BB Tracker Terms of Service

1. Introduction and Acceptance

1.1 Agreement to Terms

These Terms of Service ("Terms") constitute a legally binding agreement between you ("User," "you," or "your") and [COMPANY ENTITY TO BE SPECIFIED] ("BB Tracker," "we," "us," or "our") governing your access to and use of the BB Tracker web application and related services (collectively, the "Service").

1.2 Acceptance

By creating an account, accessing, or using the Service in any manner, you:

• Acknowledge that you have read, understood, and agree to be bound by these Terms
• Acknowledge that you have read and agree to our Privacy Policy and Cookie Policy
• Confirm that you are at least 18 years of age
• Agree to comply with all applicable laws and regulations

1.3 Rejection of Terms

If you do not agree to these Terms, you must immediately cease all use of the Service and not create an account.

1.4 Binding Nature

These Terms create a binding legal agreement enforceable under South African law. You waive any right to claim these Terms are unenforceable or invalid except as specifically provided herein.

---

2. Definitions

For purposes of these Terms:

• "Encrypted Data" means all health-related information (cycles, blood work, measurements, photos) encrypted client-side using your Password-Derived Key before transmission to our servers.
• "Password-Derived Key" means the cryptographic encryption key derived from your password using the Argon2id key derivation function, which never leaves your device and is never transmitted to or stored by us.
• "Zero-Knowledge Architecture" means our technical implementation whereby we cannot access, read, decrypt, or analyze your Encrypted Data because we do not possess your Password-Derived Key.
• "Legal Request" means any subpoena, court order, warrant, discovery request, administrative demand, or other legal process seeking disclosure of user data.
• "Sensitive Health Data" means cycle tracking information, blood work results, measurements, progress photos, and any other health-related information you upload or enter into the Service.
• "Account Data" means non-encrypted information including email address, account creation date, subscription status, IP addresses, and service usage metadata.
• "Free Tier" means the no-cost service level with limited features.
• "Pro Tier" means the paid monthly subscription service level.
• "Lifetime Tier" means the one-time payment service level with lifetime access.

---

3. Privacy and Security Commitments

3.1.1 End-to-End Encryption

• All Sensitive Health Data is encrypted on your device (client-side) before transmission to our servers using AES-256-GCM encryption.
• Your Password-Derived Key is generated using Argon2id key derivation function with cryptographically secure parameters.
• Your Password-Derived Key never leaves your device and is never transmitted to our servers.
• We do not store, have access to, or possess any means to derive your Password-Derived Key.
• We cannot decrypt your Encrypted Data under any circumstances, including if compelled by court order, subpoena, or other legal process.
• This technical inability to decrypt is a core architectural feature, not a policy choice, and cannot be circumvented without fundamentally redesigning the Service.

3.1.2 Zero-Knowledge Architecture

• We operate on zero-knowledge principles for all Sensitive Health Data.
• We cannot read, access, view, analyze, process, or disclose your Encrypted Data.
• Our servers store only encrypted ciphertext that is cryptographically useless without your Password-Derived Key.
• We cannot perform server-side analytics, data mining, or processing on your Encrypted Data.
• Any analytics or calculations on Encrypted Data are performed client-side on your device after decryption with your Password-Derived Key.

3.1.4 Data Minimization

• We collect only the minimum data necessary to provide the Service.
• Account creation requires only: (a) email address, and (b) password.
• We do not require or request: real name, phone number, physical address, government ID, payment information (for Free Tier), or any other personal identifiers.
• We encourage use of pseudonyms, aliases, and anonymous email services (ProtonMail, Tutanota, etc.).
• We do not perform identity verification or "Know Your Customer" (KYC) checks.

3.1.5 No Data Selling or Commercial Sharing

We make the following absolute commitments:

• We will NEVER sell your data (Account Data or Encrypted Data) to third parties.
• We will NEVER share your data for marketing, advertising, or commercial purposes.
• We will NEVER provide your data to researchers, academic institutions, or data brokers without your explicit, informed, written consent.
• We will NEVER monetize your data in any manner beyond your direct payment for Service tiers.
• We will NEVER participate in data sharing consortiums, advertising networks, or analytics platforms that access user data.
• We will NEVER voluntarily cooperate with non-compulsory data requests from third parties, including law enforcement requests lacking proper legal authority.

3.1.6 Legal Request Resistance (Maximum Effort Commitment)

We commit to the following regarding Legal Requests:

• We will rigorously challenge every subpoena, court order, warrant, or discovery request seeking user data.
• We will exhaust all legal remedies including motions to quash, appeals, and constitutional challenges.
• We will provide only the minimum data legally required after all appeals are exhausted.
• We will notify you immediately of any Legal Request affecting your data unless prohibited by a legally valid gag order.
• We will provide you with copies of the Legal Request and all related legal documents (unless prohibited).
• We will delay compliance to the maximum extent legally permissible to allow you time to independently challenge the request.
• We will seek to narrow the scope of any disclosure order through legal argument and negotiation.
• We will publicly oppose overbroad or unjustified Legal Requests.
• We will document and publish all Legal Requests in annual Transparency Reports (subject to gag order limitations).

3.1.7 Technical Limitations on Disclosure

Even if legally compelled to disclose data, our technical architecture limits what can be disclosed:

• Encrypted Data: We can only provide encrypted ciphertext, which is cryptographically useless without your Password-Derived Key (which we do not possess).
• Password-Derived Key: We do not store or have access to your Password-Derived Key and cannot provide it.
• Password: We store only a salted, hashed representation of your password using Argon2id; we cannot reverse this to obtain your plaintext password.
• Account Data: We can be compelled to disclose Account Data (email, IP addresses, subscription status, usage metadata), but this does not include Encrypted Data.

3.2 Data Collection Transparency

We collect the following categories of data:

3.2.1 Account Data (Not Encrypted)

• Email address (required for account creation and communication)
• Password hash (Argon2id-hashed; plaintext password never stored)
• Account creation date and last login date
• Subscription tier and payment status
• IP addresses (for security and fraud prevention; retained for 90 days)
• Device and browser information (user agent strings)
• Service usage metadata (feature usage, session duration, page views)

3.2.2 Encrypted Data (Client-Side Encrypted)

• Cycle tracking information (compounds, dosages, schedules, durations)
• Blood work results (test names, values, dates, reference ranges)
• Body measurements (weight, body fat percentage, circumferences)
• Progress photos (encrypted before upload)
• Workout logs (exercises, sets, reps, weights)
• Personal notes and annotations

3.2.3 Calculator Usage (Not Stored)

• Free calculator usage does not require an account and is not logged or stored.
• Calculator inputs and outputs are processed client-side and never transmitted to our servers.

