Your sensor login
Encrypted, used only to read.
To read your glucose, Ando signs in to your sensor’s sharing service (Dexcom Share, LibreLinkUp, Medtrum EasyFollow or your Nightscout site) the way a follower would. Here is how that login is handled:
- Encrypted with AES-256-GCM before it is stored, with a fresh random value for every encryption.
- Decrypted only on Ando’s servers, at the moment they read your glucose. Never written to logs.
- Medtronic CareLink: no password at all. You sign in on Medtronic’s own page; Ando receives an encrypted access token.
- Read-only. Ando never changes anything on your sensor or in your sensor account.
- Gone when you disconnect. Disconnecting a sensor deletes its stored login straight away.
Your data
Protected in transit, at rest and from other accounts.
- Encrypted in transit with TLS 1.3, and at rest with AES-256.
- Row-level security in the database: each account can only reach its own data.
- Secure sign-in through Supabase Auth, with Sign in with Apple on iPhone.
- Strava, your call. When you connect Strava, Ando adds a glucose block to your activities. One switch turns it off at any time, and deleting a block on Strava stops Ando from writing to that activity again.
No ads
No trackers. No selling. Ever.
The membership pays for Ando, so your data doesn’t have to. The app contains no advertising trackers and collects no advertising identifiers. Your data is never sold, and your health data is never used for advertising or marketing.
Ando uses product analytics, hosted in the EU, to understand which features are used and to fix problems, not to show you ads. This website measures visits without cookies.
Retention and deletion
Kept as long as needed, deleted when you say.
- Glucose readings: 90 days, on a rolling basis.
- Account, activities and food logs: until you delete your account.
- Delete everything from Settings in the app, at any time.
- Research: only if you opt in under Settings, Privacy, “Contribute to Research”. Data is anonymized first, and you can withdraw whenever you like.
Ando is run by ARETAEUS, a company registered in France, under the GDPR. The full list of service providers and your rights are in the privacy policy. Questions or a security concern: write to privacy@ando.care.
FAQ
Questions people ask
Is it safe to give Ando my Dexcom or LibreLinkUp password?
Ando encrypts your sensor login with AES-256-GCM before it is stored, decrypts it only on its servers at the moment it reads your glucose, and never writes it to logs. You can disconnect at any time, which deletes the stored login.
Can Ando change anything on my sensor or in my sensor account?
No. Ando only reads your glucose from your sensor’s sharing service. It never changes your sensor, your alerts or your account settings.
Does Ando sell my data or use it for ads?
No. Ando does not sell your data and does not use your health data for advertising or marketing. The app contains no advertising trackers and collects no advertising identifiers.
Who can see my glucose?
You. Other people only see what you choose to share: the glucose block on your Strava activities and the activity page it links to, or a Moment card you post. The shared activity page never shows your route or your private notes.
How long does Ando keep my glucose readings?
Glucose readings are kept for 90 days on a rolling basis. Your account, activities and food logs are kept until you delete your account, which you can do from Settings at any time.
How do I delete my data?
Delete your account from Settings in the app. That deletes your account and the data associated with it. For any question, write to privacy@ando.care.