Privacy Policy
Last updated:
This policy explains what data Chamiko (chamiko.ge) collects, why, and what rights you have. Processing is carried out under the Law of Georgia on Personal Data Protection.
Data controller: [Registered company name] (ID [XXXXXXXXX]), [Registered address, Georgia]. Questions: privacy@chamiko.ge.
The Georgian version of this policy is the authoritative one. This translation is provided for convenience.
1.What we collect
Only what the service needs to work:
- Account data: your email, a cryptographic hash of your password (never the password itself), and your name and profile picture if you provide them or sign in with Google.
- Health-related data: sex, date of birth, height, weight and its history, activity level, and your goals.
- Food diary: what you ate and when, quantities, and any foods or recipes you create.
- Technical data: a session cookie, your IP address, and server logs, for security and reliable operation.
2.Health data is a special category
Under Georgian law, weight, height, age and dietary records count as special category data. We process it only with your explicit consent, which you give when you create an account.
You can withdraw that consent at any time, which means closing your account, because the service cannot function without this data. Withdrawal does not affect processing already carried out lawfully.
3.Why we process it
- Performance of a contract: running your account, storing your diary, and calculating your daily targets.
- Your consent: processing of health-related data.
- Legitimate interest: keeping the service secure and preventing abuse and fraud.
4.Where your data is stored
Data is held on a server under our control, located physically outside Georgia, in the European Union. This constitutes a cross-border transfer of personal data.
The European Union provides adequate data protection safeguards. The database is not publicly reachable and connections to it are encrypted.
6.Retention and deletion
We keep your data for as long as your account is active. When you delete your account, your profile, diary, weight history and recipes are permanently deleted within 30 days.
Foods you contributed to the shared database may remain in anonymised form, unlinked from you, because other people rely on them.
7.Your rights
Under the Law of Georgia on Personal Data Protection you have the right to:
- Be told what data we process about you, and receive a copy of it free of charge.
- Have inaccurate or incomplete data corrected or updated.
- Have your data erased, or processing of it stopped.
- Have processing restricted (blocked).
- Withdraw your consent at any time.
- Receive your data in a machine-readable format.
8.Complaints
If you believe your rights have been breached, write to us first at privacy@chamiko.ge. We reply within 10 working days.
You also have the right to complain to the supervisory authority, the State Audit Office of Georgia, which took over supervision of personal data protection on 2 March 2026 (these matters were previously handled by the Personal Data Protection Service).
9.Security
- Passwords are stored hashed with bcrypt, so not even we can read your password.
- All connections are encrypted with HTTPS.
- The database is reachable only from the server and is not exposed to the internet.
- In the event of a breach we notify the supervisory authority within 72 hours, as the law requires.
11.Age limit
The service is intended for people aged 16 and over. If we find an account belongs to someone under 16 without the consent of a parent or legal guardian, we will delete it.
12.This is not medical advice
Chamiko is a tracking tool, not a medical service. Calorie and nutrient values, particularly for prepared dishes, are estimates computed from standard recipes. Talk to a doctor before changing your diet or training.
13.Changes to this policy
If we make a material change we will tell you by email or in the app before it takes effect.