Privacy Policy.

Who processes the data

The data operator is Ящук Николай Сергеевич, self-employed in Russia, tax ID 132406981800, owner of the FITCHECK service at fitchecly.com (referred to here as “FITCHECK” or “we”). A postal address for requests has not yet been provided. Operator contacts: privacy@fitchecly.com, +7 902 230-99-66.

This policy covers the website, virtual fitting room, AI stylists, and related account features.

What data we collect

• Sign-in data: account identifier, name, and email received from Google or Yandex ID. We do not see or store your Google or Yandex password.
• Profile: your FITCHECK name, selected styles, optional height and weight, plan, COINS balance, and selected stylists.
• User content: uploaded photos of people and clothing, messages to AI stylists, replies, fitting results, and links found.
• Technical data: session token, request times, operation status, and minimal security and error logs.

FITCHECK does not use photos to identify people or create biometric templates. However, a photo of a person may be treated as sensitive or biometric data under the laws of your country. Upload only your own photos or material you are authorized to use.

Why we use the data

We use data to create and protect your account, save settings, show history, perform virtual fittings, give styling advice, find items on request, apply plan features, prevent abuse, and fix errors.

The grounds for processing are performance of the user agreement, actions you request, your consent for optional data, and our legitimate interest in service security, to the extent permitted by applicable law.

Who receives the data

• Google or Yandex ID — for sign-in only. Each provider has its own privacy policy.
• Cloudflare — website hosting, D1 database, R2 image storage, delivery, and protection.
• OpenAI API — processing messages and, when a feature requires it, photos to produce a stylist reply or fitting result. According to current OpenAI documentation, API data is not used to train or improve models by default unless the API account owner separately enables data sharing.
• Provod AI — processes requests from Russia, including messages and photos when needed for stylist replies or fittings. Data is sent through the Provod API to fulfill the request.
• Search services through OpenAI — when you enable search or explicitly ask us to find an item. The search query may be sent to obtain current results.

Robokassa — online payment processing when COINS checkout is available in your account shop. FITCHECK sends the invoice number, technical order identifier, pack details, RUB amount, and receipt details. The buyer enters payment information and receipt contact details on the Robokassa page; Robokassa processes them under its own privacy policy. FITCHECK keeps the account and order identifiers, selected plan or COINS pack, RUB amount, payment status and dates, and the confirmed payment identifier. These records support access accounting, prevention of duplicate grants, support, and refunds. FITCHECK does not receive or store bank card details. You may send payment information to privacy@fitchecly.com when asking about a purchase.

Who may access photos. Through the website, photos are available to the account owner, not other users. The FITCHECK owner and cloud infrastructure administrators may technically access stored files. When you create a fitting or send a photo to a stylist, the image is sent to OpenAI or Provod AI according to the connection country to process the request.

We do not sell personal data or use photos or conversations for targeted advertising.

The one-time free fitting and Premium gift retain a private hash of the sign-in account identifier (Telegram, Google or Yandex) and the time each benefit was used. This minimal marker remains after profile deletion to prevent another fitting or gift for the same sign-in account. It does not restore deleted balance, access, photos or conversations and contains no name, email address or token. The hash is a pseudonymous identifier, not a fully anonymous record.

The one-time channel bonus uses a private hash of the numeric Telegram ID and the grant time. This minimal marker remains after profile deletion to prevent another bonus for the same Telegram account. It contains no name, photos, conversations, session or balance. It is a pseudonymous identifier, not a fully anonymous record.

Telegram — Mini App sign-in and Stars payments. FITCHECK verifies signed launch data and receives your numeric user ID, name and username if present. We do not request your Telegram password or phone. Stars invoices send the purchase description, XTR amount and technical order ID. FITCHECK retains the order’s account and Telegram ID, product, Stars amount, consent version and time, payment status and times, Telegram confirmation and refund records for accounting, duplicate-grant protection and support. Order and confirmation records remain separately after account deletion under the deletion section.

Support messages sent to @fitchecly_bot are copied to the FITCHECK owner, whose replies are delivered through the bot. Telegram processes this conversation under its own rules. FITCHECK stores the owner’s private chat address and message links for reply delivery; support links expire after 7 days. Message text and attachments are not written to the FITCHECK database. For purchases, send /paysupport from the Telegram account that paid.

Bug reports are delivered through bot support. Technical links to the original account are valid for seven days and are cleared during subsequent successful queue processing. After manual approval, the report number, internal account ID, COINS amount, numeric owner ID, award command number and reward time are retained. This ledger remains after profile deletion for accounting and duplicate-grant protection; no separate deletion period is set. It contains no report text or attachments and does not restore a deleted balance.

How long data is kept

• An OAuth sign-in request remains valid for up to 10 minutes. Expired records are deleted during subsequent sign-in attempts.
• A sign-in session remains valid for up to 30 days and can end earlier when you sign out. Expired records are deleted during subsequent sign-ins; until then, they do not grant access.
• Your profile, photos, fitting results, and conversations are kept while your account exists or until you delete the relevant data. After deleting an individual chat, only technical request accounting rows remain, without message text, replies, links, or attachments, until the account is deleted.
• Deleted data is removed from the active database and object storage. Earlier states may temporarily remain in provider-managed disaster recovery systems and technical logs for periods determined by the provider’s current plan, settings, and policies. They are not used in normal account operation.
• According to current OpenAI documentation, standard abuse monitoring logs may contain some submitted content and are typically kept for up to 30 days. Longer retention is possible when required by law or reasonably necessary to protect OpenAI services or third parties.

Deletion and your rights

You can delete individual photos or your entire account in your profile. In each stylist’s chat, you can delete the conversation with that character and photos sent only to that chat. Deleting an account clears active profile records, the FITCHECK OAuth identity, sessions, chats, request accounting rows, results, and all user files. Earlier order and payment confirmation records are kept separately and are not automatically deleted with the account; a separate deletion period has not yet been established. Contact privacy@fitchecly.com about these records or refunds.

Depending on your country, you may also request access, correction, restricted processing, portability, or object to processing. Use the operator contacts above. We may ask you to verify your identity to protect your account.

Security and international processing

We use HTTPS, HttpOnly sessions, ownership checks for each object, and private server keys. No storage method can guarantee absolute security.

Cloudflare, OpenAI, Provod AI, Google, and Yandex may process data in countries other than yours. Such transfers support the selected feature and are governed by the relevant provider’s terms and applicable law.

Changes to this policy

We may update this policy when features or laws change. A new version will be posted here with a new date. For significant changes, we will try to show a notice in the service.