Effective date
Effective date: August 20, 2026
Last updated: August 20, 2026
Who operates PumpSync
PumpSync is operated by Eric Slutz, an independent developer.
Data PumpSync handles
What PumpSync handles depends on how you use it:
- When you choose PumpSync: App Store subscription transaction identifiers and entitlement status.
- From the app: a PumpSync installation identifier generated by the app.
- To secure service sessions: a device-generated public key, device-attestation data for hosted access, rotating session credentials, and request replay counters.
- To protect the hosted service from fraud and abuse: encrypted App Attest receipts and categorical fraud-risk outcomes associated with a hosted App Attest key.
- During a sync request: Tandem Source username, password, selected region, pump or device identifiers, Tandem pump events, normalized insulin and carbohydrate samples, and service session tokens.
- To operate the backend: sync attempt metadata, redacted error metadata, and technical telemetry.
Data stored on your device
The app stores Tandem credentials in Keychain using device-only accessibility. Tandem credentials are not synced through iCloud by PumpSync.
The app also stores a rotating service-session credential and device-key reference in Keychain. The private device key is protected by App Attest for hosted access or the Secure Enclave for self-hosted access and is not sent to PumpSync.
The app stores minimal sync metadata and a rolling duplicate-prevention ledger so repeated syncs do not create duplicate Apple Health samples.
Data sent to PumpSync servers
The app sends Tandem credentials to the PumpSync backend only during an active HTTPS sync request. The backend uses those credentials to retrieve Tandem Source data for that request.
For hosted access, the app sends Apple App Attest objects or assertions so the backend can verify that session enrollment and renewal are bound to the installed app. The hosted backend may periodically send App Attest receipts to Apple to obtain categorical fraud-risk outcomes used only to protect PumpSync from fraudulent or abusive access. For self-hosted access, the app sends signatures from a Secure Enclave key; self-hosted authentication does not contact or depend on Apple.
A sync request can start manually, or automatically after initial setup when the app opens or during an iOS background refresh opportunity. PumpSync checks for any pump data not yet synced and aims to keep Apple Health less than four hours behind, but iOS may delay background work.
The backend does not persist Tandem username, password, Tandem session cookies, Tandem access tokens, raw Tandem events, or normalized Tandem samples.
Apple Health
PumpSync writes insulin and carbohydrate samples to Apple Health only after the user grants Apple Health permission. Apple Health controls whether other apps can read those samples.
PumpSync does not read unrelated Apple Health data. PumpSync does not use HealthKit data for advertising, marketing, tracking, or data mining.
Backend storage
PumpSync stores App Store subscription entitlement state for hosted users, app installation mappings, device public keys, one-way session-token verifiers, session expiry and replay state, encrypted App Attest receipts, categorical fraud-risk outcomes, rate-limit events, sync attempt metadata, idempotency records for non-credential endpoints, and redacted operational audit events.
PumpSync does not store plaintext renewable session credentials, device private keys, App Attest attestation objects, or assertions. App Attest receipts are encrypted before durable storage.
PumpSync does not store Tandem credentials or Tandem health payloads in backend durable storage.
Sharing
PumpSync does not sell user data. PumpSync does not share HealthKit data, Tandem credentials, Tandem tokens, raw Tandem events, or normalized Tandem samples with advertisers, data brokers, or marketing services.
PumpSync uses these infrastructure providers: Apple (App Store distribution, subscriptions, hosted device attestation, and Apple Health), Microsoft Azure (hosted backend infrastructure and telemetry), and GitHub (website hosting, source code, and support workflows). Those providers process data only as needed to provide their services.
App Attest receipts and categorical fraud-risk outcomes are used only for app functionality, security, and fraud prevention. They are never used for advertising, cross-app profiling, or tracking.
PumpSync's developer does not meet the thresholds that make the California Consumer Privacy Act applicable. Regardless, PumpSync does not sell or share personal information.
Where data is processed
The PumpSync-hosted backend runs in Microsoft Azure data centers in the United States (East US and East US 2).
Using PumpSync from outside the United States transfers sync request data and hosted metadata to those data centers. Self-hosted users control where their own backend runs.
Retention
Tandem credentials remain on the user's device until the user deletes them in the app or deletes the app.
The backend retains account, billing, device-session, rate-limit, sync metadata, and redacted operational records only as long as needed to operate PumpSync, troubleshoot issues, meet legal obligations, and protect the service.
Encrypted App Attest receipts and categorical fraud-risk outcomes are retained only while their hosted App Attest key is active and for up to 30 days after that key becomes inactive, then deleted.
Other operational records are kept until a data-deletion request removes them; there is currently no automatic time-based cleanup for those records.
Raw Tandem events and normalized Tandem samples are discarded by the backend after the sync response is produced. The app discards raw and normalized Tandem payloads after Apple Health confirms the write.
Deletion and your choices
Users may delete Tandem credentials in the app. Users may also request deletion of metadata stored by the PumpSync-hosted backend, including encrypted App Attest receipts and categorical fraud-risk outcomes, using the account and data deletion instructions.
Users may also request a copy or correction of the hosted metadata associated with their installation through the same channel.
Deleting PumpSync does not automatically delete samples already written to Apple Health. Those records are controlled by Apple Health; see Apple Support: view and delete Health data.
Children's privacy
PumpSync is not directed at children under 13. A parent or guardian should operate the PumpSync subscription or self-hosted backend used for a minor's data and must be authorized on the connected pump account.
See the age suitability page for guidance for parents and guardians.
Security
PumpSync uses HTTPS for network requests. Tandem credentials and renewable session credentials are stored on device in Keychain. Device private keys remain protected by App Attest or the Secure Enclave. Backend logs and audit events are designed to redact credential, token, transaction, and device-proof fields.
This website
This website sets no cookies and uses no analytics or tracking. It runs no executable JavaScript; the only script element on the home page is inert structured-data markup that browsers do not execute.
It is hosted on GitHub Pages, which maintains standard server access logs as described in GitHub's privacy statement.
Medical disclaimer
PumpSync is not a medical device and does not provide medical advice, diagnosis, treatment, or dosing recommendations. Users should verify health data and follow guidance from qualified healthcare professionals.
Changes
This policy may be updated as PumpSync changes. The effective date will be updated when material changes are made, and the last-updated date will be revised for any user-visible change.
Contact
For privacy, deletion, or support requests, use the support page.