CarbSnap sends carbohydrate, insulin and override commands to a Nightscout site you run, which forwards them to a Loop app you built. It is a thin, deliberately small piece of plumbing between an AI assistant and software you already operate. This page describes exactly what it keeps.

What CarbSnap stores

Data	Why
Your email address and name, from Google	To know who you are and who took an action
The first name you give the person you are managing	So the interface can say "Liam" rather than an id
Your Nightscout address	To know where to send commands
Your Nightscout API secret and Loop one-time password key	Required to send a command at all. Encrypted with AES-256-GCM before storage.
Your safety limits	To refuse a command that exceeds them
A log of every command attempted, including refusals	So you can see what happened. One-time passwords are redacted from it.
Food descriptions and carbohydrate amounts you log	Your own record, and to eventually learn per-food absorption patterns
Only if you use texts: the names, phone numbers and Apple ID emails of people you add	To address the texts you schedule. Numbers and emails are encrypted with AES-256-GCM before storage.
Only if you use texts: what each text says, when it was due, and what your Mac reported about it	So the Texts page can show whether each one went
Only if you use texts: the name of each Mac you pair, and when it last checked in	So you can see it is working, and unpair it. Its credential is stored only as a one-way hash.

What CarbSnap does not store

• Glucose readings. They are read from your Nightscout at the moment a page is displayed and are never copied into our database. Your Nightscout already holds them.
• Photographs of food. Those are handled entirely by Claude or ChatGPT. CarbSnap never receives an image of a meal.
• The QR code from Loop's one-time password screen. That picture is decoded in your browser. Only the key inside it is transmitted.
• Your Messages history. CarbSnap Relay, the optional Mac app that sends texts, reads Messages' database on your Mac only to confirm that a text it handed over went. It reads only messages you sent, and reports back only whether that one text went, which service carried it, and Messages' ID for it. How it works.
• Payment details. There is nothing to pay for.
• Anything for advertising, profiling or resale. There is no analytics script, no tracking pixel and no third-party advertising code on any page.

Who else sees your data

Only the services required to make it work, and only what each needs:

Service	What it receives
Cloudflare	Hosting, database and network. All stored data lives here.
WorkOS	Sign-in. Your email address and name.
Google	Confirms who you are when you sign in. Google is told you signed in to CarbSnap; it is not told anything about the person you manage.
Your own Nightscout	The commands you send, which is the entire point.
Apple	Only if you use CarbSnap Relay: the texts themselves, which your own Mac sends through your own Messages account, exactly as if you had typed them. CarbSnap's servers never talk to Apple.
Resend	Only when email is enabled: your address, to deliver a confirmation link.
USDA FoodData Central and Open Food Facts	The food name you typed, e.g. "pepperoni pizza". No identity, no glucose, no dose.

Your data is never sold, and never shared with anyone else.

Who can see your care circle

Only you, and anyone you explicitly invite. An invited caregiver can log carbs, request a bolus and start an override, and must accept the medical disclaimer themselves — consent is never inherited from whoever set things up. Only the owner can change credentials, limits, or membership. Every action is recorded against the person who took it.

Security, and its honest limits

• Credentials are encrypted at rest with AES-256-GCM, with a separate random initialisation vector per record, and are bound to the field they belong to so a value moved elsewhere fails to decrypt rather than quietly working.
• Sign-in is Google only. CarbSnap never sees, stores or transmits a password.
• All traffic is HTTPS.
• CarbSnap is not a HIPAA-covered entity and its infrastructure is not operated to HIPAA standards. It is a personal do-it-yourself tool, in the same spirit as Loop and Nightscout. Anyone who can read your Nightscout API secret can send commands to that Loop app, which is why the secret is encrypted and never shown again after you enter it.

Deleting your data

Turning off remote commands in settings stops every assistant immediately without deleting anything. To delete instead, use Delete account at the foot of settings. It happens straight away, on your own say-so, and nobody has to be emailed about it.

If you are the owner, that removes the stored Nightscout address and its encrypted API secret, the audit log, the food log, every review, suggestion, weight, meal time and food override, every person, group, template and text on the Texts page and every paired Mac, and access for everyone you invited. They are emailed to say their access has ended. If you were invited by somebody else, deleting removes your access and your sign-in and leaves their data with them, where it belongs.

Two things deletion deliberately does not reach, because neither is ours to take:

• Your own Nightscout site. Carb entries CarbSnap sent are still there, and Loop has already dosed against them. Deleting our copy does not, and should not, rewrite your own records.
• Your Google account. Signing in again works and starts a completely empty CarbSnap account.

One record can survive, and it is worth saying plainly. If you have sent carbs or a bolus for a family whose account is not being deleted, their log keeps that entry and shows it as coming from a deleted account. Your name and address are erased; the entry is not, because it is their safety record and not yours to remove. The page tells you before you confirm which of the two applies to you.

Changes

If this page changes in a way that affects what is collected or who receives it, you will be asked to review it before continuing to use CarbSnap.

Back to CarbSnap · Terms