# Data leak on nightscout **URL:** \ **Category:** C/GM\ **Created:** [January 2, 2020, 3:19am UTC](https://forum.fudiabetes.org/t/data-leak-on-nightscout/9031 "2020-01-02T03:19:39Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![NickR](https://avatars.discourse-cdn.com/v4/letter/n/dc4da7/32.png) [@NickR](https://forum.fudiabetes.org/u/NickR)\ **Post date:** [January 2, 2020, 3:19am UTC](https://forum.fudiabetes.org/t/data-leak-on-nightscout/9031/1 "2020-01-02T03:19:39Z")
I set up nightscout yesterday in readiness for my miaomaio to arrive. I got a web address [myuser.herokuapp.com](http://myuser.herokuapp.com). All very good. I went back to my browser later and accidentally mistyped that address and got a page full of data. I was a little surprised that data was present in my nightscout. I puzzled over it for some time. The data went back months! The penny finally dropped that I had mistyped the url and when I returned to mine it was, as expected, empty. A couple of questions: 1. Is it usual for the nightscout page to be completely open? I don’t have a clue who this person is, but s/he has a samsung 10 phone, measures in mmol/L, and speaks English. 2. Any idea how I could contact this person and tell them their data is open to the world? ---
**Author:** ![ClaudnDaye](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.fudiabetes.org/claudndaye/32/5_2.png) [@ClaudnDaye](https://forum.fudiabetes.org/u/ClaudnDaye)\ **Post date:** [January 2, 2020, 3:46am UTC](https://forum.fudiabetes.org/t/data-leak-on-nightscout/9031/2 "2020-01-02T03:46:22Z")
> [@NickR](#): > > Is it usual for the nightscout page to be completely open? I don’t have a clue who this person is, but s/he has a samsung 10 phone, measures in mmol/L, and speaks English. Anyone can see anyone else’s Nightscout page if you happen upon it or they share the url. Admin rights are reserved fort those who can “unlock” (provide the api secret) the Nightscout account. ---
**Author:** ![NickR](https://avatars.discourse-cdn.com/v4/letter/n/dc4da7/32.png) [@NickR](https://forum.fudiabetes.org/u/NickR)\ **Post date:** [January 2, 2020, 3:49am UTC](https://forum.fudiabetes.org/t/data-leak-on-nightscout/9031/3 "2020-01-02T03:49:05Z")
I think that is a pretty strange and in general unacceptable system. Some people will inadvertently be giving away a lot of info there. Is there a way of deploying to anywhere other than heroku? ---
**Author:** ![ClaudnDaye](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.fudiabetes.org/claudndaye/32/5_2.png) [@ClaudnDaye](https://forum.fudiabetes.org/u/ClaudnDaye)\ **Post date:** [January 2, 2020, 3:49am UTC](https://forum.fudiabetes.org/t/data-leak-on-nightscout/9031/4 "2020-01-02T03:49:53Z")
What info are you giving away that can somehow hurt you? No name, ssn, phone number, address, etc. No PII data at all. It’s just some anonymous persons bg data. I swap NS urls with other parents at times as a way for us to see if we can find patterns and try to help each other manage our kids ngs i wouldn’t care if our url were public ---
**Author:** ![NickR](https://avatars.discourse-cdn.com/v4/letter/n/dc4da7/32.png) [@NickR](https://forum.fudiabetes.org/u/NickR)\ **Post date:** [January 2, 2020, 3:52am UTC](https://forum.fudiabetes.org/t/data-leak-on-nightscout/9031/5 "2020-01-02T03:52:38Z")
Yeh people said that when google and facebook started collecting “anonymous” data about us too. I put the question back to you: why would you share intensely personal data with the world, even anonymously? I think we all need to protect any and all personal data where possible. ---
**Author:** ![ClaudnDaye](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.fudiabetes.org/claudndaye/32/5_2.png) [@ClaudnDaye](https://forum.fudiabetes.org/u/ClaudnDaye)\ **Post date:** [January 2, 2020, 3:53am UTC](https://forum.fudiabetes.org/t/data-leak-on-nightscout/9031/6 "2020-01-02T03:53:37Z")
> [@NickR](#): > > why would you share intensely personal data with the world, even anonymously? Why do you consider bg data “intensely personal data”? I don’t personally. Everyone has bgs ---
