Terms of Service and Privacy Notice
trackchat is operated by COGEN s.r.o., a company registered in the Slovak Republic (IČO 53 187 709), with its registered seat at Južná trieda 1559/20, 040 01 Košice-Juh, Slovakia. In this document, “we”, “us”, “our” and “trackchat” mean COGEN s.r.o.; “you” means the person using the service. You can reach us at any time at info@trackchat.fit.
This document has two parts, and both apply whenever you use trackchat. Part A — Terms of Service is the agreement between you and us. Part B — Privacy Notice explains what personal data we process, why, on what legal basis, and what rights you have over it.
Part A — Terms of Service
These terms are a binding agreement between you and COGEN s.r.o. Please read them, in particular the health and safety section, the section on what our AI can and cannot do, and the section limiting our liability.
1. Accepting these terms
trackchat is a chat-based service, and you accept these terms in the chat: the bot links this page and asks you to reply with a clear acceptance. Replying to accept means you have read this document and agree to it. If you do not agree, do not use the service — until you accept, nothing you send is logged as fitness data or added to your history. Setting up the conversation still creates a minimal account record and keeps the setup exchange itself, as Part B explains; deleting your account erases both.
We record the date and time of your acceptance and the version of the document you accepted, identified by the effective date shown at the top of this page. If we later update this document, we will tell you in the chat, and continuing to use trackchat after that notice means you accept the updated version; where the law requires your explicit agreement to a particular change, we will ask for it in the chat instead.
2. Eligibility
You must be at least 16 years old to use trackchat, and by accepting these terms you confirm that you are. If the law where you live requires a higher minimum age for using a service like this one, or for consenting to the processing of your data, that higher age applies to you instead.
trackchat is for your own personal, non-commercial use. One account per person. You may not use it on behalf of somebody else, or for anyone under the minimum age. If you believe someone under that age is using trackchat, tell us and we will delete the account and its data.
3. What trackchat is
trackchat is a personal fitness-tracking assistant you use by chatting in a messaging app. You tell it, in everyday language, what you ate and drank, the workouts and activities you did, your body weight, your body measurements, your steps and your sleep. You can also send photos — of meals, of nutrition labels, or of your body for progress tracking. trackchat interprets those messages and photos, records them, replies with confirmations and summaries, tracks progress toward goals, and answers questions about fitness and nutrition. A companion web dashboard shows the charts and history that do not fit in a chat message.
Two things follow from that, and they matter:
- trackchat is automated. Replies are generated by software, including AI language models. Nobody reads your messages in order to answer them. A small number of authorised people at COGEN s.r.o. can access stored data where that is necessary to operate, support, secure or debug the service.
- trackchat runs on top of a messaging platform (currently Telegram) that we do not own or control. Your use of that platform is governed by its own terms and privacy policy, it carries your messages to and from us, and it can change or withdraw its service independently of us.
4. Health, fitness and safety — please read this section
trackchat is an information and tracking tool. It is not a healthcare provider and we are not your doctor, dietitian, nutritionist, physiotherapist or trainer.
Not medical or professional advice
Nothing trackchat produces is medical, nutritional, psychological, pharmaceutical or professional fitness advice, and nothing it produces is a diagnosis, a treatment, a prescription, a therapy plan or a substitute for a consultation with a qualified professional who knows your history. trackchat does not diagnose conditions, does not treat or prevent disease, and is not a medical device. We make no medical claims for it, and you must not use it as one.
Answers are generated by AI, and can be wrong
When you ask trackchat a fitness or nutrition question — for example whether a supplement is safe, how often to train a muscle group, or what to eat before a session — the answer is generated automatically by an AI language model from general fitness and nutrition information. It is not reviewed by a professional before you see it, it is not tailored to your medical history, your medication or your circumstances, and it can be incomplete, out of date, or simply wrong while sounding confident. Treat it as a starting point for your own research and for a conversation with a qualified professional — never as an instruction to follow.
