothing: no account with us, no backend, no tracking; everything happens on your device or moves directly between your device and Abbott. We only receive personal data if you email us or join the TestFlight beta. This website is hosted on GitHub Pages, which (like any web server) processes visitors’ IP addresses in its logs.

Last updated: 28 September 2026. A German version is available: Datenschutzerklärung.

Controller

The controller responsible for data processing under the GDPR is the operator named in the Impressum / Legal Notice. Contact: support@poschenrieder.io.

Scope

This policy covers (1) the ZuckerDings iOS app, (2) this website at zuckerdings.poschenrieder.io, (3) the TestFlight beta of the app, and (4) contacting us by email. The app and the website do not share data.

A note on health data

Glucose readings are health data (a special category of personal data under Art. 9 GDPR). ZuckerDings is built around that: your readings are processed exclusively on your device and in direct transfer between your device and Abbott’s servers. We operate no servers for the app, so we never receive, see, or store your glucose data at any point.

1. The ZuckerDings app

What the app collects

Nothing. The app has no backend server, no analytics, no advertising, no tracking, and no third-party SDKs that collect data. We do not create an account for you, and through the app we never receive, see, or store any of your information. On the App Store the app declares “Data Not Collected.” (The only cases in which we do receive data are the TestFlight beta and emails you send us, both described below.)

Your LibreLinkUp credentials

To show live data you provide your own LibreLinkUp follower account email address and password, the same account you already use in Abbott’s LibreLinkUp app to follow a FreeStyle Libre sensor. These credentials:

are stored only in the iOS Keychain on your device;
are shared with the ZuckerDings widget through a private, on-device App Group container so the widget can refresh;
are never transmitted to us or to any server we control. We operate no servers for the app.

Your glucose data

When you use live data, the app sends your LibreLinkUp credentials directly from your device to Abbott’s LibreLinkUp/LibreView cloud and receives the glucose readings shared with your follower account in return. Those readings are cached locally on your device (in the App Group container) so the widgets can display them and show a “last updated” time. This data is not sent to us or anywhere else.

The readings are shared with your follower account through LibreLinkUp: the person wearing the sensor invited you there and consented to that sharing with Abbott. Abbott is an independent controller for the data processed through LibreLinkUp; its handling is governed by Abbott’s own terms and privacy policy, over which we have no control.

No processing by us; on-device storage

Credentials and glucose readings are processed only on your device, for your own personal use. We have no access to them and do not process them, so there is no processing by us that would require a legal basis under Art. 6 or Art. 9 GDPR. Your own use on your own device is a purely personal activity outside the scope of the GDPR (Art. 2(2)(c) GDPR). Storing credentials and cached readings on your device is strictly necessary to deliver the service you explicitly requested, so it falls under § 25(2) no. 2 TDDDG and requires no separate consent.

Apple App Store

The app is distributed via the Apple App Store. Apple processes download and usage data as an independent controller under Apple’s privacy policy. If you have chosen in iOS to share analytics with app developers, Apple gives us only aggregated, non-personal statistics in App Store Connect (for example, numbers of installs or crashes).

2. This website

This website is static and hosted on GitHub Pages, delivered via GitHub’s content-delivery network. The provider is GitHub B.V., Prins Bernhardplein 200, 1097 JB Amsterdam, the Netherlands, or GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA.

Server logs. When you visit, GitHub automatically processes technical access data — including your IP address, date and time, the page requested, referrer, and browser/user-agent string. According to GitHub, it logs and stores the IP addresses of visitors to GitHub Pages sites for security purposes; it does so under its own responsibility. We have no access to these logs. Legal basis for delivering the website via GitHub: Art. 6(1)(f) GDPR (legitimate interest in delivering the site securely, reliably, and at low cost).
No cookies, no analytics, no tracking, no external fonts or CDNs. The site sets no cookies and loads no third-party scripts or fonts, so no consent banner is required (§ 25 TDDDG).
International transfer. GitHub is part of the Microsoft group, headquartered in the USA. Processing in the USA takes place on the basis of the EU–US Data Privacy Framework, under which GitHub is certified (Art. 45 GDPR). See GitHub’s privacy statement.

3. TestFlight beta

Before release you can test the app through Apple’s TestFlight service. Unlike the released app, this means we receive data about you via Apple (App Store Connect):

No name or email address: if you join via the public TestFlight link, we only see you as an anonymous tester (we do not receive your name or email address). Only Apple knows your Apple ID. Only if we invite you by email as an exception do we see the name and email address we entered for that;
Technical data: device model, iOS version, app version, number of sessions, and crash reports;
Feedback you choose to send through TestFlight, including comments and screenshots.

Purpose and legal basis: managing your participation in the beta (Art. 6(1)(b) GDPR), and fixing bugs and improving the app using crash reports and feedback (Art. 6(1)(f) GDPR; legitimate interest in a stable, bug-free app). Please do not send screenshots or comments that show glucose readings or any other health data. We do not need or want such data. If we receive it anyway, we delete that feedback promptly and do not use it.

Apple also processes your TestFlight data as an independent controller; see Apple’s privacy policy and the privacy information in the TestFlight app. Participation is voluntary and you can leave the beta at any time in TestFlight.

4. Contacting us by email

If you email us, we process your email address, your name (if given), and the content of your message to answer your request. Legal basis: Art. 6(1)(b) GDPR where your request concerns using the app, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).

Please do not send us any health data, such as glucose readings or screenshots of them. We do not need it for support. If we receive it anyway, we delete it promptly and do not use it.

Our mailbox is hosted by Apple (iCloud Mail); for users in the EU the provider is Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Processing by Apple Inc. in the USA is possible; Apple Inc. is certified under the EU–US Data Privacy Framework (Art. 45 GDPR).

Recipients

Abbott (only via your own LibreLinkUp account, when you use live data), GitHub (website hosting), and Apple (app distribution, TestFlight, email hosting). We do not sell or share data with anyone else.

Retention

App: Cached readings stay on your device and are removed when you uninstall the app. Credentials are stored in the iOS Keychain, which iOS keeps even after the app is uninstalled; on the first launch after a reinstall the app detects this and removes them automatically. You can also remove them at any time by signing out in the app.
Emails: We delete your request once it has been fully dealt with, unless statutory retention obligations apply.
TestFlight: Tester data is stored in App Store Connect. We remove you as a tester when you leave the beta or the beta ends, and delete crash reports and feedback once they are no longer needed for fixing bugs. Apple’s retention periods apply otherwise.
Website: Server logs are retained and controlled by GitHub per its own policy; we hold no copies.

Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), and data portability (Art. 20), and to withdraw consent with effect for the future (Art. 7(3)). We hold no data about you from the app itself; we only hold data if you have emailed us or joined the TestFlight beta. For your LibreLinkUp/LibreView data, please contact Abbott; for website server logs, please refer to GitHub.

Right to object (Art. 21 GDPR). Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object to that processing at any time, on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is needed to establish, exercise, or defend legal claims. A simple email is enough.

Right to complain

You may lodge a complaint with a data-protection supervisory authority, in particular the one for our location, the Berliner Beauftragte für Datenschutz und Informationsfreiheit, or the authority where you live or work.

Obligation to provide data

You are under no statutory or contractual obligation to provide us with data. Without your email address we cannot answer your request; without the TestFlight data you cannot take part in the beta.

Automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

Children

ZuckerDings is not directed at children and does not knowingly collect information from anyone, including children.

Changes

If this policy changes, the updated version will be posted here with a new “last updated” date.

Contact

Questions about privacy? Email support@poschenrieder.io or see the Impressum.