3.3 Data Retention

• Encrypted Data: Retained until you delete your account or individual records.
• Account Data: Retained until you delete your account, then permanently deleted within 30 days.
• Backup Data: Encrypted Data in backups is permanently deleted within 30 days of account deletion; encryption keys are destroyed immediately upon account deletion, rendering backup data cryptographically unrecoverable.
• IP Addresses: Retained for 90 days for security purposes, then permanently deleted.
• Payment Data: Processed by third-party payment processors (Stripe, PayPal); we do not store credit card numbers or payment credentials.

3.4 Third-Party Service Providers

We use the following categories of third-party service providers:

• Hosting: Cloud infrastructure providers (e.g., AWS, Google Cloud, DigitalOcean) for server hosting. Encrypted Data is stored encrypted at rest; providers cannot decrypt.
• Payment Processing: Stripe, PayPal, or similar for payment processing. Payment data is handled directly by these processors under their terms and privacy policies.
• Email Delivery: Transactional email services (e.g., SendGrid, Amazon SES) for account notifications. Only email address and non-sensitive message content is shared.
• Analytics: Privacy-respecting analytics (e.g., Plausible, self-hosted Matomo) that do not track individual users or use cookies. No data sharing with advertising networks.

All third-party service providers are contractually bound to:

• Maintain confidentiality of any data they process
• Use data only for providing services to us
• Implement appropriate security measures
• Not disclose data to third parties without our authorization
• Delete data upon termination of services

3.5 International Data Transfers

• Our servers are located in [SPECIFY JURISDICTION].
• If you access the Service from outside South Africa, your Account Data may be transferred to and processed in [SPECIFY JURISDICTION].
• Encrypted Data remains encrypted during any international transfer and cannot be decrypted by us or third parties.
• We comply with applicable data protection laws regarding international transfers.

3.6 Your Privacy Rights

You have the following rights regarding your data:

• Right to Access: Export all your data in machine-readable JSON format at any time.
• Right to Deletion: Permanently delete your account and all associated data at any time (one-click deletion).
• Right to Rectification: Modify or correct any Account Data or Encrypted Data at any time.
• Right to Portability: Export your data for transfer to another service.
• Right to Object: Object to processing of your data (by deleting your account).
• Right to Notification: Be notified of Legal Requests affecting your data (unless prohibited by gag order).
• Right to Pseudonymity: Use pseudonyms and anonymous email addresses without identity verification.

To exercise these rights, use the in-app account settings or contact [PRIVACY CONTACT TO BE SPECIFIED].

---

4. Service Description and Tiers

4.1 Service Overview

BB Tracker is a privacy-focused, web-based SaaS platform providing:

• Bodybuilding cycle tracking with end-to-end encryption
• Blood work management and tracking (encrypted)
• Workout and training log tracking (encrypted)
• Body measurement tracking (encrypted)
• Progress photo storage (encrypted)
• Fitness calculators (one-rep max, body fat percentage, TDEE, macro calculators, etc.)
• Educational resources on harm reduction and safe practices
• Community support and forums (optional participation)

4.2 Free Tier

Cost: No charge

Features:

• Access to all free calculators (no account required)
• Account creation with email and password
• 1 active cycle tracking (encrypted)
• Basic workout tracking (encrypted)
• 5 blood work records (encrypted)
• Body measurement tracking (encrypted)
• 10 progress photos (encrypted)
• Community forum access (read and post)
• Email support (best-effort response time)

Limitations:

• Cannot track more than 1 active cycle simultaneously
• Limited blood work history (5 records)
• Limited photo storage (10 photos)
• No PDF upload or OCR functionality
• No advanced analytics or visualizations
• No data export functionality

4.3 Pro Tier

Cost: $9.99 USD per month (or ZAR equivalent at current exchange rate)

Billing: Monthly recurring subscription; automatic renewal

Features:

• All Free Tier features, plus:
• Unlimited cycle tracking (encrypted)
• Unlimited blood work records (encrypted)
• Unlimited progress photos (encrypted)
• Advanced analytics and visualizations (computed client-side)
• Trend analysis and progress tracking
• PDF upload with client-side OCR for blood work results
• Data export in JSON and CSV formats
• Priority email support (24-48 hour response time)
• Early access to new features (beta testing)

4.4 Lifetime Tier

Cost: $199 USD one-time payment (or ZAR equivalent at current exchange rate)

Billing: One-time payment; no recurring charges

Features:

• All Pro Tier features, plus:
• Lifetime access to all current and future features (as long as Service operates)
• No recurring fees ever
• VIP support (12-24 hour response time)
• Priority feature requests and feedback
• Early beta access to experimental features
• Lifetime price lock (immune to future price increases)
• Exclusive Lifetime member badge and recognition

Limitations:

• Non-refundable after 30-day refund period (see Section 11.5)
• Lifetime access contingent on Service continuing to operate (no guarantee of perpetual operation)
• Subject to these Terms and Acceptable Use Policy (violations may result in termination)

4.5 Service Modifications

• We reserve the right to modify, add, or remove features at any time.
• Material changes to paid tier features will be communicated with 30 days' advance notice.
• We will not remove core features (encryption, cycle tracking, blood work tracking) without offering suitable alternatives or refunds.
• New features may be added to paid tiers without notice.
• Free Tier features may be modified or limited with 14 days' notice.

---

5. Eligibility and Account Requirements

5.2 Age Verification

• We may request age verification documentation if we have reason to believe you are under 18.
• Acceptable verification includes: government-issued ID (with personal details redacted except date of birth), credit card statement, or other reliable age verification methods.
• Failure to provide age verification within 7 days of request will result in account suspension.
• Failure to verify age within 30 days will result in permanent account termination and data deletion.

5.3 Legal Compliance

You represent and warrant that your use of the Service complies with all applicable laws in your jurisdiction, including:

• Laws regulating possession, use, and distribution of controlled substances (anabolic steroids, SARMs, peptides, growth hormone, etc.)
• Prescription requirements for controlled substances
• Import/export regulations for controlled substances
• Medical practice laws (you will not provide medical advice to others)
• Data protection and privacy laws

5.4 Jurisdiction-Specific Restrictions

• The Service is governed by South African law and intended primarily for users in South Africa.
• Users in other jurisdictions use the Service at their own risk and are responsible for compliance with local laws.
• We make no representation that the Service is appropriate or legal in all jurisdictions.
• If your local laws prohibit use of the Service, you must not create an account or use the Service.

