Privacy Policy

Fat Hack is operated by Kirill Melkozerov, a sole proprietor in Yerevan, Armenia ("we," "us," or "our"), the controller of personal data described here. This policy covers our website, waitlist, and nutrition and habit-building application.

We are committed to protecting your privacy. Please read this policy carefully.

1. Information We Collect

To provide a personalized experience, we collect only the information you provide and technical information needed to run and secure the Service. This includes:

• Contact Information: Your name and email address, used for creating your account, communicating with you, and notifying you (if you are on our waitlist).
• Health and Body Metrics: Information such as your age, weight, height, dietary preferences, and other measurements. This data is the core input for generating your personalized plan.
• Program data: Food photos and descriptions, nutrition estimates, weight and step records, goals, preferences, completed tasks, and coach messages and conversation history.
• Technical data: Session identifiers, IP addresses, user-agent information, timestamps, and operational logs used for authentication, troubleshooting, and security.
• Purchases: When payments are introduced, Paddle will process billing details and payment information. We do not store full payment-card details.

2. How We Use Your Information

We use the information you provide for the sole purpose of delivering and improving the Service. Specifically, we use it to:

• Create and manage your account.
• Provide and Personalize the Service: Your health and body metrics are used by our system to generate your unique nutrition and habit-building plan.
• Communicate with You: To respond to your questions, send important service updates, and provide customer support.
• Improve the Service: To analyze anonymized data for the purpose of enhancing the effectiveness of our programs and features.

3. Disclosure of Your Information

We do not sell your personal data. We will only share your information in the following limited circumstances:

• With Essential Service Providers: We may share data with third-party vendors who perform critical services on our behalf, such as database hosting or server infrastructure. Our infrastructure stores account records, program data, conversations, and photos. Resend processes email addresses and authentication emails. Google Fonts receives technical connection information when your browser loads our fonts.
• AI processing: OpenRouter and its model providers, including Google and DeepSeek, process relevant food photos, food descriptions, and coach conversation/context. DeepSeek also receives nutrition-analysis requests directly. Coach context can include goals, settings, food logs, weight trends, and task progress. These features require sending that information to external providers; do not submit information you do not want processed this way.
• Paddle: Once checkout is available, Paddle processes purchase information as Merchant of Record under its Privacy Policy. We do not send food photos or coach conversations to Paddle to process a payment.
• By Law or to Protect Rights: If we believe the release of information is necessary to comply with a legal obligation, to protect our rights and property, or to ensure the safety of our users.
• Aggregated and Anonymized Data: We may use and share aggregated data that has been stripped of all personal identifiers (and thus cannot be used to identify you) for research or to refine our algorithms.

We will never share your identifiable health data with third-party advertisers.

4. Data Security

We use administrative, technical, and physical security measures to help protect your personal information. While we have taken reasonable steps to secure the information you provide, please be aware that no security measures are perfect or impenetrable.

5. Your Data Rights

You have the right to access, correct, or delete your personal data at any time. To exercise these rights, please contact us at the email address below, and we will process your request promptly.

Where applicable, you may also request portability, restriction of processing, object to processing, withdraw consent, or complain to your local data-protection authority. Contact [email protected]. We may need to verify your identity and will respond within the time limits required by applicable law, normally one month under GDPR. Account-wide erasure is requested through support; signing out or deleting a food entry does not erase all stored data.

6. Children's Privacy

Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children.

7. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last Updated" date.

8. Contact Us

If you have questions or comments about this Privacy Policy, please contact us at: [email protected].

9. Retention, Cookies, and International Processing

Account and program records, photos, and conversations are retained to provide your ongoing history; they do not automatically expire after 30 days. Request erasure through support. Necessary legal, security, and accounting records may be retained where permitted or required by law; backups and provider records may have separate retention periods. A refund is not an account-deletion request.

We use essential authentication cookies to keep you signed in. Blocking them may prevent access to your account. We do not currently use optional third-party analytics cookies.

We operate from Armenia, and external providers may process data outside your country, including outside the EEA. Applicable transfer safeguards are required where data-protection law requires them; use of the website alone is not consent to waive these rights.

10. Grounds for Processing

We process account and service data to perform our contract with you, security and diagnostic data for legitimate interests, and required records to meet legal obligations. Health-related data may receive special protection under applicable law and require explicit consent or another valid legal condition in addition to these grounds. This policy is not itself a request for, or proof of, that consent. Where processing relies on consent, you may withdraw it through support; features requiring that data may then be unavailable.