Supplements and other substances
Anything trackchat says about supplements, sports nutrition products, vitamins or similar substances is general information, not a recommendation to take them. Their regulatory status, legality, permitted claims and available formulations differ from country to country; they can interact with medication and with medical conditions; and some are prohibited under anti-doping rules that may apply to you as a competing athlete. Check with a doctor or pharmacist before taking anything, and check the rules of your sport yourself.
When to talk to a professional first
Talk to a doctor or another qualified professional before acting on anything trackchat says, and before starting or changing a diet or training routine, if any of the following applies to you:
- you are pregnant, trying to conceive, or breastfeeding
- you have, or have had, an eating disorder or a difficult relationship with food, body weight or exercise
- you have a chronic condition — including diabetes, heart or circulatory disease, high or low blood pressure, kidney or liver disease, a thyroid or hormonal disorder, or a musculoskeletal injury
- you take prescription medication of any kind
- you are recovering from illness, surgery or injury
- you are over 65, or new to exercise after a long break
Calorie tracking and disordered eating
Tracking food, weight and body measurements does not suit everyone. If counting calories, weighing yourself or photographing your body makes you anxious, or pushes you toward restriction, purging or compulsive exercise, please stop using trackchat and speak to a doctor or a support organisation in your country. trackchat will never encourage extreme restriction, but it is an automated tool and it cannot recognise that you are struggling.
Emergencies
trackchat is not an emergency service and is not monitored. If you feel unwell, are injured, or believe you may be having a medical emergency, stop and contact your local emergency number or a health professional immediately. In the EU, the general emergency number is 112.
Physical activity carries risk
Exercise carries an inherent risk of injury, and that risk is yours to manage. Warm up, use a weight and an intensity appropriate to your condition and experience, use correct technique, and stop immediately if you feel pain, dizziness, chest discomfort or shortness of breath.
The decision is always yours
You use trackchat, and act on what it tells you, at your own discretion and at your own risk. Nothing in this section removes any liability that cannot lawfully be excluded — see the section on liability below.
5. Numbers, estimates and accuracy
trackchat estimates figures such as calories, protein, carbohydrate, fat, portion sizes, distances and step counts, and it computes targets such as your basal metabolic rate, daily energy expenditure and recommended intake from the profile you give it.
- Estimates are approximate. They depend on what you tell us, on general food and activity data, and — for photos — on what a model can infer from an image. They are best-effort figures, not measurements, and they can be materially wrong for an individual meal or session.
- Formulas are general-population formulas. The targets are computed with standard published equations from the profile you provide. They describe a statistical average, not you, and they say nothing about whether a target is appropriate for your health.
- Do not rely on them where accuracy matters. In particular, do not use trackchat to manage a medical condition, to dose medication such as insulin, or to make any decision where a wrong number could harm you.
- Your history is not a backup. Keep your own records if the data matters to you; you can export everything at any time (see below).
6. Your account and acceptable use
Your account is tied to your identity on the messaging platform you use. Keep access to that account, and to the device where you open the dashboard, secure — anyone who can use them can use trackchat as you.
To keep the service affordable and available for everyone, use is subject to fair-use limits, including a cap of 200 messages per day, short-term burst limits, and the monthly AI allowances described in the next section. These limits protect the service against runaway or automated use; we may adjust them, and we will not use them to withdraw the paid features you have bought.
You agree that you will not:
- use trackchat for any unlawful purpose, or to harm, harass, defraud or impersonate anyone
- use it on behalf of another person, or create more than one account — in particular, do not delete and re-register to obtain fresh free allowances
- send content you have no right to send, including photos of other identifiable people who have not agreed to it, and any sexual content involving a minor
- automate, script, scrape or bulk-generate traffic to the service, or resell or redistribute it
- attempt to disrupt, overload, probe, reverse-engineer or gain unauthorised access to the service or its infrastructure, or to circumvent its limits, meters or paywall
- deliberately attempt to manipulate the AI into producing harmful, unlawful or misleading output, or into disclosing another user's data or our internal instructions
If you break these rules we may limit, suspend or end your access, with notice where it is reasonable to give it and immediately where it is not. Where the breach is minor and fixable, we will normally ask you to stop first.