**Author:** ![ClaudnDaye](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.fudiabetes.org/claudndaye/32/5_2.png) [@ClaudnDaye](https://forum.fudiabetes.org/u/ClaudnDaye)\ **Post date:** [January 2, 2020, 3:55am UTC](https://forum.fudiabetes.org/t/data-leak-on-nightscout/9031/7 "2020-01-02T03:55:41Z")
But my recommendation to anyone is do what you’re comfortable with. If you think it’s a data leak, data mine, insecure zone for personal data theft, i recommend not using the system. ---
**Author:** ![Sam](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.fudiabetes.org/sam/32/10595_2.png) [@Sam](https://forum.fudiabetes.org/u/Sam)\ **Post date:** [January 2, 2020, 4:27am UTC](https://forum.fudiabetes.org/t/data-leak-on-nightscout/9031/8 "2020-01-02T04:27:16Z")
I don’t know anything about nightscout or even what @nickr is referring to directly… but I 100% understand his concern about bg data being intensely personal… It’s different for adults than children… adults have careers, are subject to nonsensical bureaucracy etc… there are a lot of potential ramifications to blood sugar data already and even more potential for the future… it’s a very slippery slope imo Historically I don’t even share electronic bg data with my own doctors… although that’s becoming harder and harder to do… ---
**Author:** ![ClaudnDaye](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.fudiabetes.org/claudndaye/32/5_2.png) [@ClaudnDaye](https://forum.fudiabetes.org/u/ClaudnDaye)\ **Post date:** [January 2, 2020, 4:28am UTC](https://forum.fudiabetes.org/t/data-leak-on-nightscout/9031/9 "2020-01-02T04:28:23Z")
![image](https://canada1.discourse-cdn.com/flex030/uploads/fudiabetes/original/2X/b/b09aaf24c2050d6872bfe35d834de6827bb02df1.jpeg) Here is Nightscout. Find anything personal. Even if you landed on my url. So what. Adult, child, doesn’t matter imo. ---
**Author:** ![ClaudnDaye](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.fudiabetes.org/claudndaye/32/5_2.png) [@ClaudnDaye](https://forum.fudiabetes.org/u/ClaudnDaye)\ **Post date:** [January 2, 2020, 4:30am UTC](https://forum.fudiabetes.org/t/data-leak-on-nightscout/9031/10 "2020-01-02T04:30:36Z")
But i say again… Don’t do anything that makes you uncomfortable. Everything off a security risk these days. Can’t stop living out of fear. ---
**Author:** ![Sam](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.fudiabetes.org/sam/32/10595_2.png) [@Sam](https://forum.fudiabetes.org/u/Sam)\ **Post date:** [January 2, 2020, 4:30am UTC](https://forum.fudiabetes.org/t/data-leak-on-nightscout/9031/11 "2020-01-02T04:30:51Z")
Hypothetical—- your son wants to fly an airplane someday and some bean counter decides that the acceptable bg range for someone with that diagnosis is something absurd like “bg managed between 90-125 100% of the time” Not that this particular platform is directly accountable to him but it is just an example of why electronic data tracking in the public domain makes some people like the OP and like myself very nervous ---
**Author:** ![ClaudnDaye](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.fudiabetes.org/claudndaye/32/5_2.png) [@ClaudnDaye](https://forum.fudiabetes.org/u/ClaudnDaye)\ **Post date:** [January 2, 2020, 4:31am UTC](https://forum.fudiabetes.org/t/data-leak-on-nightscout/9031/12 "2020-01-02T04:31:39Z")
And? ---
**Author:** ![ClaudnDaye](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.fudiabetes.org/claudndaye/32/5_2.png) [@ClaudnDaye](https://forum.fudiabetes.org/u/ClaudnDaye)\ **Post date:** [January 2, 2020, 4:33am UTC](https://forum.fudiabetes.org/t/data-leak-on-nightscout/9031/13 "2020-01-02T04:33:22Z")
> [@Sam](#): > > makes some people like the OP and like myself very nervous Definitely don’t use it then. Doesn’t make it insecure. Just elevates your worries ---
