Privacy Policy

Effective date: October 15, 2026

This Privacy Policy explains how Aura Crafts LLC ("we", "us") collects, uses, and protects your information when you use the spike mobile application ("spike", the "App") and the spikehealth.app website. Your health data is private. Community sharing is optional: we publish only the community profile details you choose to provide and meals you explicitly submit that are approved for publication.

Feature availability varies by app version and platform. The new community, planning, and fasting features described here are included in the iOS 5.0 release.

1. Health data from Apple Health (HealthKit)

With your explicit permission, spike reads and writes the following through Apple's HealthKit framework:

• We read: blood glucose, including readings you log from a fingerstick meter and compatible CGM data shared with Apple Health, steps, active energy, exercise time, workouts, and water intake.
• We write: meter readings you choose to log, the water you log, and the nutrition of meals you log (calories, protein, carbohydrates, sugar, fiber, cholesterol, fat, sodium).

Here is exactly what happens with your glucose data:

• Glucose readings are read from Apple Health on your device to display your daily curve and analyze your responses to meals.
• Raw glucose readings are not uploaded to our servers. When a meal's response is analyzed, only summary values for that meal (baseline, peak, the change between them, and recovery time) are stored in your private account record so they sync across your sessions.
• Health data from HealthKit is never used for advertising or marketing, never sold, and never shared with data brokers. We do not use HealthKit data for any purpose other than providing the App's features to you, consistent with Apple's HealthKit guidelines.

You can revoke Health access at any time in iOS Settings > Privacy & Security > Health > spike.

2. Other information we collect

• Account information: your email address and name from Sign in with Apple or Google, and a user identifier.
• Profile and goals: information you provide during onboarding, such as gender, date of birth, height, weight, goals, activity level, diet preference, and which CGM you use.
• Food logs: meals you log, including photos you take of food, nutrition data, and the meal-response summaries described above.
• My meals and weekly plans: meal names, photos you select, ingredients and quantities, cooking steps, estimated nutrition, saved community meals, and your recurring plan, meal selections, portions, and planning preferences. These are private account records unless you separately submit an original meal for community publication.
• Fasting: your selected mode, safety acknowledgement and eligibility confirmation, and session start/end times are stored on your device in an account-specific protected file excluded from device backup. The individual diagnosis and medication answers used for the safety check are not saved. Fasting history is not uploaded to our servers or shared with the community.
• Optional community profile: your chosen display name, avatar or profile photo, bio, and city. City is text you enter; this feature does not request your GPS location. Your sign-in email and private health profile are not added to your public community profile.
• Community activity: submitted recipes and photos, review status and moderator feedback, saved-meal associations, reports, and blocked-creator preferences. We display an aggregate count of unique saves; we do not publicly display who saved a meal.
• Progress data: weight entries and progress photos you choose to add.
• Feedback and support: the message and bug-report or feature-request category you send, together with your account identifier, account name and email, app version, device model, operating-system version, and submission time. The feedback form does not automatically attach glucose readings, food logs, or fasting history.
• Usage and diagnostics: app interaction events, crash reports, and device information used to fix bugs and improve the App.

3. How we use information

• To provide the App: analyzing meal responses, showing your glucose curves, calculating nutrition targets, and syncing your data across sessions.
• To process AI meal recognition: photos of food you submit are processed to identify foods and estimate nutrition.
• To save reusable meals, build your weekly plan, display community recipes, maintain save counts, and review submissions and reports.
• To manage your subscription and free trial.
• To respond to support requests and send service notifications you've enabled.
• To understand aggregate usage and improve the App.

The Home feedback card can be enabled remotely. Its app-open count and dismissal/response cooldown are stored locally per account on the device to decide when to show it. Opening the App Store review link does not tell us whether you submitted a rating or review. Written feedback is sent privately to the Spike team only when you tap Send.

4. Optional community sharing

Creating a meal in My meals does not publish it. To contribute, you create a community profile, preview a meal, and explicitly submit it. Spike moderators can access the submitted photo, recipe, chosen community profile, and review history to check completeness and appropriate content. A submission becomes visible to other community users only after approval. Review is not a medical or nutritional certification.

Your community profile and approved meals can show your display name, avatar or photo, bio, city, recipe photo, ingredients and quantities, cooking steps, estimated nutrition, and creator credit. Your food diary, glucose readings, meal-response summaries, weekly schedule, weight history, fasting history, and sign-in email are not automatically published.

You can edit your profile, withdraw a meal, or remove your community profile in the App. An approved version may remain visible while a revised submission is being reviewed. Withdrawing a meal or deleting your community profile removes it from community browsing, but copies already saved to other users' private My meals, including copied photos and creator credit, can remain. Screenshots, downloads, or other copies made by recipients cannot be recalled. Avoid including personal information in recipe text or images that you do not want others to see.

5. Service providers

We use service providers to operate the features you use:

• Google Firebase (authentication, database, storage, crash reporting, analytics, Remote Config, and app verification): stores account records, private meal and planning data, community profiles, recipes and photos, submissions, support feedback, and meal-response summaries, and helps operate and protect the App.
• RevenueCat (subscription management): processes purchase receipts; it does not receive health data.
• TastyAPI (AI meal recognition): receives the food image you send for a scan to estimate foods and nutrition. Your glucose readings and fasting history are not attached to that request.
• Edamam (ingredient search and nutrition) and Spoonacular (recipe discovery): receive the searches, ingredients, quantities, or recipe preferences needed to return results. Your glucose readings and fasting history are not attached to those requests.
• AppsFlyer (Android and earlier iOS releases): supports install attribution and deep links and receives device/install information. It does not receive health data. The iOS 5.0 app no longer includes this SDK.

Payment is processed by Apple; we never see your payment details.

6. What we don't do

• We do not sell your personal information.
• We do not share your health data with advertisers, data brokers, or social networks.
• We do not use glucose or other HealthKit data for advertising, marketing, or machine-learning training unrelated to providing your features.

7. Data retention and deletion

We retain account data to provide the App while your account is active. Submitted recipes and moderation history are retained to process reviews and enforce community rules. Feedback and reports may be retained as needed to respond, investigate abuse, meet legal obligations, or resolve disputes.

You can delete your account in the App (Profile tab > settings gear > Delete Account), or follow the steps on our account deletion page. Account deletion removes your community profile, published meals, submissions, save associations, private meals and plans, food logs, photos, and meal-response records from our active systems. Local fasting data is removed by the in-app account-deletion flow. Already-saved copies in other users' private libraries are subject to the community-copy limitation above. Data in Apple Health remains under your control; deleting a Spike account does not cancel an Apple subscription.

8. Children

spike is not intended for anyone under 17, and we do not knowingly collect data from children. Over-the-counter CGMs supported by spike are indicated for adults 18+.

9. Security

Data in transit is encrypted with TLS. Server data is stored in Google Firebase with access controls appropriate to the feature: private account records are restricted to authorized access, submitted content is accessible for moderation, and the community can view chosen profile details and approved meals. Photos are delivered through download links; anyone you give a photo link or a saved copy to may retain it.

10. Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal information. Contact us at [email protected] and we'll honor these requests.

11. Changes

If we make material changes to this policy, we'll update the effective date above and notify you in the App.

12. Contact

Aura Crafts LLC
[email protected]