-
Notifications
You must be signed in to change notification settings - Fork 0
App Store and Privacy
PumpSync's App Store and legal assets live in the iOS repository. Backend privacy and operational retention behavior is documented in the backend repository and summarized here.
Current App Store evidence lives in PumpSync/docs/app-store/:
-
pumpsync-hosted-subscription-review.jpg: current subscription review image for the PumpSync Hosted auto-renewable subscription in App Store Connect. -
hosted-services-subscription-image.png: earlier hosted-service subscription image retained for reference. -
accessibility.md: App Store accessibility label answers, common task matrix, and manual validation checklist for iPhone and iPad.
| Purpose | Scheme | Configuration | StoreKit environment | Backend URL |
|---|---|---|---|---|
| Local Xcode install | PumpSync |
Debug |
Sandbox | https://ca-pumpsync-nonprod-api.gentlesea-b1e8a783.eastus2.azurecontainerapps.io/api |
| TestFlight upload | PumpSync Beta |
Beta archive |
Sandbox | https://ca-pumpsync-nonprod-api.gentlesea-b1e8a783.eastus2.azurecontainerapps.io/api |
| App Store release | PumpSync |
Release archive |
Production | https://api.pumpsync.ericslutz.dev/api |
TestFlight and development-signed purchases use Apple's sandbox and do not charge real money. App Store release builds use the production App Store transaction environment.
Keep HealthKit enabled for the app. StoreKit access comes from enabling the In-App Purchase capability in Apple Developer and App Store Connect; do not add an In-App Purchase entitlement key to PumpSync.entitlements.
Background task identifiers and UIBackgroundModes=processing are app configuration values in project.yml, not separate Apple entitlement keys to add for StoreKit.
PumpSync is designed to minimize server-side storage of health data and credentials.
- Tandem credentials are stored only by the iOS app in Keychain with device-only accessibility.
- Tandem credentials are sent to the configured backend only inside an active HTTPS sync request.
- The backend does not persist Tandem username, password, Tandem session cookies, Tandem access tokens, raw Tandem events, or normalized Tandem samples.
- The app writes Tandem insulin and carbohydrate samples to Apple Health after permission is granted, then discards returned payloads after the write completes.
- Duplicate prevention uses a local rolling HMAC external-ID ledger.
- Tandem credentials are not synced through iCloud in v1; each device must be configured separately.
Hosted backend storage includes operational state:
- App Store subscription entitlement state.
- App installation mappings needed to issue PumpSync service tokens.
- Rate-limit events.
- Sync attempt metadata.
- Idempotency records for non-credential endpoints.
- Redacted operational audit events.
Self-host SQLite stores the same operational state in the configured self-host database.
Users may delete Tandem credentials in the app. Users may request deletion of PumpSync hosted server-side metadata from the app's Data Handling section or through the support contact listed on the App Store product page or TestFlight invitation.
Deleting PumpSync does not automatically delete samples already written to Apple Health. Users manage Apple Health records in the Apple Health app.
See:
PumpSync is not a medical device and does not provide medical advice, diagnosis, treatment, or dosing recommendations. Users should verify health data and follow guidance from qualified healthcare professionals.
PumpSync documentation: iOS repository · Backend repository · Issues