Sweet Dreams Privacy Policy
Effective date: 11 October 2026
Last updated: 11 October 2026
This policy explains what personal data the Sweet Dreams apps collect, why, who else handles it, and what you can do about it. It covers the Sweet Dreams apps for iPhone, iPad, Apple Watch, Mac and Android, and the Sweet Dreams server that powers them.
We've tried to write this in plain English. If anything is unclear, email us at marwan@sweet-dreams.app.
Our approach to privacy
Sweet Dreams exists to help you keep an eye on glucose readings. That's the only reason we handle your data.
- We only collect what the app needs to work. Every piece of data in this policy is there to show your readings, send your alerts, or keep the app running reliably.
- We have no interest in your data beyond powering the app. We don't sell it, we don't use it for advertising, and we don't build profiles of you.
- No ads, no ad tracking. Sweet Dreams has no advertising SDKs and doesn't track you across other apps or websites.
- You're in control. You can delete your account and its data from inside the app at any time.
The short version
- Sweet Dreams signs in to your glucose sharing account (for example Dexcom Share or LibreLinkUp) so it can show you readings, send alerts and power Live Activities, widgets, the Watch app and more.
- To do that, our server stores your sharing-account username and password. The password is encrypted.
- Glucose readings are health data. We process them only to run the app, and only with your explicit consent.
- We use a small number of service providers to host the server, store data, send notifications, handle subscriptions, and understand how the app is used. They're all listed below.
- We don't sell your data, and we don't show ads.
- You can delete your account from inside the app at any time.
Sweet Dreams is not a medical device
Sweet Dreams is an independent app. It is not a medical device, and it is not made by or affiliated with Dexcom, Abbott, Medtronic, Senseonics, Medtrum, Tandem, or any other device maker.
Readings, alerts and charts in Sweet Dreams can be late, missing or wrong. That can happen because of your sensor, your phone, your internet connection, the sharing service, or Sweet Dreams itself. Don't use Sweet Dreams to make treatment decisions. Always use your official CGM app or receiver, and a blood glucose meter where your device maker advises.
1. Who we are
Sweet Dreams is built and fully owned by Sweet Apps QFZ LLC, which is the data controller responsible for your personal data:
Sweet Apps QFZ LLC
Ras Bufontas Admin Building, Office 62
Ras Bufontas Free Zone, Doha, Qatar
Email: marwan@sweet-dreams.app
2. Whose data this covers
Sweet Dreams is used both by people with diabetes and by people who look after them (parents, partners, carers). Often the person using the app is a "follower" of someone else's sharing account.
That means the readings shown in the app may belong to someone other than you. If you add a sharing account that belongs to another person, please make sure they (or, for a child, their parent or guardian) are happy for you to use Sweet Dreams to view their data.
3. What we collect
Information you give us when you sign in
- Sharing-account details. The provider you choose (Dexcom, Libre, Medtronic CareLink, Nightscout, Eversense, Medtrum, Twiist, Tandem and others), your username or email, your password, and your region. For Nightscout, this is your site address and access token.
- Sign-in tokens that the sharing service gives us, and account or patient IDs it returns, so we don't have to sign in from scratch every time.
- Your first name, if you enter one. It's shown to other people in your Message Group (see below).
- Names of the people you can follow, if your sharing service returns them, so you can pick whose readings to show.
Health data
- Glucose readings: value, time, trend arrow and rate of change. We fetch these from your sharing service.
- For most providers, our server fetches readings, uses them (for example to decide whether to send an alert, or to update your Live Activity), and does not keep the values in our database. We do keep the time of the latest reading so we know when to check for the next one.
- Twiist: we keep a short history of readings on our server, because of how that service works. See "How long we keep data".
- The app also stores recent readings on your device so it can show charts, widgets and the Watch app.
Your settings
Alert thresholds and sounds, snooze status, units (mg/dL or mmol/L), Live Activity style, missed-reading alert settings, calendar settings and other app preferences. We store these on our server so alerts work even when the app is closed.
Device and notification information
- Push notification tokens from Apple (APNs) or Google (Firebase Cloud Messaging), and Live Activity tokens, so we can send you alerts and update your Live Activity.