7. Free tier and Premium
Free is permanent, not a trial. Deterministic features — logging in the quick formats, summaries, your history, the dashboard, export and deletion — are unmetered. AI-assisted use is metered: 30 AI messages and 5 photo scans per month, counted from your registration anniversary. When the allowance runs out, AI replies stop until it refreshes; logging does not.
Premium costs $4.99 per month or $39.99 per year, in US dollars worldwide, and includes unlimited AI logging, 300 photo scans per month (a higher allowance, not an unlimited one), corrections and advice. The price shown in the chat is the price at checkout; applicable taxes are shown there before you pay.
- A subscription renews automatically at the end of each period, at the then-current price, until you cancel it.
- You can cancel at any time, from the billing portal linked in the chat. Cancelling stops the next renewal and keeps your access until the end of the period you have already paid for. We do not pro-rate part-used periods, except where the law requires it.
- If a payment fails, it is retried over several days; if it keeps failing, Premium ends and your account returns to the free tier. Nothing is deleted.
- We may change the price or the allowances. We will tell you before a change takes effect for you, and never mid-period. If you do not accept a price increase, cancel before your next renewal; continuing past it is acceptance of the new price.
- We may comp an account — grant Premium at no charge — and we may end that at any time with notice, after which the standard price applies if you choose to continue.
8. Payments, invoices and refunds
Payments are processed by Polar Software Inc., which acts as Merchant of Record for the sale. That means Polar, not us, is the seller of record for your purchase: it takes the payment, issues the invoice, and handles the applicable sales tax or VAT. Polar's name, not ours, will normally appear on your card or bank statement. Your purchase is also subject to Polar's own terms and privacy policy, which you accept at checkout.
We never see or hold your card details, billing address or the email address you give at checkout. Our side of a subscription is a tier, a plan, a status, a renewal date and the identifiers that link your account to the subscription.
For a refund, contact Polar, who handle our payments: write to support@polar.sh with the invoice number from your Polar receipt email. Polar takes the payment, issues the refund, and decides refunds that go beyond your statutory rights. Where we promise a refund ourselves below — for a change that materially reduces the service, or for access we end for something other than your breach — that commitment stays ours. Your statutory rights, including the withdrawal right below, are not affected by anything in this section.
9. Right of withdrawal — consumers in the EU and EEA
If you are a consumer in the EU or the EEA, you have the right to withdraw from a purchase of Premium within 14 days, without giving a reason. The period starts on the day the contract is concluded.
To withdraw, send a clear statement to Polar at support@polar.sh — an email saying you withdraw is enough, and there is no form to fill in. You can also tell us at info@trackchat.fit and we will pass it on. The payment you made is refunded using the same means of payment, within 14 days of being informed.
Because Premium is a digital service that starts working the moment you buy it, by completing checkout you expressly request that we begin performance immediately, during the withdrawal period, and you acknowledge that once the service has been fully performed you lose the right to withdraw from it. If you withdraw after performance has begun but before it is complete, you owe us a proportionate amount for what was supplied up to that point, and we refund the rest.
Consumers outside the EU and EEA may have equivalent rights under their own law; nothing here limits them.
10. Referral codes and discounts
A creator may give you a code to type into the chat. Typing a valid code attaches a 10% discount to your account, which is applied every time a checkout is created for you, including at renewal, for as long as your subscription continues.
- One code, first one wins. The first valid code your account accepts is permanent and cannot be swapped, removed or stacked with another offer.
- An invalid code does nothing — it is answered plainly and nothing is stored, so you can simply type it again.
- A discount is not cash. It has no cash value, is not transferable, and cannot be exchanged for a refund of a payment already made.
- If you already pay full price, the discount applies from your next checkout rather than retroactively.
- A comped account gets no discount, because there is nothing to discount.