**Author:** ![ClaudnDaye](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.fudiabetes.org/claudndaye/32/5_2.png) [@ClaudnDaye](https://forum.fudiabetes.org/u/ClaudnDaye)\ **Post date:** [January 2, 2020, 4:34am UTC](https://forum.fudiabetes.org/t/data-leak-on-nightscout/9031/14 "2020-01-02T04:34:09Z")
OPs question answered. Moving along. 😉 ---
**Author:** ![NickR](https://avatars.discourse-cdn.com/v4/letter/n/dc4da7/32.png) [@NickR](https://forum.fudiabetes.org/u/NickR)\ **Post date:** [January 2, 2020, 4:36am UTC](https://forum.fudiabetes.org/t/data-leak-on-nightscout/9031/15 "2020-01-02T04:36:39Z")
You use mg/dL so you are probably in one of a limited number of countries. You have hidden the panel at the top which shows your name, but that would normally be visible. By hovering over the battery indicator I can see what sort of phone you have. By going into reports I can see your timezone. It is just unheard of in this day and age to put data like this on the web. If you tell me it helps the developers to analyse the performance of their software, that is one thing. Putting personal data on the net with no warning is bad bad practice. ---
**Author:** ![ClaudnDaye](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.fudiabetes.org/claudndaye/32/5_2.png) [@ClaudnDaye](https://forum.fudiabetes.org/u/ClaudnDaye)\ **Post date:** [January 2, 2020, 4:38am UTC](https://forum.fudiabetes.org/t/data-leak-on-nightscout/9031/16 "2020-01-02T04:38:47Z")
> [@NickR](#): > > You have hidden the panel at the top which shows your name, but that would normally be visible. Not true. What is displayed is what i tell ns to display. I could have it read Sams pancreas if i wanted too. > [@NickR](#): > > By hovering over the battery indicator I can see what sort of phone you have. Really? Lol Again… NO PERSONAL DATA. I work in personal data so I’m aware of what constitutes personal data. You’re stretching. You sound like you are definitely NOT a good candidate for NS though… And that’s ok… To each their own. ---
**Author:** ![BrianJ](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.fudiabetes.org/brianj/32/10796_2.png) [@BrianJ](https://forum.fudiabetes.org/u/BrianJ)\ **Post date:** [January 2, 2020, 4:40am UTC](https://forum.fudiabetes.org/t/data-leak-on-nightscout/9031/17 "2020-01-02T04:40:17Z")
You can make Nightscout only accessible to persons you specify in the settings. It depends on how you set it up. ---
**Author:** ![NickR](https://avatars.discourse-cdn.com/v4/letter/n/dc4da7/32.png) [@NickR](https://forum.fudiabetes.org/u/NickR)\ **Post date:** [January 2, 2020, 4:43am UTC](https://forum.fudiabetes.org/t/data-leak-on-nightscout/9031/18 "2020-01-02T04:43:07Z")
Can you enlighten me further? I can’t see that setting. And thank you for an answer that is actually informative and helpful. ---
**Author:** ![ClaudnDaye](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.fudiabetes.org/claudndaye/32/5_2.png) [@ClaudnDaye](https://forum.fudiabetes.org/u/ClaudnDaye)\ **Post date:** [January 2, 2020, 4:43am UTC](https://forum.fudiabetes.org/t/data-leak-on-nightscout/9031/19 "2020-01-02T04:43:11Z")
![image](https://canada1.discourse-cdn.com/flex030/uploads/fudiabetes/original/2X/1/13713674590a4d281b6f64ad068376afebc922de.png) There are a wide array of admin tools for those who need them. ---
**Author:** ![BrianJ](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.fudiabetes.org/brianj/32/10796_2.png) [@BrianJ](https://forum.fudiabetes.org/u/BrianJ)\ **Post date:** [January 2, 2020, 4:44am UTC](https://forum.fudiabetes.org/t/data-leak-on-nightscout/9031/20 "2020-01-02T04:44:19Z")
> **[Authentication Roles - The Nightscout Project](http://www.nightscout.info/wiki/welcome/website-features/0-9-features/authentication-roles)** > > The ability to create tokens to control better control access to and usage of a Nightscout site was introduced with Grilled Cheese (0.9). > > With current authentication options, you can create certain limited-use roles to: > > > Allow a caregiver the... [Next page](https://forum.fudiabetes.org/t/data-leak-on-nightscout/9031.md?page=2)