- App version and platform (for example "iOS 1.33"), and when the app last checked in.
- Device model and operating system version, sent with diagnostic logs.
Diagnostic logs
The app sends us limited technical logs, mostly about Live Activities, the sign-in and onboarding steps, and Apple Health sync timing. These include your Sweet Dreams user ID (or, before you have an account, a random install ID), app version, device model, OS version and what happened (for example "Live Activity started"). They're designed not to include full tokens or glucose values. Our server also logs technical events, which may include your user ID, and in some error cases your sharing-account username, or out-of-range glucose values that we discarded as invalid.
Usage analytics
The apps record which features and screens are used (for example "opened Live Activity settings" or "finished onboarding"), linked to your Sweet Dreams user ID. On iPhone, this analytics profile also includes your first name and sharing-account username, so we can find the right account when we investigate a problem. Analytics don't include glucose readings or other health data, and we don't use them for marketing. The analytics tool also automatically collects basic device information such as device model, OS version, app version and approximate location derived from your IP address.
Subscription information
If you subscribe to Premium, Apple handles the payment. We never see your card details. Our subscription provider gives us your subscription status, product, renewal and cancellation dates. To link your subscription to your account, we use a one-way hashed version of your sharing-account username. We also record which CGM provider you use against your subscription.
If you cancel and choose to tell us why, the reason you type is sent to us.
Calendar integration (optional)
If you turn on Calendar Integration, you give us your Apple ID email and an app-specific password (not your main Apple ID password). Our server stores these and uses them to add your latest reading to a "Sweet Dreams" calendar in your iCloud account. You can unlink this at any time in the app, which deletes them from our server.
Apple Health and Health Connect (optional)
If you turn on Health sync, the app reads and writes blood glucose data in Apple Health (iPhone) or Health Connect (Android). This happens on your device. We don't send your Apple Health or Health Connect data to our server. We only receive basic technical facts about a sync, such as how many readings it found and how long it took.
Message Group
Message Group lets you ping, acknowledge or message other Sweet Dreams users who follow the same sharing account. When you send a message, we send a notification to the others in the group with your first name and your message. We don't store the message on our server, but it passes through Apple's or Google's notification service.
Custom alert sounds
If you record your own alert sound, the recording stays on your device.
Support
If you email us, message us on Facebook, or contact us another way, we'll have your message, your contact details, and anything you include. Emails started from inside the app include your Sweet Dreams user ID so we can find your account.
What we don't collect
- We don't ask for your date of birth, address or phone number (unless your phone number is your sharing-account username).
- We don't use advertising SDKs or track you across other companies' apps and websites.
- We don't access your location, contacts or photos. (The app can save a picture of your chart to Photos if you ask it to.)
- We don't store your IP address in our database. It's used briefly to prevent abuse, and our hosting and other service providers will see it as part of handling your connection.
4. Why we use your data, and our legal basis
Under UK and EU data protection law (UK GDPR and EU GDPR), we need a legal reason for each use of your data.
| What we do | Data used | Legal basis |
|---|---|---|
| Sign in to your sharing account and fetch readings | Sharing-account details, tokens | Contract (to provide the app you asked for). For health data: your explicit consent. |
| Show readings, send alerts, update Live Activities, widgets, Watch, CarPlay | Readings, settings, push and Live Activity tokens | Contract. For health data: your explicit consent. |
| Calendar integration | Apple ID, app-specific password, readings | Contract, and your explicit consent for health data. Only if you turn it on. |
| Message Group | First name, message, push tokens | Contract. Only if you use it. |
| Manage your Premium subscription | Subscription status, hashed username, provider | Contract |
| Fix problems and keep the service running | Diagnostic logs, server logs, app version | Legitimate interests (keeping the app reliable and secure) |
| Maintain the app, check that safety features such as alerts behave correctly, and understand which features are used | Usage analytics (no health data) | Legitimate interests (keeping the app working and safe) |
| Prevent abuse (for example rate limiting) | IP address, user ID | Legitimate interests |
| Reply to support requests | Your messages and contact details | Legitimate interests, or contract where it's about your account |
| Comply with the law | Whatever's needed | Legal obligation |
5. Health data and your consent
Glucose readings are health data, which the law treats as "special category" data. We only process them with your explicit consent, which you give when you sign in to your sharing account in Sweet Dreams.