5.5 Prohibited Jurisdictions

We reserve the right to restrict or prohibit access from specific jurisdictions where:

• Local laws conflict with our privacy commitments
• Legal risks to the Service or users are unacceptably high
• Compliance with local laws would require compromising encryption or zero-knowledge architecture

Current prohibited jurisdictions: [TO BE SPECIFIED IF APPLICABLE]

5.6 Account Eligibility

You are eligible to create an account only if:

• You are 18 years of age or older
• You have a valid email address (anonymous email services accepted)
• You agree to these Terms and the Privacy Policy
• You are not prohibited from using the Service under applicable law
• You have not previously had an account terminated for Terms violations
• You are not creating an account on behalf of another person (one account per person)

---

6. Account Creation and Security

6.1 Account Creation Process

To create an account, you must provide:

• Email address: Valid email address for account communication (anonymous email services such as ProtonMail, Tutanota, or Guerrilla Mail are explicitly permitted and encouraged)
• Password: Strong password meeting minimum security requirements (minimum 12 characters; we recommend 16+ characters with mixed case, numbers, and symbols)

You are not required to provide:

• Real name or legal name (pseudonyms and aliases encouraged)
• Phone number
• Physical address
• Government-issued ID
• Payment information (for Free Tier)
• Any other personal identifiers

6.2 Pseudonymity and Anonymity

• We strongly encourage use of pseudonyms and aliases rather than real names.
• We explicitly permit use of anonymous email services (ProtonMail, Tutanota, Guerrilla Mail, etc.).
• We do not perform identity verification, "Know Your Customer" (KYC) checks, or require proof of identity.
• You may use the Service pseudonymously or anonymously to the maximum extent technically feasible.
• Community forum participation may use your chosen username/pseudonym; you are not required to reveal your identity.

6.5 Two-Factor Authentication (2FA)

• We strongly recommend enabling two-factor authentication (2FA) for additional account security.
• Supported 2FA methods: TOTP (Time-based One-Time Password) apps such as Google Authenticator, Authy, or 1Password.
• 2FA protects your account from unauthorized access even if your password is compromised.
• Warning: If you lose access to your 2FA device and do not have backup codes, you will be permanently locked out of your account. Store backup codes securely.

6.6 Account Security Best Practices

We recommend the following security practices:

• Enable 2FA immediately after account creation
• Use a unique, strong password (16+ characters)
• Use a password manager to generate and store passwords
• Regularly review account activity and login history
• Log out of shared or public devices
• Use a secure, updated web browser
• Enable browser security features (HTTPS-only mode, tracking protection)
• Be cautious of phishing attempts (we will never ask for your password via email)

6.7 Account Sharing Prohibition

• Each account is for individual use only.
• You may not share your account credentials with others.
• You may not allow others to access your account.
• Account sharing violates these Terms and may result in account termination.
• If you suspect unauthorized access to your account, change your password immediately and contact us at [SECURITY CONTACT TO BE SPECIFIED].

6.8 Account Activity Monitoring

• You are responsible for all activity occurring under your account.
• You must notify us immediately of any unauthorized access or security breach.
• We will investigate suspected unauthorized access and may temporarily suspend your account for security purposes.
• We are not liable for losses resulting from unauthorized access due to your failure to secure your password.

---

7. User Rights (Non-Waivable)

The following rights are non-waivable and cannot be limited by any provision of these Terms:

7.1 Right to Data Deletion

• You have the absolute right to delete your account and all associated data at any time, for any reason, without justification.
• Deletion is immediate and irreversible (one-click deletion via account settings).
• Upon deletion:
  • Your account is immediately deactivated
  • Your Password-Derived Key is immediately destroyed (rendering all Encrypted Data cryptographically unrecoverable)
  • All Account Data and Encrypted Data is permanently deleted from production systems within 30 days
  • All backup copies are permanently deleted within 30 days
  • Deletion is permanent and cannot be undone

7.2 Right to Data Export

• You have the absolute right to export all your data in machine-readable format at any time (Pro and Lifetime tiers).
• Export formats: JSON (structured data) and CSV (tabular data).
• Exported data includes:
  • All cycle tracking data (decrypted)
  • All blood work records (decrypted)
  • All workout logs (decrypted)
  • All body measurements (decrypted)
  • All progress photos (decrypted image files)
  • Account metadata (email, account creation date, subscription status)
• Export is generated client-side after decryption with your Password-Derived Key.
• Export files are provided as downloadable ZIP archive.
• You may export your data as frequently as desired without limitation.

7.3 Right to Pseudonymity

• You have the absolute right to use pseudonyms, aliases, and anonymous email addresses without identity verification.
• We will never require you to provide your real name, government ID, or proof of identity (except for age verification if we have reasonable suspicion you are under 18).
• You may change your username/pseudonym at any time.
• Community forum participation does not require revealing your identity.

7.4 Right to Notification of Legal Requests

• You have the right to be notified of any Legal Request seeking disclosure of your data, unless we are prohibited by a legally valid gag order.
• Notification will be provided:
  • Immediately upon receipt of Legal Request (if no gag order)
  • As soon as legally permissible (if gag order expires or is lifted)
  • Via email to your registered email address
  • Including copies of the Legal Request and all related legal documents (unless prohibited)
• Notification will include:
  • Nature and scope of the Legal Request
  • Data sought by the requesting party
  • Legal basis for the request (subpoena, warrant, court order, etc.)
  • Deadline for compliance
  • Our planned response and legal challenges
  • Your right to independently challenge the request
  • Contact information for legal assistance resources

7.5 Right to Challenge Legal Requests

• You have the independent right to challenge any Legal Request seeking your data.
• We will provide you with:
  • Sufficient advance notice (to the extent legally permissible) to allow you to seek legal counsel
  • Copies of all legal documents related to the request
  • Information about the requesting party and legal basis
  • Delay compliance to the maximum extent legally permissible to allow you time to challenge
• You may:
  • Retain your own legal counsel to challenge the request
  • File motions to quash or narrow the scope of the request
  • Assert constitutional or statutory protections (privacy rights, medical confidentiality, etc.)
  • Negotiate with the requesting party
  • Appeal adverse rulings to higher courts
• Our legal challenges are independent of and in addition to your right to challenge.