- We may end the referral programme for new sign-ups at any time; a discount already attached to your account keeps applying to your renewals.
11. The dashboard
The dashboard lives on its own web address and shows your charts, history and photos. Access works like this: you ask for it in the chat, we send you a single-use link that expires in 15 minutes, and opening it signs that one device in for up to a year. There is no password, and the web address itself is not a secret — the sign-in lives in the cookie on your device.
So: do not forward that link to anyone, and do not open it on a shared or public device. If a device is lost or shared, deleting your account ends every session; tell us and we can also invalidate them. Deleting a photo from the dashboard deletes it for good.
12. Availability and changes to the service
We work to keep trackchat available, but we do not guarantee it will be uninterrupted or error-free. It depends on third parties — a messaging platform, cloud infrastructure, AI providers and a payment processor — and any of them can fail, change or withdraw their service.
We may add, change or remove features, including the AI models behind the service and the providers who run them. If we make a change that materially reduces what you have paid for, we will tell you and, if you are not happy with it, you can cancel and we will refund the unused part of the period. If we discontinue trackchat altogether, we will give you reasonable notice, stop charging, refund the unused part of any period paid for, and keep the export working so that you can take your data with you.
13. Your content and our content
Yours stays yours. The entries you log and the photos you send remain yours. You grant us a limited, worldwide, royalty-free licence to store, copy, transmit, adapt and display that content solely to provide the service to you — which includes transmitting it to the sub-processors listed in Part B, and displaying it back to you in the chat and on the dashboard. That licence ends when the content is deleted. We do not use your content for advertising, do not publish it, do not sell it, and do not use it to train AI models.
Ours stays ours. The trackchat software, brand, name, look and the text of this site are ours or our licensors', and using the service gives you no rights in them beyond using it as intended.
Feedback you volunteer about trackchat — suggestions, bug reports, feature ideas — we may use freely and without obligation to you.
14. Ending it
You can leave at any time. Ask in the chat to delete your account and, after a confirmation step, everything is erased from our live systems — see Part B for exactly what that means and for the one small marker that survives it.
We may end or suspend your access if you materially breach these terms, if we are required to by law, or if we discontinue the service. Where we end your access for something other than your breach, we refund the unused part of any period you have paid for.
Dormant accounts are deleted automatically. If you do not use trackchat for 2 years, we delete your account and all its data in the same way a self-requested deletion works, so that dormant data does not sit around indefinitely. Any message keeps the account active. Separately, if you hold a subscription but stop using the service entirely for 1 year, we cancel that subscription at the end of the paid period rather than letting it renew against a service you are not using.
15. No warranty
trackchat is provided “as is” and “as available”, without warranties of any kind, whether express or implied, including any implied warranty of merchantability, fitness for a particular purpose, accuracy or non-infringement. We do not warrant that the service will be uninterrupted, secure or error-free, that any figure, estimate or answer it produces is accurate or complete, or that it will produce any particular health, fitness or body-composition result.
Where you are a consumer, this section does not exclude the statutory guarantees you have under the law of your country of residence, which apply regardless of anything written here.
16. Limitation of liability
Nothing in these terms limits or excludes our liability for death or personal injury caused by our negligence, for fraud or fraudulent misrepresentation, for gross negligence or wilful misconduct, or for anything else that cannot lawfully be limited — including the mandatory rights of consumers.
Subject to that, and to the fullest extent permitted by law:
- We are not liable for indirect, incidental, special or consequential loss, for loss of profit, revenue, data, or goodwill, or for any health, dietary, training, competitive or body-composition outcome arising from your use of, or reliance on, trackchat.
- We are not liable for loss arising from a third-party service failing, changing or withdrawing — a messaging platform, a cloud provider, an AI provider or the payment processor.
- Our total aggregate liability for all claims arising in any 12-month period is limited to the greater of the total amount you paid us in that period and EUR 50.
You are responsible for how you act on what trackchat tells you, and for keeping your own copy of any data that matters to you.