You can withdraw consent at any time by deleting your account in the app (Settings → Account → Delete Account), or by emailing us. Withdrawing consent doesn't affect anything we did before you withdrew it. Without this consent we can't provide the app, because showing readings is what it does.
6. Who we share data with
We don't sell your data, and we don't share it with advertisers or data brokers.
Our service providers
These companies process data on our behalf, under contract, to help us run Sweet Dreams. They can only use it to provide their service to us.
| Provider | What they do for us | Data they handle | Where |
|---|---|---|---|
| Replit | Hosts our server, including the helper that handles Medtronic CareLink sign-in | Everything our server processes, including sharing-account details and readings in transit | United States |
| Neon | Our database | Account details (passwords encrypted), settings, tokens, Twiist reading history | United States |
| Axiom | Stores server and app diagnostic logs | User ID or install ID, device and app info, technical events; occasionally usernames or discarded readings in error logs | United States |
| Mixpanel | Usage analytics | User ID, feature usage, device info, approximate location; on iPhone also first name and sharing-account username | EU data residency (Mixpanel is a US company) |
| RevenueCat | Manages Premium subscriptions | Hashed username or user ID, purchase history, CGM provider | United States |
| Apple Push Notification service | Delivers notifications and Live Activity updates on Apple devices | Push and Live Activity tokens, notification content (which can include readings and Message Group messages) | Apple’s global infrastructure |
| Google Firebase Cloud Messaging | Delivers notifications on Android | Push token, notification content (which can include readings) | Google’s global infrastructure |
| ProxyScrape, Webshare, Decodo | Network routing services our server uses to connect to some sharing services reliably | Our server's encrypted connections to sharing services. They can see which service we're connecting to, but the connection is encrypted so they can't read your password or readings | Various countries |
| IFTTT | Sends internal alerts to our own phones about service health and account events | Things like first name when an account is created, user ID when one is deleted, username when Premium is granted, out-of-range readings that were discarded, provider error summaries | United States |
| Telegram | Internal team notifications about subscription cancellations | CGM provider, plan, how long since your last reading, a link to your subscription record (hashed ID), part of your user ID, and any cancellation reason you type | Telegram’s global infrastructure |
| ConfigCat | Remote app settings (feature switches) | Your IP address when the app fetches settings. No account information is sent. | Global content delivery network |
| Contentful | Hosts in-app content such as community updates and support links | Your IP address when the app loads content | Global content delivery network |
| Instatus | Hosts our service status page, which the app checks | Your IP address when the app checks status | Global content delivery network |
| Zoho Mail | Our email | Support emails you send us | United States |
Services you choose to connect
When you use Sweet Dreams, you ask us to connect to services that you already have an account with. These companies are not our service providers. They're independent, and their own privacy policies apply:
- Your glucose sharing service (Dexcom, Abbott LibreView/LibreLinkUp, Medtronic CareLink, Eversense, Medtrum, Twiist, Tandem, Tidepool, or your own Nightscout site). We send them your sign-in details and receive your readings. On iPhone, the app can also fetch Dexcom and Libre readings directly from those services using your sign-in token.
- Apple iCloud Calendar, if you turn on Calendar Integration. We sign in with the details you gave us and add events that include your latest reading.
- Apple Health or Health Connect, if you turn on Health sync. This stays on your device.
- Apple App Store, which handles Premium payments.
- Facebook / Messenger, if you choose to contact us there.
Others
We may share information if the law requires it, to protect someone's safety, or as part of a sale or reorganisation of Sweet Dreams. If that happens, this policy will continue to apply to your data, or we'll tell you.