7.6 Right to Transparency

• You have the right to transparency regarding Legal Requests and data disclosures.
• We will publish annual Transparency Reports including:
  • Total number of Legal Requests received (by type: subpoena, warrant, court order, administrative demand)
  • Number of Legal Requests challenged and outcomes
  • Number of Legal Requests complied with (in whole or in part)
  • Types and volume of data disclosed
  • Number of user notifications sent
  • Number of gag orders received and their duration
  • Jurisdictions of requesting parties
• Transparency Reports will be published at [URL TO BE SPECIFIED] and announced via email.
• Individual Legal Requests will be disclosed (with personal details redacted) unless prohibited by ongoing gag order.

7.7 Right to Service Without Discrimination

You have the right to use the Service without discrimination based on:

• Use of pseudonyms or anonymous email addresses
• Refusal to provide unnecessary personal information
• Exercise of privacy rights (data deletion, export, etc.)
• Jurisdiction or location (except where legally prohibited)
• Lawful use of tracked substances (e.g., legal TRT under medical supervision)

We will not:

• Degrade service quality for privacy-conscious users
• Require additional verification or information from users exercising privacy rights
• Discriminate in support response times or quality
• Penalize users for using privacy-enhancing tools (VPNs, Tor, anonymous email, etc.)

---

8. Acceptable Use Policy

8.1 Permitted Uses

You may use the Service for the following lawful purposes:

• Personal health and fitness tracking: Tracking cycles, blood work, workouts, measurements, and progress for personal use (encrypted).
• Legal TRT (Testosterone Replacement Therapy): Tracking medically prescribed and supervised testosterone replacement therapy.
• Harm reduction and education: Learning about safe practices, harm reduction strategies, and health monitoring.
• Personal record keeping: Maintaining personal health records for your own reference and medical consultations.
• Research and academic purposes: Using the Service for legitimate research or academic study, provided you:
  • Obtain appropriate ethical approval from an institutional review board (IRB) or ethics committee
  • Do not access other users' data without explicit informed consent
  • Comply with research ethics standards and data protection laws
  • Enter into a separate research agreement with us if required

8.2 Prohibited Uses

The following uses are strictly prohibited and will result in immediate account termination:

8.2.1 Illegal Activities

• Using the Service to facilitate, promote, or engage in illegal activities, including:
  • Illegal possession, distribution, or sale of controlled substances (anabolic steroids, SARMs, peptides, growth hormone, etc.) without valid prescription
  • Trafficking or smuggling of controlled substances
  • Manufacturing or compounding of controlled substances without proper licensing
  • Conspiracy to commit any of the above
• Providing false information to law enforcement or regulatory authorities
• Using the Service to evade legal obligations or detection by authorities

8.2.2 Providing Medical Advice

• Providing medical advice, diagnosis, or treatment recommendations to other users (you are not a licensed healthcare provider unless you hold valid credentials and are acting within your scope of practice)
• Prescribing or recommending specific substances, dosages, or protocols to others
• Interpreting others' blood work results or health data
• Holding yourself out as a medical professional if you are not licensed
• Exception: Sharing personal experiences and anecdotal information is permitted, provided you clearly state it is not medical advice and recommend consulting a healthcare professional

8.2.3 Account Abuse

• Creating multiple accounts for the same individual (one account per person)
• Sharing or selling account access to others
• Using another person's account without authorization
• Circumventing account limitations or restrictions (e.g., Free Tier limits)
• Creating accounts using false or misleading information (pseudonyms are permitted; false information to us is not)

8.2.4 Security Violations

• Attempting to hack, compromise, or gain unauthorized access to the Service, our servers, or other users' accounts
• Reverse engineering, decompiling, or disassembling any part of the Service (except as permitted by applicable law)
• Introducing malware, viruses, trojans, worms, or other malicious code
• Conducting security testing or penetration testing without prior written authorization
• Exploiting security vulnerabilities for any purpose other than responsible disclosure to [SECURITY CONTACT TO BE SPECIFIED]
• Attempting to decrypt other users' Encrypted Data
• Attempting to bypass or circumvent encryption, access controls, or security measures

8.2.5 Data Misuse

• Scraping, data mining, or automated extraction of data from the Service (except via official API if available)
• Using bots, scripts, or automated tools to access the Service (except via official API)
• Collecting or harvesting other users' personal information without consent
• Uploading others' medical records, blood work results, or personal health information without explicit consent
• Sharing or disclosing other users' data without authorization
• Using the Service to build a competing product or service

8.2.6 Abuse and Harassment

• Harassing, threatening, intimidating, or abusing other users or BB Tracker staff
• Posting or transmitting hate speech, discriminatory content, or content promoting violence
• Stalking or doxxing other users (revealing personal information without consent)
• Impersonating others or misrepresenting your identity or affiliation
• Engaging in spam, unsolicited commercial communications, or phishing

8.2.7 Intellectual Property Infringement

• Uploading, posting, or sharing copyrighted material without authorization from the copyright holder
• Infringing trademarks, patents, trade secrets, or other intellectual property rights
• Using the Service to distribute pirated software, media, or other infringing content

8.2.8 Resale and Redistribution

• Reselling, sublicensing, or redistributing access to the Service without our written authorization
• Using the Service to provide services to third parties (e.g., offering cycle planning services using our platform)
• Framing, mirroring, or embedding the Service on other websites without authorization

8.2.9 Underage Use

• Creating an account or using the Service if you are under 18 years of age
• Allowing individuals under 18 to use your account
• Providing false age information during account creation or age verification

8.2.10 Interference with Service

• Interfering with or disrupting the Service, servers, or networks
• Imposing unreasonable load on our infrastructure (e.g., denial-of-service attacks)
• Bypassing rate limits or access controls
• Interfering with other users' use and enjoyment of the Service

8.3 Enforcement

Violations of this Acceptable Use Policy will result in:

• Minor violations: Warning and opportunity to cure within 7 days
• Moderate violations: Temporary account suspension (7-30 days) and warning
• Serious violations: Immediate permanent account termination without notice, including:
  • Illegal activities
  • Security violations
  • Underage use
  • Harassment or threats
  • Repeated violations after warnings

We reserve the right to:

• Investigate suspected violations
• Cooperate with law enforcement regarding illegal activities (while still challenging overbroad Legal Requests)
• Terminate accounts at our sole discretion for violations
• Report illegal activities to appropriate authorities when legally required

8.4 Reporting Violations

If you become aware of violations of this Acceptable Use Policy, report them to [ABUSE CONTACT TO BE SPECIFIED] with:

• Description of the violation
• Username or account information (if known)
• Evidence (screenshots, links, etc.)
• Date and time of violation

We will investigate all reports and take appropriate action.