17. Complaints, governing law and disputes
If something is wrong, write to info@trackchat.fit first. We aim to acknowledge a complaint within 5 working days and to resolve it within 30 days.
These terms, and any dispute arising from them or from your use of trackchat, are governed by the law of the Slovak Republic, and the courts of the Slovak Republic have jurisdiction. If you are a consumer, this does not deprive you of the protection of the mandatory rules of the law of your country of residence, and you may also bring proceedings in the courts of that country.
If you are a consumer and we cannot settle a complaint between us, you may refer the dispute to the Slovak alternative dispute resolution body, the Slovak Trade Inspection (Slovenská obchodná inšpekcia), Bajkalská 21/A, 827 99 Bratislava, Slovakia — soi.sk — or to an ADR body in your own country. Using ADR is voluntary for both sides and does not affect your right to go to court.
18. General
- Changes to these terms. We may update this document. Each version carries the effective date shown at the top. When we make a change that affects you, we will tell you in the chat, and continuing to use trackchat after that notice means you accept the updated version; for corrections that change neither your rights nor your obligations, the updated effective date on this page is enough. If you do not want to accept a change, stop using the service and, if you wish, delete your account. Where the law requires your explicit agreement to a particular change, we will ask for it in the chat instead of relying on your continued use.
- The whole agreement. This document, together with anything we tell you in the chat about a price or an allowance, is the entire agreement between us about trackchat, and replaces anything said earlier.
- If part of it fails. If any provision is held invalid or unenforceable, the rest stays in force and the invalid part is treated as replaced by the closest valid provision.
- No waiver. If we do not enforce something immediately, we do not lose the right to enforce it later.
- Transfer. You may not transfer your account or your rights under these terms. We may transfer ours to a successor if our business is reorganised or acquired, provided your rights are not reduced; we will tell you in the chat if that happens.
- Notices. We normally reach you in the chat; you reach us at info@trackchat.fit.
- Events outside our control. We are not responsible for a failure to perform caused by something beyond our reasonable control, for as long as it lasts.
- Language. The English version of this document is the binding one. Any translation is provided for convenience, and in case of a discrepancy the English text prevails.
Part B — Privacy Notice
This part explains what personal data we process, why, on what legal basis, who else sees it, how long we keep it, and what you can require of us. It is written to satisfy Articles 13 and 14 of the EU General Data Protection Regulation (GDPR).
19. Who is responsible for your data
The data controller is COGEN s.r.o., Južná trieda 1559/20, 040 01 Košice-Juh, Slovakia, IČO 53 187 709, reachable at info@trackchat.fit. We have not appointed a data protection officer, because we are not required to; the address above reaches the people who decide these things.
20. What we collect
- An account identifier from the messaging platform — for example your Telegram user ID. The record is created the first time you message the bot, before you accept this document, so that the setup conversation can happen at all. We deliberately do not store your name or username.
- Your messages and our replies. We keep a record of each processed exchange: what you sent, what we replied, what the system understood it to mean, and technical details of the turn. This is what makes corrections, summaries, support and debugging possible. This includes the setup exchange before acceptance — which question we asked and what you answered — kept separately from your later conversations and erased with your account.
- The fitness data you log — food and drink, workouts and activities, body weight, body measurements, steps, sleep and water, with their dates and times, plus the personal bests and streaks derived from them.
- Photos you send — of meals, of nutrition labels, and body progress photos if you choose to send them, together with the date and the pose we infer. Photos are stored privately in encrypted storage in the EU, and we strip location and other embedded metadata (EXIF/GPS) on receipt, so a photo does not reveal where it was taken.
- Profile inputs you provide so calculations can be personalised: sex, height, age or year of birth, activity level, diet phase, your daily goals, your unit system, date format and language.
- A timezone, from a one-off setup step, stored as a region name (for example Europe/Bratislava) so your days line up correctly. This is not your location and is not used to track where you are.
- Subscription state — your tier, plan, status, renewal date, and the identifiers that link your account to your subscription at our payment processor. Not your card, address or billing email.
