Archive of a previously published revision. The service description may have changed. Read the current document.
Updated: 5 November 2026
Mobile consent disclosure identifier: 2026-11-04.
Русская версия · Health data policy · Deletion
This update describes the separate product-statistics choice and account-wide withdrawal, alongside the existing processing, recipients and retention. Publication is not consent. Previous revision.
Raisat Ramazanova, an individual developer based in Serbia, operates MorphTrack (also called Morph). MorphTrack is a trade name, not a separate legal entity. Contact: morphtrack.app@gmail.com.
This policy covers the app and website. Our separate Consumer Health Data Privacy Policy explains health-related information.
Photo metadata: uploaded images are re-encoded to remove embedded camera metadata, including GPS tags. We separately retain photo dates and image dimensions for the journal. Re-encoding does not remove information visible in a picture or text you enter.
Account and journal data provide the features you request; purchase records validate subscriptions; support messages let us answer you; limited technical records support operation, security and troubleshooting.
Where GDPR or comparable rules apply, our grounds are performance of the service contract, legitimate interests in security and reliability, legal obligations, and consent for optional processing that requires it. Health data also requires a separate permitted basis under sensitive-data rules. Where explicit consent is required, it must cover the relevant purpose and be obtained separately. Accepting this policy or uploading a photo does not by itself establish that consent. In app versions that support the updated choices, one screen explains journal processing, optional OpenAI sharing and optional product statistics. You separately confirm that you are 18 or older and accept the Terms/acknowledge the Privacy Policy, then choose each processing permission independently. The processing choices start off; continuing records only the choices you actually make, with the disclosure version and date. AI and statistics are optional. Older app versions may not show all controls; they do not gain analytics permission automatically. Update the app or contact us to manage these choices. Once saved, account permissions apply across devices, including older versions.
You may withdraw consent without affecting processing already lawfully carried out. A feature may stop working if it needs the data covered by withdrawal. Controls and requests are described below.
Only with your separate, optional journal-statistics permission do internal dashboards use account identifiers, recent authenticated activity, and the dates, counts, types and statuses of registrations, photos, trackers, factors, routine marks, analyses and subscriptions to evaluate active/returning use, feature adoption and subscription conversion. Reports may also group tracker and factor names, including names you enter. Those names can reveal health information. Calculations may include journal records saved before you opted in. Photo contents, notes, analysis text, optional profile details, email addresses and device details are not used in these product-statistics queries. Data is processed by the infrastructure providers described below; it is not sent to OpenAI for statistics.
The source records remain account-linked even when a report displays totals. Refusing statistics does not restrict the journal, AI or purchases. Without a current explicit grant, an account is excluded from product dashboards regardless of app version. In versions with this control, turn off statistics in More → About → AI and your data, or contact us. Withdrawal excludes your account from future calculations and clears the recent-activity timestamp; it does not automatically delete the underlying journal or subscription records needed for their original purposes. Withdrawing journal permission also stops AI and statistics. Necessary sign-in, payment, error and security monitoring remains separate and does not depend on this optional choice. Website analytics is separate too.
To detect failures of sign-in, registration, purchases, email flows, photo upload and analysis, the app sends a small operational event to our API. It contains a random event identifier, a predefined failure category and reason, iOS/Android, app version/build and event time. It does not contain an account/device identifier, email, photo, journal text, receipt, token, raw error message or stack trace. These diagnostics are used to detect and troubleshoot failures, not to measure product engagement, and do not depend on optional product-statistics permission. They can be sent before sign-in.
Unhandled Dart/Flutter errors are included. Where the operating system makes them available, we also receive a coarse crash/hang category: Android 11+ reports this on a later launch; iOS MetricKit may deliver it later and its timestamp represents a reporting window. No full OS diagnostic payload or memory contents are transmitted. Collection is best-effort and does not cover every failure. Expected cancellation is not reported as a failure.
The app bounds and deduplicates its queue, retaining pending events for up to seven days and retrying when it can connect. Events pass through Cloudflare to our DigitalOcean-hosted API and central logs, configured for 30-day retention; a hash of the random event identifier is retained for up to seven days to prevent duplicate delivery. Network infrastructure still processes IP addresses for delivery/security; therefore we do not describe these events as anonymous. Expired local events are discarded when the app runs; deleting an account does not immediately erase dormant device or device-backup copies. Device backups follow your OS settings. Replay-prevention hashes may remain in restricted database backups under the periods below. Events are not sent to OpenAI and do not authorise a purchase or change your permissions. Apple/Google may separately process diagnostics under your platform settings.
