Privacy Policy

Last updated: 2026-08-18

The short version

• My GLP Shot is local-first. Your shot log, weights, notes, photos, and settings live in your browser on this device unless you choose otherwise.
• An account is optional. You can use the app with no account and no email.
• If you create an account, we store your email and billing state. We do not store your password. Cloud backup is end-to-end encrypted in your browser. We cannot read that backup.
• Smart Import is the exception. If you use it, the file you upload is sent in readable form to an AI parser so we can turn it into shots and weights. That is the only path where health data leaves your device in plaintext.
• No ads. No data sales. No health-data partnerships.

What stays on your device only

By default, all of this lives in your browser's IndexedDB on your device and never reaches our servers:

• Shot logs (medication, dose, date/time, injection site, notes)
• Weight, mood, appetite, side effects, body measurements, labs, supply, and daily notes
• Photos you attach to a log
• Settings (cadence, reminders, theme)

You can keep using the app this way forever. Nothing above is uploaded unless you sign in and turn on cloud backup, create a doctor-share link, or use Smart Import.

If you create an account

An account is optional. If you sign up, we store:

• Your email address (that is how we know which account is yours, and how we send a password-reset link)
• A one-way hash of an authentication token derived from your password on your device. We never receive the password itself.
• Subscription state: trial dates, whether you are on Premium, and Stripe customer / subscription IDs if you pay
• Where you arrived from when you signed up (the referring page and any campaign tags on the link). This is for us to understand which pages bring people in. It is not ad tracking.
• A signed-in session cookie (HttpOnly, Secure, 90 days)

Forgot-password emails are sent through Resend from hello@myglpshot.com. We do not send marketing mail.

What we store if you enable Cloud Sync

Cloud Sync is opt-in and requires an account. When enabled, an encrypted blob of your data is uploaded so you can restore it on another device. The server stores:

• A ciphertext blob (AES-GCM 256, encrypted in your browser before upload)
• An IV (random 96-bit nonce per encryption)
• A last-updated timestamp and the size of the blob

We cannot read the blob. We do not store your password or your encryption key. If you lose your password, the cloud copy cannot be recovered. Your local copy on this device is unchanged.

Smart Import — the one plaintext exception

Smart Import is optional and only runs if you are signed in and you choose to upload an export from another tracker (or a CSV). The file is sent to our server, then to an AI model (Google Gemini, reached through our own LiteLLM gateway / OpenRouter) so it can be turned into shots and weights.

• The uploaded text is readable to that parser. It can include doses, dates, and weights.
• We do not use Smart Import files to train a model, sell data, or build advertising profiles.
• If you do not use Smart Import, this path never runs and that data never leaves the device in readable form.

Reminders

If you turn on shot or daily reminders and allow notifications, your browser gives us a push endpoint. We store that endpoint and the times you asked to be buzzed. The notification wording is chosen from a fixed list on the server. We do not send your dose, weight, or notes in a notification.

Payments

Premium is billed by Stripe ($1.99/month or $19.99/year, 14-day trial). Checkout and the customer portal run on Stripe's site, not inside the app. Stripe sees the email and payment details you give them. We store Stripe's customer and subscription IDs so we can keep Premium in sync. We do not store card numbers.

How the encryption works

• Key derivation: PBKDF2-SHA-256, 600,000 iterations, salted with a hash of your email
• Encryption: AES-256-GCM with a fresh random 96-bit IV per upload
• The first half of the derived key never leaves your device. The second half is the auth token we bcrypt and store.
• All cryptography runs in your browser via the Web Crypto API.

Plain-English glossary

If any of the terms above are unfamiliar, here's what they actually mean.

Local-first

The app runs on your device and saves your data on your device. Nothing leaves the phone or computer unless you turn on Cloud Sync, create a doctor-share link, or use Smart Import.

IndexedDB

A built-in storage area inside your web browser where the app keeps your shots, weight, and settings. It stays on your device — like the notes app on your phone.

