Privacy Policy

1.What we collect

Only what the service needs to work:

• Account data: your email, a cryptographic hash of your password (never the password itself), and your name and profile picture if you provide them or sign in with Google.
• Health-related data: sex, date of birth, height, weight and its history, activity level, and your goals.
• Food diary: what you ate and when, quantities, and any foods or recipes you create.
• Technical data: a session cookie, your IP address, and server logs, for security and reliable operation.

2.Health data is a special category

Under Georgian law, weight, height, age and dietary records count as special category data. We process it only with your explicit consent, which you give when you create an account.

You can withdraw that consent at any time, which means closing your account, because the service cannot function without this data. Withdrawal does not affect processing already carried out lawfully.

3.Photo estimation and AI

When you upload a photo of a meal, it is sent to an AI provider, Google (Gemini) and/or OpenAI (GPT), to work out what is on the plate and roughly how much. The photo is sent for that purpose only, and only when you press the estimate button yourself.

When the first model is not sure, we send the same photo to the second provider to check it. Both providers receive only the photo and any note you typed with it. Nothing else about you goes with it: not your name, not your email, not your diary.

We do not store the photo. It is processed for the length of the request and is never written to our server or our database. We keep only a cryptographic hash of it, from which the image cannot be reconstructed.

If you correct an estimate, we store the correction itself (what the system said and what you said) so we can measure and improve accuracy. That record contains no photo.

Processing by those providers is governed by their own policies. If you would rather not send a photo anywhere, simply do not use photo estimation; the rest of the app works fully without it.

4.Why we process it

• Performance of a contract: running your account, storing your diary, and calculating your daily targets.
• Your consent: processing of health-related data.
• Legitimate interest: keeping the service secure and preventing abuse and fraud.

5.Where your data is stored

Data is held on a server under our control, located physically outside Georgia, in the European Union. This constitutes a cross-border transfer of personal data.

The European Union provides adequate data protection safeguards. The database is not publicly reachable and connections to it are encrypted.

6.Who we share it with

We do not sell your data and we do not pass it to anyone for advertising. It is accessible only to:

• Our hosting provider, which operates the server as a technical processor.
• Google, only if you choose to sign in with Google, in which case Google shares your email, name and profile picture with us. The same applies to Apple if you sign in with Apple.
• Resend, an email delivery service, only when we send you an email confirmation or a password reset. It receives your email address and the text of the message.
• Google (Gemini) and OpenAI (GPT), only when you use photo or text estimation. They receive the photo or the description of the meal, and your note, and nothing else.
• Your browser's push service (Google, Apple or Mozilla, depending on your browser), only if you turn on evening reminders. We store the device's push address; the reminder text passes through the service encrypted. Turning reminders off deletes the address.
• State authorities, where the law directly requires it.

7.Retention and deletion

We keep your data for as long as your account is active. When you delete your account, your profile, diary, weight history and recipes are permanently deleted within 30 days.

Foods you contributed to the shared database may remain in anonymised form, unlinked from you, because other people rely on them.

8.Your rights

Under the Law of Georgia on Personal Data Protection you have the right to:

• Be told what data we process about you, and receive a copy of it free of charge.
• Have inaccurate or incomplete data corrected or updated.
• Have your data erased, or processing of it stopped.
• Have processing restricted (blocked).
• Withdraw your consent at any time.
• Receive your data in a machine-readable format.

9.Complaints

If you believe your rights have been breached, write to us first at privacy@chamiko.ge. We reply within 10 working days.

You also have the right to complain to the supervisory authority, the State Audit Office of Georgia, which took over supervision of personal data protection on 2 March 2026 (these matters were previously handled by the Personal Data Protection Service).

10.Security

• Passwords are stored hashed with bcrypt, so not even we can read your password.
• All connections are encrypted with HTTPS.
• The database is reachable only from the server and is not exposed to the internet.
• In the event of a breach we notify the supervisory authority within 72 hours, as the law requires.

11.Cookies

We use only the cookies the service needs to work: a session cookie that remembers you are signed in, a CSRF protection cookie, your chosen language (NEXT_LOCALE), your Chamiko+ colour theme (chamiko_accent, kept for one year), light or dark mode if you chose one yourself (chamiko_theme, kept for one year), and your cookie choice itself (chamiko_consent, kept for six months). We use no advertising or tracking cookies.

A cookie notice appears on your first visit. Optional categories, analytics included, are off by default, and nothing loads until you consent. You can change your choice at any time from the Cookie settings link in the footer.

If you turn analytics on: our own server counts the date, the page address, the language, the referring domain, and whether you are on a phone or a desktop. Only totals are stored, with no record of individual visits, no IP address and no identifier of any kind, so even we cannot tie these numbers to a person. We use no third-party analytics service, and no extra cookie is set for this.

12.Age limit

The service is intended for people aged 16 and over. If we find an account belongs to someone under 16 without the consent of a parent or legal guardian, we will delete it.

13.This is not medical advice

Chamiko is a tracking tool, not a medical service. Calorie and nutrient values, particularly for prepared dishes, are estimates computed from standard recipes. Talk to a doctor before changing your diet or training.

14.Changes to this policy

If we make a material change we will tell you by email or in the app before it takes effect.