- A referral code, if you typed one — the creator's code, which identifies the creator, not you.
- Usage counters needed to run the meters and limits: messages today, AI messages and photo scans this month, dashboard loads today.
- Technical logs produced by the infrastructure while handling your requests, retained briefly for operations and security.
We do not collect your name, phone number, email address (unless you write to us), postal address, payment card details or precise location. We do not use advertising or cross-site tracking technologies of any kind.
21. Why we process it, and on what legal basis
- To provide the service you asked for — recording your entries, generating replies, summaries, charts and progress. Legal basis: performance of a contract with you, Article 6(1)(b) GDPR.
- Health-related data. Body weight, body measurements, body progress photos and anything health-related you choose to type are special-category data. We process them only on the basis of your explicit consent, Article 9(2)(a) GDPR, which you give by accepting this document, and which you can withdraw at any time (see your rights). Because these are the core of what trackchat does, withdrawing consent means we can no longer provide the service.
- To take payment, invoice you and meet tax obligations. Legal bases: contract, Article 6(1)(b), and legal obligation, Article 6(1)(c).
- To keep the service secure, working and affordable — enforcing caps and meters, preventing abuse and fraud, retaining the anti-abuse marker described below, monitoring for faults, and debugging failures using stored exchanges. Legal basis: our legitimate interests, Article 6(1)(f), in running a service that is not degraded or exploited. We have balanced this against your interests; you may object at any time (see your rights).
- To improve trackchat — understanding, in aggregate, which features are used and where the system gets things wrong. Legal basis: legitimate interests, Article 6(1)(f). The statistics we keep for this are aggregated counters that carry no message text and are not linked to you.
- To communicate with you about the service — billing confirmations, changes to these terms, and answers when you write to us. Legal bases: contract and legitimate interests.
We do not make decisions about you by solely automated means that produce legal effects or similarly significantly affect you.
22. The AI providers, and what leaves the EU
To understand your messages and photos, we send their content to AI providers who process it on our behalf as processors and return a result. They are told to use it only to answer our request, and not for their own purposes. This is the part of the service that involves transfers outside the European Economic Area, so we set it out plainly:
- Google (Gemini) — the primary model for both message text and photos. Your message content, the recent conversation context needed to interpret it, and photos you send, including body progress photos (to identify the pose), are processed by Google, which may process them outside the EEA, including in the United States.
- OpenAI — the standby model for both, used only when Google is unavailable, processing the same content, in the United States.
Those are the only two AI providers we use, and both are United States companies: no part of your conversation is processed in a country the European Commission has not approved for transfers. Transfers to the United States are covered by the Commission's adequacy decision of 10 July 2023 for organisations certified under the EU–US Data Privacy Framework, and both providers are certified under it. Each provider's data processing terms additionally include the Commission's Standard Contractual Clauses, so a second lawful basis stands on its own if that decision is ever withdrawn. Beyond the legal basis, we keep what we send to a minimum: the content of a message or photo and never your name, email, phone number, payment details or precise location, and the identifier attached to your data is a platform user ID rather than an identity.
Nothing is sent to an AI provider for training. We use both providers on paid API terms, under which customer content is not used to train their models. We do not permit them to use your content to train or improve their models, and we do not do so ourselves.
If you would rather your body progress photos were never processed by an AI provider, do not send them: everything else in trackchat works without them.
23. Who else receives your data
We do not sell your data, and we do not share it for anyone else's marketing. Besides the AI providers above, the recipients are:
- Amazon Web Services (AWS) — hosting, databases and photo storage, in the EU (Frankfurt, eu-central-1). A processor acting on our instructions.
- The messaging platform you chat through (currently Telegram) — it carries your messages to and from trackchat under its own terms and privacy policy, as an independent controller of the messaging layer. What you send through it is subject to its policies as well as ours.
- Polar Software Inc. — payments, invoicing and tax, as Merchant of Record. It collects your payment details, billing country and checkout email directly from you, as a controller in its own right, under its own privacy policy. We receive only the subscription facts listed above.
