Privacy Policy

Last updated: 2026-04-19

At Kilotaki ("we", "the app", "the service"), protecting our users' privacy and the security of their personal data is a fundamental priority. This privacy policy comprehensively explains what data we collect, how we use it, whom we share it with, and your rights as our valued user.

By using our application, you accept the terms of this policy. Kilotaki is designed to be fully compliant with the General Data Protection Regulation (GDPR) and equivalent privacy standards worldwide.

1. Personal Data We Collect

Kilotaki collects the following data categories to provide its service:

Account Information: Email address, username, password hash (your password is never stored in plain text — it is one-way hashed using bcrypt).
Health & Fitness Data: Weight entries, height, body measurements (waist, hips, arms, legs, chest, neck, etc.), before/after photos, goals.
Nutrition Data: Meal entries, foods consumed, recipes you create, calorie and macro information.
Usage Data: App preferences (language, theme), device type, browser info, session info.
Communication Data: Messages you send us in support requests.

2. How We Use Your Data

The data we collect is used only for the following purposes:

To provide the core functionality of our service (weight tracking, nutrition logging, macro calculation).
To protect the security and authentication of your account.
To improve the user experience by analyzing app operation (anonymously).
To fulfill legal obligations and resolve legal disputes.
To communicate with you (support responses, important update announcements).

3. We Never Sell Your Data

Kilotaki DOES NOT SELL its users' health, weight, or nutrition data TO THIRD PARTIES. User data is not sold, rented, or shared for commercial purposes to advertising companies, data brokers, or marketing partners. This is a core commitment of Kilotaki.

Your data is shared with third parties only in the following limited circumstances:

With your explicit consent (e.g., when you choose to share your recipes with the community, only the content you share becomes visible).
When legally required (court orders, legal investigations).
Infrastructure providers we use to deliver the service (e.g., database hosting, email delivery) — these providers operate under strict confidentiality agreements and cannot use your data for their own purposes.
Anonymous and aggregated statistics (collective data that cannot identify an individual user).

4. Data Security

Industry-standard security measures are implemented to protect your data:

All data transfers are encrypted via HTTPS / TLS.
Passwords are one-way hashed using the bcrypt algorithm — your original password cannot be seen by us.
Your health data (measurements, photos) is stored in a protected database, accessible only with your own account.
Admin panel access is secured with two-factor authentication (TOTP).
Regular security audits and updates are performed.

5. Data Retention Period

We store your data as long as your account is active. Upon requesting account deletion, your personal data is deleted within 30 days. Certain audit logs (who did what when) may be retained longer due to legal obligations, but these logs do not contain personal identifiers.

6. Your User Rights (GDPR)

Under GDPR and equivalent regulations, you have the following rights:

Right of Access: The right to know what data we hold about you.
Right to Rectification: The right to correct incorrect or incomplete data.
Right to Erasure (Right to be Forgotten): The right to request deletion of your data.
Right to Restriction of Processing: The right to object to specific processing activities.
Right to Data Portability: The right to request your data in a structured format.
Right to Object: The right to object to data processing.

7. Cookies and Analytics

The app uses technical cookies essential for core functionality (session cookies, authentication cookies). Preference cookies (language, theme selection) are stored in your browser's localStorage. No unauthorized third-party tracking or advertising cookies are used.

8. Children's Privacy

Kilotaki is not designed for children under 13 years of age. We do not knowingly collect personal data from users under 13. If we discover that a child under 13 has created an account, the account will be deleted immediately.

9. International Data Transfer

Your data is processed in the data centers of the cloud infrastructure we use to provide the service. For data transfers outside the EU/EEA, GDPR-compliant Standard Contractual Clauses (SCC) or equivalent safeguards are applied.

10. Policy Changes

This privacy policy may be updated from time to time. You will be notified via your registered email address when significant changes are made. The last update date is indicated at the top of the page.

11. Contact

To contact us regarding the privacy policy, data usage, or to exercise your rights, please reach out at: [email protected]