---

9. Content Ownership and Intellectual Property

9.1 Your Data Ownership

You retain full and exclusive ownership of all data you upload, enter, or create using the Service, including:

• Cycle tracking data
• Blood work results
• Workout logs
• Body measurements
• Progress photos
• Personal notes and annotations
• Any other user-generated content

9.2 Limited License to Us

By using the Service, you grant us a limited, non-exclusive, royalty-free, worldwide license to:

• Store your Encrypted Data on our servers (in encrypted form only)
• Transmit your Encrypted Data between your device and our servers
• Create backup copies of your Encrypted Data (in encrypted form only)
• Process your Account Data to provide the Service (account management, billing, support, etc.)

This license is:

• Limited in purpose: Only to provide the Service to you; not for any other commercial or non-commercial purpose
• Limited in scope: We cannot access, read, or use your Encrypted Data due to zero-knowledge architecture
• Revocable: Automatically terminates when you delete your account or individual data
• Non-transferable: We will not transfer this license to third parties (except as necessary for service providers bound by confidentiality obligations)

9.3 Our Intellectual Property

The Service and all related intellectual property are owned by BB Tracker and protected by copyright, trademark, patent, and other intellectual property laws. This includes:

• Software and code: All source code, object code, algorithms, and software architecture
• Calculators and formulas: All fitness calculators, formulas, and computational methods
• User interface and design: All UI/UX design, layout, graphics, and visual elements
• Branding: BB Tracker name, logo, trademarks, and service marks
• Content: All educational content, articles, guides, and documentation created by us
• Database structure: Database schema, organization, and structure

9.4 Open Source Components

The Service may incorporate open-source software components licensed under various open-source licenses (MIT, Apache 2.0, GPL, etc.). These components are governed by their respective licenses, which will be documented at [URL TO BE SPECIFIED]. Our proprietary code and intellectual property are separate from and not subject to open-source licenses.

9.5 Restrictions on Use of Our Intellectual Property

You may not, without our prior written consent:

• Copy, reproduce, or duplicate any part of the Service
• Modify, adapt, translate, or create derivative works based on the Service
• Reverse engineer, decompile, or disassemble the Service (except as permitted by applicable law for interoperability purposes)
• Remove, obscure, or alter any copyright, trademark, or other proprietary notices
• Use our trademarks, logos, or branding in any manner
• Frame, mirror, or embed the Service on other websites
• Extract or scrape data, code, or content from the Service
• Use the Service to build a competing product or service

9.6 Feedback and Suggestions

If you provide feedback, suggestions, or ideas for improving the Service ("Feedback"), you grant us a perpetual, irrevocable, worldwide, royalty-free, fully sublicensable license to use, implement, and commercialize the Feedback without compensation or attribution. This allows us to improve the Service based on user input without legal complications.

9.7 User-Generated Content in Community Forums

If you post content in community forums or public areas of the Service:

• You retain ownership of your content
• You grant us and other users a non-exclusive, royalty-free license to view, access, and use your content within the Service
• You represent and warrant that you have the right to post the content and that it does not infringe third-party rights
• You are responsible for the content you post; we are not liable for user-generated content
• We may remove content that violates these Terms or applicable law

9.8 Copyright Infringement (DMCA)

We respect intellectual property rights. If you believe content on the Service infringes your copyright, submit a DMCA takedown notice to [DMCA CONTACT TO BE SPECIFIED] with:

• Identification of the copyrighted work
• Identification of the infringing material and its location
• Your contact information
• Statement of good faith belief that use is not authorized
• Statement that the information is accurate and you are authorized to act on behalf of the copyright owner
• Your physical or electronic signature

We will investigate and remove infringing content as required by law.

---

10. Medical and Legal Disclaimers

10.5 No Liability for User Decisions

• You are solely responsible for all decisions regarding substance use, dosages, cycle protocols, and health management.
• We are not liable for consequences of your decisions, even if based on information or tools provided by the Service.
• We do not endorse or recommend any specific substances, dosages, or protocols.
• Any information provided is for educational purposes only and not personalized advice.

10.6 Third-Party Information

• The Service may link to or reference third-party websites, articles, studies, or resources.
• We do not control, endorse, or verify third-party content.
• Third-party information is provided for convenience only.
• You access third-party content at your own risk.
• We are not liable for accuracy, legality, or consequences of third-party information.

---

11. Payment Terms

11.1 Subscription Billing (Pro Tier)

11.1.1 Pricing

• Pro Tier: $9.99 USD per month (or ZAR equivalent at current exchange rate at time of billing)
• Prices are subject to change with 30 days' advance notice to existing subscribers (see Section 11.7)

11.1.2 Billing Cycle

• Monthly recurring charges on the same day each month (e.g., if you subscribe on the 15th, you will be billed on the 15th of each subsequent month)
• First charge occurs immediately upon subscription
• Automatic renewal unless cancelled

11.1.3 Payment Methods

• Credit card (Visa, Mastercard, American Express)
• Debit card
• PayPal
• Other payment methods as available through our payment processor (Stripe or similar)

11.1.4 Payment Processing

• Payments are processed by third-party payment processors (Stripe, PayPal, or similar)
• We do not store credit card numbers or payment credentials
• Payment processors are PCI-DSS compliant
• Payment processing is subject to the payment processor's terms and privacy policy

11.1.5 Automatic Renewal

• Your subscription will automatically renew each month unless cancelled
• You will be charged the then-current subscription price (subject to 30 days' notice of price changes)
• You authorize us to charge your payment method on file for recurring subscription fees

11.1.6 Cancellation

• You may cancel your subscription at any time via account settings (one-click cancellation)
• Cancellation is effective at the end of the current billing period
• You will retain Pro Tier access until the end of the paid period
• No refunds for partial months (except as required by South African Consumer Protection Act)
• After cancellation, your account will be downgraded to Free Tier (data is not deleted unless you delete your account)

11.2 Lifetime Tier

11.2.1 Pricing

• Lifetime Tier: $199 USD one-time payment (or ZAR equivalent at current exchange rate at time of purchase)
• Price is subject to change at any time; existing Lifetime members are not affected by price changes

11.2.2 Payment

• One-time payment via credit card, debit card, or PayPal
• Payment processed immediately upon purchase
• No recurring charges