AI journal analysis starts when you request it and have enabled AI sharing. We send OpenAI selected photos and dates, tracker name/goal and capture settings, relevant routine/ongoing factors and dates, app language, and previous-analysis context where used. A photo note is included only when marked shareable with AI. Your email and optional profile fields are not included as separate AI inputs; a goal, note or picture can still reveal them.
Results and retained input context remain in your account. Deleting a source photo or changing a note’s sharing setting does not erase a saved analysis or recall a previous provider request. Delete the analysis too, or ask us to delete associated data.
We do not use your journal to train our models. OpenAI’s API does not train on customer inputs/outputs by default. Standard abuse-monitoring retention is up to 30 days, with legal and safety exceptions, including flagged image review. We do not promise zero provider retention. See OpenAI’s data controls.
Turn off future AI sharing in More → About → AI and your data, or contact us. This does not delete past results. AI can be wrong; it is not medical advice and does not make decisions about you with legal or similarly significant effects.
The camera provides preview and capture when you take a photo; library access is used for selected uploads. The optional framing guide is fixed, not face recognition. We do not create faceprints or identify people from photos. AI may describe visible features; that is different from identifying you.
Camera, library and notification permissions are controlled in device settings. The app keeps private local caches and sign-in tokens in device secure storage. Signing out clears app caches; exports and device/OS backups are separate copies under your control.
We do not sell personal or consumer health data, use journal content for advertising, or disclose it for cross-context behavioural advertising. The app has no advertising or usage-analytics SDKs. We do use the server-side product statistics described in section 3; absence of an SDK does not mean absence of analytics. Website analytics is separate.
Providers process data for the relevant service under applicable terms and data-protection arrangements. Some also act independently for payment, account, security or legal obligations. Not every provider acts only as our processor.
Internal access is restricted to authorised support, operations, security, the product statistics described above and legal compliance. Journal content is not public to other users. Limited disclosure may be required by law or necessary to establish or defend legal claims, subject to applicable safeguards.
Processing may occur outside your country, including in Serbia through operation/support, Germany and the US. Where law requires transfer safeguards, these must cover the transfer, such as applicable standard contractual clauses. Contact us for information about safeguards relevant to your data.
We do not promise instant disappearance of every residual/provider copy or an unverified fixed backup lifetime. For an applicable deletion request, we identify relevant copies, instruct recipients where required, and explain lawful exceptions and deadlines. See the deletion procedure.
We use HTTPS, authenticated access, private photo storage and access restrictions. No system is completely secure. Storage is not end-to-end encrypted: the service processes content to provide requested features.
You can edit profile details, delete content, disable future AI sharing, or delete your account in More → Profile → Delete account. For access/export, correction, withdrawal, restriction, objection, deletion or recipient information, email morphtrack.app@gmail.com, subject Privacy request. Rights depend on applicable law.
We verify identity proportionately, preferably through an authenticated account or verified control of its email. We do not require a new account, payment, your password or unnecessary health information. An authorised representative may contact us; we may verify their authority.
Under GDPR, we respond within one month, with a lawful extension explained within that month. Under applicable US consumer-health rules, the usual response period is 45 days; shorter deletion deadlines can apply. See the health policy. We explain refusals and review appeals sent with subject Privacy appeal, within 45 days or an earlier applicable deadline.
You may complain to the authority competent under the law that applies to your case: for example, Serbia’s Commissioner under Serbian data-protection law, the competent supervisory authority under EEA/UK law, or a state’s Attorney General where that US state’s law applies. US complaint channels are not intended as universal destinations for all users. Complaining is optional, and our internal appeal does not limit statutory complaint rights. The Health Data Policy provides further details. We do not discriminate for exercising privacy rights.
MorphTrack is intended for adults 18 and over. Contact us if you believe we hold information from someone under 18 so we can investigate and address it.
We communicate material changes through an appropriate notice, such as in the app or by email. New consent-required purposes require new consent; changing this document does not itself provide it.