Features and Modes

Features and Modes

PumpSync has one iOS app and one backend API that supports hosted service, real self-hosting, and synthetic demo/App Review flows.

iOS App Features

• Stores Tandem Source credentials in the device Keychain with device-only accessibility.
• Validates Tandem credentials through the configured backend.
• Writes Tandem insulin and carbohydrate samples to Apple Health after the user grants HealthKit permission.
• Uses local sync metadata and a rolling external-ID ledger to avoid duplicate Apple Health samples.
• Lets users choose PumpSync through StoreKit or enter a self-hosted backend URL.
• Provides settings, sync, privacy/data handling, diagnostics, and support surfaces.
• Lets users start a sync manually at any time.
• Checks for any pump data not yet synced when the app opens after initial setup and during iOS background refresh opportunities. PumpSync aims to keep Apple Health less than four hours behind, but iOS controls when background work runs; the app also provides a manual sync action and shows the last successful sync time.
• Supports App Intents shortcuts for PumpSync flows.

PumpSync does not read unrelated Apple Health data and does not use HealthKit data for advertising, marketing, or data mining.

Access Modes

Mode	User experience	Backend behavior	Storage
PumpSync	User subscribes or restores the PumpSync auto-renewable subscription in the iOS app.	Backend validates the signed App Store transaction and protocol 3 App Attest request binding, then issues a renewable device-bound session. Hosted access fails closed on proof or local receipt-validation failure; optional Apple risk assessment is observe-only.	Azure Table Storage for hosted operational state.
Self-hosted	User enters their own backend base URL in app settings.	Backend verifies a signature from an on-device Secure Enclave P-256 key; it has no App Store or Apple authentication dependency.	SQLite by default.
Synthetic demo/App Review	User enters the public demo backend URL and demo Tandem credentials.	Backend runs SelfHosted + SyntheticDemo; no Tandem network calls are made.	SQLite by default.

Sign in with Apple is intentionally not part of the current access flow.

Build 7 uses renewable authentication protocol 3 while retaining one-hour JWT access tokens and a rotating refresh credential stored in the device Keychain. Refresh credentials have a 30-day idle and 90-day absolute lifetime. Background sync renews through the device-bound proof without StoreKit; foreground recovery can repair hosted entitlement state through StoreKit when renewal is unavailable. Hosted mode requires App Attest. Rotating either backend security key invalidates the affected sessions until the app reconnects in the foreground.

The backend reports its data source on the wire — capabilities and session responses carry dataSourceMode (tandemSource or syntheticDemo) — and the app labels a demo backend's connection status accordingly, so synthetic data cannot silently masquerade as pump data.

Backend Modes

The backend uses ASP.NET Core configuration binding. Environment variables use double underscores.

Mode	PumpSync__BackendMode	PumpSync__DataSourceMode	PumpSync__StorageProvider
Hosted service	Hosted	TandemSource	AzureTableStorage
Real self-hosting	SelfHosted	TandemSource	Sqlite
Demo/App Review	SelfHosted	SyntheticDemo	Sqlite

The same API, contracts, services, and normalization code are used in all three modes.

Route Contract

Hosted, demo, and self-host app-entered URLs include /api. PumpSync appends /v1/... endpoint paths, so the backend exposes API routes under /api/v1/....

Main routes:

• GET /api/v1/capabilities
• POST /api/v1/session/challenge
• POST /api/v1/session/refresh
• POST /api/v1/subscription/session
• POST /api/v1/self-host/session
• POST /api/v1/app-store/notifications
• GET /api/v1/status
• POST /api/v1/tandem/credentials/validate
• POST /api/v1/sync/tandem

status, tandem/credentials/validate, and sync/tandem require a bearer access token whose session family remains active. Session creation and refresh rotate the credential and persist only its backend verifier.

Data Handling

The Privacy Policy is the canonical statement of what is handled, stored, and retained. Implementation notes:

• Credential-bearing requests are limited to the validate and sync endpoints; nothing credential-bearing is written to durable storage.
• The iOS app discards raw and normalized Tandem payloads after Apple Health confirms the write.
• Hosted and self-host deployments persist the same operational tables; self-host uses SQLite in the configured database.
• Hosted protocol 3 additionally stores encrypted App Attest receipts and categorical fraud-risk outcomes for security and fraud prevention. These records are never used for tracking and are retained no later than 30 days after their key becomes inactive.
• Self-hosted and synthetic demo sessions use the Secure Enclave proof path and do not contact or depend on Apple authentication or App Attest risk assessment.
• Sync attempts and rate-limit buckets accumulate until a data-deletion request removes the user's rows; there is no automatic time-based cleanup.