11.2.3 Lifetime Access

• Lifetime access to all Pro Tier features (current and future)
• Access continues as long as the Service operates
• No guarantee of perpetual operation: We reserve the right to discontinue the Service with 90 days' notice (see Section 13.4)
• If Service is discontinued, Lifetime members will receive pro-rated refund based on reasonable expected service lifetime (e.g., 10 years)

11.2.4 Refund Policy

• 30-day money-back guarantee: Full refund if requested within 30 days of purchase, no questions asked
• After 30 days: Non-refundable except:
  • As required by South African Consumer Protection Act
  • If we discontinue the Service (pro-rated refund)
  • If we materially breach these Terms (pro-rated refund)
• Refund requests: Contact [BILLING CONTACT TO BE SPECIFIED]

11.3 Failed Payments

11.3.1 Payment Failure

If a recurring payment fails (expired card, insufficient funds, etc.), we will:

• Retry payment up to 3 times over 7 days
• Send email notification of payment failure
• Provide 7-day grace period to update payment method

11.3.2 Grace Period

• During the 7-day grace period, you retain Pro Tier access
• No data is deleted during grace period
• Update payment method via account settings

11.3.3 Downgrade to Free Tier

• If payment is not resolved within 7 days, your account will be automatically downgraded to Free Tier
• You will lose access to Pro Tier features (unlimited cycles, advanced analytics, data export, etc.)
• Data exceeding Free Tier limits will be archived (not deleted) and restored if you resubscribe
• No data loss; you can resubscribe at any time to restore Pro Tier access

11.4 Currency and Exchange Rates

• Prices are listed in USD (United States Dollars)
• Charges are processed in your local currency (ZAR for South African users) at the current exchange rate
• Exchange rate is determined by our payment processor at the time of transaction
• Exchange rates fluctuate; your local currency charge may vary slightly from month to month
• Currency conversion fees may be charged by your bank or payment processor (not by us)

11.5 Taxes

• Prices do not include applicable taxes (VAT, sales tax, etc.)
• You are responsible for all taxes associated with your purchase
• Taxes will be calculated and added at checkout based on your billing address
• South African users: 15% VAT will be added to all purchases

11.6 Refund Policy

11.6.1 Pro Tier (Monthly Subscription)

• No refunds for partial months except as required by South African Consumer Protection Act
• If you cancel mid-month, you retain access until the end of the billing period (no pro-rated refund)
• Exception: If we materially breach these Terms or fail to provide the Service, you may request a pro-rated refund for the unused portion of the month

11.6.2 Lifetime Tier

• 30-day money-back guarantee: Full refund if requested within 30 days of purchase
• After 30 days: Non-refundable except:
  • As required by South African Consumer Protection Act (e.g., defective service, misrepresentation)
  • If we discontinue the Service (pro-rated refund based on reasonable expected lifetime)
  • If we materially breach these Terms (pro-rated refund)

11.6.3 Refund Process

Refund requests: Email [BILLING CONTACT TO BE SPECIFIED] with:

• Account email address
• Reason for refund request (if after 30-day period)
• Payment transaction ID (if available)

• Refunds processed within 14 business days
• Refunds issued to original payment method
• Upon refund, your account will be downgraded to Free Tier (or deleted if you request account deletion)

11.7 Price Changes

11.7.1 Notice of Price Changes

• We may change subscription prices at any time
• Existing subscribers: 30 days' advance notice via email before price change takes effect
• New subscribers: New prices apply immediately

11.7.2 Acceptance of Price Changes

• Continued use of the Service after the 30-day notice period constitutes acceptance of new prices
• If you do not accept the price change, cancel your subscription before the effective date (no penalty; access continues until end of current billing period)

11.7.3 Lifetime Tier Price Lock

• Lifetime Tier members are immune to price changes
• Your one-time payment guarantees lifetime access at the original price
• Future price increases do not affect Lifetime members

11.8 Promotional Offers and Discounts

• We may offer promotional discounts, coupon codes, or special pricing from time to time
• Promotional offers are subject to specific terms and conditions (duration, eligibility, limitations)
• Promotional offers may be modified or terminated at any time
• Promotional pricing may revert to standard pricing after the promotional period
• One promotional offer per account unless otherwise specified

11.9 Billing Disputes

• If you dispute a charge, contact us at [BILLING CONTACT TO BE SPECIFIED] within 30 days of the charge
• Provide:
  • Account email address
  • Transaction date and amount
  • Reason for dispute
• We will investigate and respond within 14 business days
• If dispute is valid, we will issue a refund or credit
• Do not initiate a chargeback without contacting us first: Chargebacks may result in account termination and may incur chargeback fees

---

12. Data Protection and Privacy

12.1 Governing Privacy Policy

All data collection, use, storage, and disclosure practices are governed by our Privacy Policy, which is incorporated by reference into these Terms. By using the Service, you agree to the Privacy Policy.

The Privacy Policy is available at: [PRIVACY POLICY URL TO BE SPECIFIED]

12.2 Consent to Data Processing

By creating an account and using the Service, you consent to:

• Collection of Account Data as described in Section 3.2.1
• Client-side encryption of Sensitive Health Data before transmission
• Storage of Encrypted Data on our servers (in encrypted form)
• Processing of Account Data for service provision, billing, support, and security
• Use of cookies and similar technologies as described in our Cookie Policy
• International data transfer (if applicable) as described in Section 3.5

12.3 Withdrawal of Consent

You may withdraw consent to data processing at any time by:

• Deleting your account (permanent deletion of all data within 30 days)
• Opting out of non-essential cookies via Cookie Policy settings
• Contacting us at [PRIVACY CONTACT TO BE SPECIFIED] to exercise specific privacy rights

Withdrawal of consent may result in inability to use the Service.

12.4 Data Security Measures

We implement industry-standard security measures to protect your data, including:

• Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS 1.3 (Transport Layer Security)
• Encryption at rest: All Encrypted Data is stored encrypted on our servers using AES-256-GCM
• Access controls: Strict access controls limit employee and contractor access to production systems
• Authentication: Strong password requirements and optional 2FA for account security
• Monitoring: Security monitoring and intrusion detection systems
• Regular security audits: Periodic security assessments and penetration testing
• Secure development practices: Code reviews, security testing, and vulnerability scanning
• Incident response plan: Documented procedures for responding to security incidents

12.5 Data Breach Notification

In the event of a data breach affecting your account:

• We will notify you within 72 hours of discovering the breach (as required by South African Protection of Personal Information Act)
• Notification will be sent via email to your registered email address
• Notification will include:
  • Nature and scope of the breach
  • Types of data affected (Account Data, Encrypted Data, etc.)
  • Potential impact and risks
  • Measures we have taken to address the breach
  • Recommended protective measures for you (e.g., change password, monitor accounts)
  • Contact information for questions and support

12.6 Your Responsibility for Data Security

You are responsible for:

• Maintaining the security of your password and Password-Derived Key
• Using a strong, unique password
• Enabling 2FA for additional security
• Protecting your device from malware and unauthorized access
• Logging out of shared or public devices
• Backing up critical data using the export feature (Pro/Lifetime tiers)
• Promptly notifying us of any suspected unauthorized access or security breach

We are not liable for data loss or unauthorized access resulting from your failure to secure your password or device.