7. International transfers
Sweet Apps QFZ LLC is based in Qatar, and Sweet Dreams is used around the world. To run the app, your data is processed in Qatar and by the service providers listed above, mainly in the United States (for example our database, with Neon) and the European Union (our analytics, with Mixpanel). If you're in the UK or EU, that means your data is transferred outside the UK and EU. Where a provider offers them, we rely on standard data protection contract terms, such as the EU Standard Contractual Clauses or the UK International Data Transfer Addendum, to protect it. Email us if you'd like more detail.
8. How long we keep data
| Data | How long |
|---|---|
| Your account (sharing-account details, settings, tokens) | Until you delete your account. |
| Glucose readings (most providers) | Not stored on our server. We keep only the time of the latest reading. |
| Twiist reading history | About a day (deleted once older than 24 hours, checked every 6 hours) |
| Calendar Apple ID and app-specific password | Until you unlink iCloud or delete your account |
| Diagnostic and server logs (Axiom) | 30 days |
| Usage analytics (Mixpanel) | As long as it's useful for maintaining the app. Email us to have your analytics profile deleted at any time. |
| Subscription records (RevenueCat) | As long as needed for accounting and tax |
| Support emails and messages | As long as needed to help you, and to refer back to if the same problem comes up again |
| Readings and settings on your device | Until you log out, delete the app, or they're replaced by newer ones |
9. Deleting your account
You can delete your account in the app: Settings → Account → Delete Account.
This deletes your account from our database, including your sharing-account details, settings, alerts, push tokens and calendar details. It also deletes any Twiist reading history.
Some data may remain for a limited time afterwards:
- Logs and analytics, until they expire under the retention periods above. Email us if you'd like your analytics profile deleted straight away.
- Technical records of Live Activity starts, which we use for troubleshooting.
- Your subscription history with RevenueCat and Apple, which we may need for accounting. Deleting your Sweet Dreams account doesn't cancel an Apple subscription. Manage that in your Apple ID settings.
- If other people follow the same sharing account in Sweet Dreams, their accounts aren't affected.
To ask us to delete anything else, email marwan@sweet-dreams.app.
10. Your rights
Under UK and EU data protection law, you have the right to:
- Access the personal data we hold about you
- Correct data that's wrong
- Delete your data
- Restrict how we use it
- Object to us using it based on legitimate interests (including analytics)
- Data portability: get a copy of data you gave us, in a machine-readable format
- Withdraw consent at any time, where we rely on consent
To use any of these rights, email marwan@sweet-dreams.app. We may need to check it's really you, for example by asking you to email us from inside the app. We'll reply within one month.
You also have the right to complain to a data protection authority. In the UK, that's the Information Commissioner's Office (ico.org.uk). In the EU, it's the authority in your country. We'd appreciate the chance to sort things out first, so please contact us.
In Qatar, you have similar rights under the Personal Data Privacy Protection Law (Law No. 13 of 2016). If you live in another country, you may have similar rights under local law. Email us and we'll help.
11. Children
Many people use Sweet Dreams to look after a child with diabetes. In that case, the child's readings are shown in the app because a parent or guardian set up sharing and chose to use Sweet Dreams. Parents and guardians can delete this data at any time by deleting the account.
Sweet Dreams accounts are meant to be set up by adults, or by children old enough to consent in their country (13 in the UK). We don't knowingly collect data from younger children except through a parent or guardian. If you think a young child has set up an account without permission, email us and we'll delete it.
12. Security
We take reasonable steps to protect your data, including:
- Encrypting your sharing-account password in our database (AES-256-GCM).
- Using encrypted (HTTPS) connections between the app, our server and the services we connect to.
- Limiting access to production data to the people who run Sweet Dreams.
No system is perfectly secure, and we can't guarantee that your data will never be accessed without permission. If a breach happens that's likely to put you at risk, we'll tell you and the relevant authority as the law requires.
13. Changes to this policy
We'll update this policy when the app changes. We'll post the new version at this address and change the "Last updated" date. If a change is significant, we'll also let you know in the app.
14. Contact
Email: marwan@sweet-dreams.app
Post: Sweet Apps QFZ LLC, Ras Bufontas Admin Building, Office 62, Ras Bufontas Free Zone, Doha, Qatar