-
Notifications
You must be signed in to change notification settings - Fork 0
App Store and Privacy
PumpSync's App Store and legal assets live in the iOS repository. Backend privacy and operational retention behavior is documented in the backend repository and summarized here.
Current App Store evidence lives in PumpSync/docs/app-store/:
-
pumpsync-subscription-review.jpg: current subscription review image for the PumpSync auto-renewable subscription in App Store Connect. -
hosted-services-subscription-image.png: earlier hosted-service subscription image retained for reference. -
accessibility.md: App Store accessibility label answers, common task matrix, and manual validation checklist for iPhone and iPad.
| Purpose | Scheme | Configuration | StoreKit environment | Hosted environment |
|---|---|---|---|---|
| Local Xcode install | PumpSync |
Debug |
Sandbox | Nonprod hosted API |
| TestFlight upload | PumpSync Beta |
Beta archive |
Sandbox | Nonprod hosted API |
| App Store release | PumpSync |
Release archive |
Production | Production hosted API |
TestFlight and development-signed purchases use Apple's sandbox and do not charge real money. App Store release builds use the production App Store transaction environment.
Keep HealthKit and App Attest enabled for the app. StoreKit access comes from enabling the In-App Purchase capability in Apple Developer and App Store Connect; do not add an In-App Purchase entitlement key to PumpSync.entitlements. Debug uses the App Attest development environment, while TestFlight and App Store archives use production.
Background task identifiers and UIBackgroundModes=processing are app configuration values in project.yml, not separate Apple entitlement keys to add for StoreKit.
The Privacy Policy on the website is the canonical statement of what PumpSync handles, stores, retains, and deletes. Do not restate it here — this section covers implementation details only.
- Credentials are held in the iOS Keychain with device-only accessibility; they are never written to backend durable storage.
- Credential transmission is scoped to a single in-flight HTTPS sync request, whether the sync was started manually, on app open, or by an iOS background refresh opportunity.
- Duplicate prevention uses a local rolling HMAC external-ID ledger keyed on the sample external ID.
- Keychain items are not synced through iCloud in v1, so each device is configured separately.
- Hosted renewable sessions use request-bound App Attest and retain encrypted receipts plus categorical risk outcomes for service security and fraud prevention. Receipt validation is required for enrollment; Apple's optional risk exchange is observe-only and never blocks an otherwise valid session. The public policy defines their deletion and 30-day inactive-key retention boundary.
- Self-hosted renewable sessions use a Secure Enclave P-256 key and have no Apple authentication or App Attest risk-assessment dependency.
Before submitting Build 7, reconcile the live App Store Connect privacy questionnaire with the shipped protocol 3 behavior:
| App Store privacy field | Build 7 answer |
|---|---|
| Data type | Device ID |
| Linked to the user | Yes — the hosted key record is associated with an installation and subscription session. |
| Purpose | App Functionality, including service security and fraud prevention. |
| Used for tracking | No. |
The review note should say: "PumpSync-hosted access uses Apple App Attest. The backend stores the App Attest receipt encrypted and stores only a categorical fraud-risk outcome. These records protect account and service sessions, are not used for advertising or tracking, are deleted on an applicable deletion request, and are automatically deleted no later than 30 days after the App Attest key becomes inactive. Self-hosted authentication does not contact or depend on Apple."
Treat the live App Store Connect answers as release state: inspect them again for every candidate rather than assuming a previous questionnaire is still current.
The website's Backend storage section is the canonical inventory of what the hosted backend keeps. Self-host SQLite stores the same operational state in the configured self-host database.
For the full backend security model — rate limits, forwarded-header trust, transport posture, and retention — see the backend repo's docs/security-and-privacy.md.
Use the public website for user-facing privacy and deletion instructions:
Implementation references:
The medical disclaimer is published on the website and rendered on every page there. See the Privacy Policy and Terms of Use; do not maintain a copy of that wording here.
PumpSync documentation: iOS repository · Backend repository · Issues