End-to-end encrypted (E2EE)

Your data is scrambled on your device before it's sent to our server, and only your device has the key to unscramble it. We can't read it. Same approach used by Signal and Bitwarden.

Ciphertext

Scrambled data. Without the key, it's a jumble of random-looking bytes — useless to anyone who steals it, including us.

Encryption key

The secret that turns ciphertext back into your readable data. We never see it. It's derived from your password on your device and never leaves.

PBKDF2

The way we turn your password into an encryption key. We run the password through 600,000 rounds of a math function so it's slow to guess, even with a powerful computer.

AES-256-GCM

The actual scrambling method. AES-256 is the gold-standard encryption used by banks and governments. GCM is the mode that also detects if anyone tried to tamper with the ciphertext.

IV (initialization vector) / nonce

A random number we mix in each time we encrypt, so the same data encrypted twice produces different ciphertext. Stops attackers from spotting patterns.

Lookup ID

An older anonymous ID used by the original sync method. Current accounts are keyed by email plus the hashed auth token, not a lookup ID.

Web Crypto API

The cryptography toolkit built into every modern browser. It's what does the encrypting on your device. Standard, audited, and runs locally.

PWA (Progressive Web App)

A website you can install to your phone or computer like an app. Works offline, sends notifications, no app-store middleman.

HIPAA, GDPR, CCPA

Health and privacy laws — U.S. health (HIPAA), European general privacy (GDPR), and California consumer privacy (CCPA/CPRA). They give you rights like exporting your data and deleting it. The export/delete buttons in the app cover those rights.

Server logs

Our reverse proxy logs basic request metadata (IP address, user agent, timestamp, request size, response status) for security and rate-limiting purposes. These logs are rotated and retained for no longer than 14 days. They are not joined to user data.

Cookies, analytics, third parties

The marketing site and the app both load our own self-hosted Umami analytics at analytics.willhitestrategy.org. It counts page views and a few in-app events (for example: signed up, tried without an account). It does not set an advertising cookie, does not sell data, and does not follow you across other sites. We do not embed ad networks, social pixels, or other companies' trackers.

Third parties that can see something, and only when you use that feature:

• Stripe — if you pay for Premium
• Resend — if we email you a password-reset link
• Google Gemini via our LiteLLM gateway / OpenRouter — if you use Smart Import
• Your browser's push service (Apple, Google, or Mozilla) — if you turn on reminders

Cloudflare sits in front of the site for TLS and abuse protection. It sees the same request metadata any CDN would.

Your rights

• Export your data anytime as JSON from Settings → Backup.
• Delete local data via Settings → Erase all data on this device.
• Delete the cloud copy via Settings → Cloud Sync → Delete cloud data.
• Delete the account via Settings → Delete account and all cloud data. That removes the account, the encrypted backup, sessions, share links, and reminder schedule.
• If you are in the EU/UK, California, or another jurisdiction with privacy rights (GDPR, CCPA/CPRA, etc.), the controls above cover access and erasure. Email hello@myglpshot.com if you want us to confirm an account deletion from our side.

HIPAA

My GLP Shot is a personal tracking tool used directly by individuals. It is not a Covered Entity under HIPAA, is not integrated with healthcare providers or insurers, and does not handle Protected Health Information on behalf of any covered entity. Nothing in this app constitutes medical advice. Talk to your doctor about your medication.

Breaches

If our server is ever compromised, an attacker would obtain encrypted ciphertext only — not your data in any readable form. We will still notify users if any breach occurs that we believe could affect them, in accordance with applicable law including the FTC Health Breach Notification Rule.

Children

My GLP Shot is not directed to children under 13. We do not knowingly collect data from children.

Changes to this policy

If this policy changes materially, we will update the "Last updated" date and post a notice in the app.

Contact

Questions or concerns: hello@myglpshot.com

Willhite Strategy Group
1875 Mission St Ste 103 #809
San Francisco, CA 94103

Back to My GLP Shot  ·  Terms of Use