- Professional advisers, and public authorities where we are legally required to disclose something, or need to establish or defend a legal claim.
- A successor, if our business is reorganised, merged or acquired — in which case your data moves with the service, on these same terms, and we tell you in the chat.
24. How long we keep it
- While you use trackchat, we keep your data so your history and progress stay available to you.
- If you delete your account, we erase it from our live systems immediately and completely — every entry across all tracking types, your progress-photo images, your profile, your stored exchanges and your dashboard sessions. There is no soft delete, no grace period, and no recovery. Two things outlast that, both described below: the anti-abuse marker, and encrypted backups, which age out within 35 days.
- One small marker deliberately survives a deletion, so that deleting and re-registering cannot reset the free allowances or the abuse limits. It contains a one-way hash of your platform identifier, the date and kind of closure, the counters carried over, and — if you gave one — the free-text reason you typed when leaving. It holds no logs, no profile and no content, and we cannot reverse the hash into an identifier; but the same platform identifier would produce the same marker again, which is exactly what makes it work. Legal basis: our legitimate interest in preventing abuse of a free allowance. If you would rather not give a reason for leaving, say so — the step is optional and skipping it does not block the deletion.
- Dormant accounts are deleted automatically after 2 years with no activity.
- Technical logs are kept for 14 days.
- Encrypted point-in-time backups of the databases exist for operational recovery, and deleted records may persist in them for up to 35 days before they age out. They are not readable by the service and are never used to restore an individual account after a deletion.
- Billing records are kept by our payment processor for as long as tax and accounting law requires (typically 10 years in the EU); that retention is Polar's, under its own policy.
25. Security
Your data is encrypted in transit and at rest. Photos live in a private, encrypted store that has no public address: the dashboard shows them through short-lived signed links that expire within an hour, and there is no permanent public URL for an image. Access to production systems is restricted and least-privilege, and the dashboard session cookie is issued as `HttpOnly`, `Secure` and `SameSite=Lax`.
No system is perfectly secure. If a breach ever affects your personal data and is likely to result in a high risk to you, we will tell you, and the supervisory authority, as the GDPR requires.
26. Cookies
We use the minimum a working site needs, and none of it is for advertising or analytics:
- A dashboard session cookie, set only when you open a sign-in link from the chat. It keeps you signed in on that device for up to a year and is strictly necessary for the dashboard to work at all.
- A language preference cookie on the trackchat.fit website, set only when you choose a language, so the site remembers it.
There are no third-party cookies, no advertising identifiers, and no cross-site tracking. Because both cookies are strictly necessary or set at your own request, no consent banner is required for them.
27. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you, and get a copy of it;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to processing based on our legitimate interests;
- receive your data in a portable, machine-readable format;
- withdraw your consent to the processing of health-related data at any time, which does not affect processing already carried out;
- not be subject to a solely automated decision producing legal or similarly significant effects (we make none).
Two of these you can exercise yourself, in the chat, at any moment and on any tier: ask to download your data and trackchat sends you a complete machine-readable export, with signed links for your photos; ask to delete your account and, after a confirmation step, everything goes. For anything else — correction, restriction, objection, or a question about this notice — write to info@trackchat.fit. We answer within one month, and will tell you if a request needs longer or if we need to verify that the request is really yours. Repeated exports are rate-limited, as the GDPR allows for manifestly excessive requests.
You also have the right to complain to a supervisory authority — the Slovak one is the Úrad na ochranu osobných údajov Slovenskej republiky (dataprotection.gov.sk) — or to the authority in the EU country where you live or work.
28. Children
trackchat is not for people under 16. We do not knowingly collect data from anyone under that age. If you believe a child is using trackchat, write to info@trackchat.fit and we will delete the account and its data.
29. Changes to this notice
We may update this notice as the service changes — for example if we change AI provider. The effective date at the top of this page always identifies the current version, and we will tell you in the chat when a change affects you. Where a change needs your consent, we will ask for that consent before it takes effect.