12.7 Third-Party Data Processors

We use third-party service providers to help provide the Service (hosting, payment processing, email delivery, etc.). These providers are contractually bound to:

• Process data only as instructed by us
• Maintain confidentiality and security of data
• Not use data for their own purposes
• Delete data upon termination of services
• Comply with applicable data protection laws

Current third-party processors:

• Hosting: [TO BE SPECIFIED] (e.g., AWS, Google Cloud, DigitalOcean)
• Payment processing: Stripe, PayPal
• Email delivery: [TO BE SPECIFIED] (e.g., SendGrid, Amazon SES)
• Analytics: [TO BE SPECIFIED] (e.g., Plausible, self-hosted Matomo)

A complete list of third-party processors is available in our Privacy Policy.

12.8 Data Retention

• Encrypted Data: Retained until you delete your account or individual records
• Account Data: Retained until you delete your account, then permanently deleted within 30 days
• Backup Data: Encrypted Data in backups is permanently deleted within 30 days of account deletion; encryption keys are destroyed immediately, rendering backup data unrecoverable
• IP Addresses: Retained for 90 days for security purposes, then permanently deleted
• Payment Data: Retained by payment processors per their policies; we do not store payment credentials

12.9 Children's Privacy

• The Service is not intended for individuals under 18 years of age
• We do not knowingly collect data from children under 18
• If we discover a user is under 18, we will immediately terminate the account and delete all data
• Parents or guardians: If you believe your child has created an account, contact us immediately at [PRIVACY CONTACT TO BE SPECIFIED]

---

13. Service Availability and Modifications

13.1 "As Is" and "As Available" Basis

The Service is provided on an "as is" and "as available" basis, without warranties of any kind, either express or implied, including but not limited to:

• No warranty of uninterrupted service: We do not guarantee the Service will be available 24/7 without interruption
• No warranty of error-free operation: The Service may contain bugs, errors, or technical issues
• No warranty of security: While we implement strong security measures, no system is 100% secure
• No warranty of accuracy: Calculators and information may contain errors or inaccuracies
• No warranty of fitness for a particular purpose: The Service may not meet your specific needs or expectations

13.2 Scheduled Maintenance

• We will perform scheduled maintenance from time to time to improve the Service
• We will provide advance notice of scheduled maintenance when possible (at least 24 hours for major maintenance)
• Notice will be provided via:
  • Email to registered users
  • In-app notification banner
  • Status page at [STATUS PAGE URL TO BE SPECIFIED]
• During scheduled maintenance, the Service may be unavailable or have limited functionality
• We will minimize maintenance duration and schedule during low-usage periods when possible

13.3 Unscheduled Downtime

Unscheduled downtime may occur due to:

• Technical failures (server crashes, network outages, etc.)
• Security incidents (DDoS attacks, intrusions, etc.)
• Third-party service provider outages (hosting, CDN, etc.)
• Force majeure events (natural disasters, power outages, etc.)

• We will work to restore service as quickly as possible
• We will provide status updates via [STATUS PAGE URL TO BE SPECIFIED] and email when possible
• We are not liable for losses resulting from unscheduled downtime (see Section 14)

13.4 Service Modifications and Discontinuation

13.4.1 Feature Modifications

• We reserve the right to modify, add, or remove features at any time
• Material changes to paid tier features: 30 days' advance notice via email
• Minor changes and improvements: No advance notice required
• Removal of core features: We will not remove core features (encryption, cycle tracking, blood work tracking) without offering suitable alternatives or refunds

13.4.2 Service Discontinuation

• We reserve the right to discontinue the Service entirely with 90 days' advance notice
• Notice will be provided via:
  • Email to all registered users
  • Prominent in-app notification
  • Public announcement on website
• Upon discontinuation:
  • All users will have 90 days to export their data
  • Pro Tier subscribers will receive pro-rated refunds for unused subscription time
  • Lifetime Tier members will receive pro-rated refunds based on reasonable expected service lifetime (e.g., 10 years from purchase date)
  • All data will be permanently deleted 90 days after discontinuation notice

13.4.3 Acquisition or Merger

If BB Tracker is acquired by or merges with another company:

• These Terms and Privacy Policy will continue to apply unless you are provided 30 days' notice of changes
• Your data will remain subject to the same privacy protections (encryption, zero-knowledge architecture)
• If the acquiring company cannot or will not maintain our privacy commitments, you will be offered the option to delete your account and receive pro-rated refunds (if applicable)

13.5 No Liability for Downtime

We are not liable for any losses, damages, or consequences resulting from:

• Scheduled maintenance
• Unscheduled downtime
• Service modifications or discontinuation
• Third-party service provider failures
• Force majeure events

Exception: If downtime is caused by our gross negligence or willful misconduct, we may provide service credits or pro-rated refunds at our discretion

13.6 Service Level Agreement (SLA)

• We do not provide a formal Service Level Agreement (SLA) guaranteeing uptime percentages
• We strive for high availability but make no guarantees
• Target availability: 99.5% uptime (excluding scheduled maintenance)
• Actual availability may be higher or lower depending on circumstances

---

14. Limitation of Liability

14.3 No Liability for Specific Risks

We are not liable for:

14.3.1 Health Outcomes

• Any health consequences, injuries, illnesses, or death resulting from your use of performance-enhancing substances
• Adverse reactions, side effects, or complications from substances you track
• Failure to achieve desired results (muscle gain, fat loss, performance improvements)
• Inaccurate blood work interpretation or health decisions based on the Service
• Failure to seek medical attention or follow medical advice

14.3.2 Legal Consequences

• Criminal prosecution, arrest, or conviction for possession, use, or distribution of controlled substances
• Civil liability or lawsuits related to your substance use
• Professional consequences (loss of employment, professional license suspension, etc.)
• Customs seizure or importation violations
• Any legal consequences of your actions or decisions

14.3.3 Data Loss

• Loss of data due to your failure to maintain backups
• Loss of data due to forgotten password (irrecoverable by design)
• Loss of data due to account termination for Terms violations
• Loss of data due to technical failures, security breaches, or force majeure events

14.3.4 Third-Party Actions

• Actions or omissions of third-party service providers (hosting, payment processors, etc.)
• Third-party websites, content, or services linked from the Service
• Other users' actions or content (community forums, etc.)
• Unauthorized access to your account due to your failure to secure your password

14.3.5 Service Availability

• Downtime, interruptions, or unavailability of the Service
• Bugs, errors, or technical issues
• Modifications or discontinuation of features or the Service

14.4 Basis of the Bargain

You acknowledge and agree that:

• The limitations of liability in this Section 14 are a fundamental part of the basis of the bargain between you and BB Tracker
• The Service would not be provided without these limitations
• The pricing of the Service reflects these limitations
• These limitations apply even if any limited remedy fails of its essential purpose

14.5 Exceptions to Limitations

The limitations in this Section 14 do not apply to:

• Liability for gross negligence or willful misconduct by BB Tracker
• Liability for fraud or fraudulent misrepresentation
• Liability that cannot be excluded or limited under South African law, including:
  • Consumer Protection Act protections (if applicable)
  • Constitutional rights
  • Death or personal injury caused by our negligence

14.6 South African Consumer Protection Act

To the extent the South African Consumer Protection Act, 2008 applies to your use of the Service:

• Nothing in these Terms limits or excludes liability that cannot be limited or excluded under the Consumer Protection Act
• If any provision of these Terms is found to be unfair, unreasonable, or unjust under the Consumer Protection Act, that provision will be modified to the minimum extent necessary to comply with the Act
• All other provisions remain in full force and effect

14.7 Allocation of Risk

You acknowledge and agree that:

• You assume all risks associated with your use of the Service and tracked substances
• The limitations of liability in this Section 14 reflect a reasonable allocation of risk between you and BB Tracker
• You have had the opportunity to review these Terms and seek legal advice before agreeing

---

15. Indemnification

15.1 Your Indemnification Obligation

You agree to defend, indemnify, and hold harmless BB Tracker, its owners, officers, directors, employees, contractors, agents, affiliates, successors, and assigns (collectively, "Indemnified Parties") from and against any and all claims, liabilities, damages, losses, costs, expenses, and fees (including reasonable attorneys' fees and legal costs) arising out of or related to:

15.1.1 Your Violation of These Terms

• Breach of any representation, warranty, or obligation in these Terms
• Violation of the Acceptable Use Policy (Section 8)
• Unauthorized use of the Service
• Account sharing or allowing unauthorized access

15.1.2 Your Violation of Laws

• Illegal possession, use, distribution, or sale of controlled substances
• Violation of prescription requirements or medical practice laws
• Import/export violations
• Any other violation of South African law or local laws

15.1.3 Your Health Decisions

• Health consequences, injuries, illnesses, or death resulting from your use of tracked substances
• Medical expenses or treatment costs
• Claims by third parties (family members, healthcare providers, insurers, etc.) related to your health outcomes
• Failure to seek medical attention or follow medical advice

15.1.4 Your Content

• Content you upload, post, or transmit via the Service (cycle data, blood work, photos, forum posts, etc.)
• Infringement of third-party intellectual property rights (copyright, trademark, etc.)
• Defamation, libel, or invasion of privacy
• Uploading others' personal or medical information without consent

15.1.5 Your Use of the Service

• Negligent or wrongful acts or omissions in connection with your use of the Service
• Harm to third parties resulting from your use of the Service
• Claims by other users related to your conduct or content

15.2 Indemnification Process

If an Indemnified Party seeks indemnification from you:

• We will provide you with prompt written notice of the claim
• You will have the right to control the defense and settlement of the claim, provided:
  • You use legal counsel reasonably acceptable to us
  • You do not settle in a manner that admits liability on our behalf or imposes obligations on us without our prior written consent
• We reserve the right to participate in the defense at our own expense
• You will not settle any claim without our prior written consent if the settlement:
  • Requires us to admit liability or wrongdoing
  • Imposes any obligation or restriction on us
  • Does not include a full release of all Indemnified Parties

15.3 Cooperation

You agree to cooperate fully with us in the defense of any claim, including:

• Providing information and documentation
• Making yourself available for depositions, testimony, or other legal proceedings
• Assisting in the investigation and defense strategy

15.4 No Indemnification for Our Wrongdoing

You are not required to indemnify us for claims arising solely from:

• Our gross negligence or willful misconduct
• Our breach of these Terms
• Our violation of applicable law
• Defects in the Service caused by our actions or omissions

---

16. Legal Requests and Disclosure Resistance

16.2 Types of Legal Requests

Legal Requests may include:

• Subpoenas: Court orders requiring production of documents or testimony
• Search warrants: Court orders authorizing search and seizure of data
• Court orders: Judicial orders requiring disclosure of specific data
• Discovery requests: Requests for data in civil litigation
• Administrative demands: Requests from government agencies (tax authorities, regulatory bodies, etc.)
• National security letters (NSLs): (If applicable under South African law or international cooperation)

16.3 Our Legal Challenge Process

Upon receiving a Legal Request, we will:

1. Immediately assess the legal basis, scope, and validity of the request
2. Consult with legal counsel specializing in privacy and data protection law
3. File motions to quash or narrow the request if it is:
   • Overbroad or lacks specificity
   • Not supported by adequate legal basis
   • Violates constitutional rights (privacy, freedom of association, etc.)
   • Imposes undue burden
   • Seeks data we do not possess (e.g., decrypted Encrypted Data)
4. Appeal adverse rulings to higher courts if necessary
5. Seek protective orders to limit disclosure or maintain confidentiality
6. Negotiate with requesting party to narrow scope or accept alternative forms of compliance
7. Comply only after exhausting all legal remedies and only to the minimum extent legally required

16.4 User Notification

16.4.1 Immediate Notification (No Gag Order)

If we receive a Legal Request without a gag order, we will notify you immediately (within 24 hours) via email to your registered email address. Notification will include:

• Copy of the Legal Request and all related legal documents
• Nature and scope of the request (what data is sought)
• Legal basis for the request (subpoena, warrant, court order, etc.)
• Requesting party (law enforcement agency, private litigant, government body, etc.)
• Deadline for compliance (if specified)
• Our planned response and legal challenges
• Your right to independently challenge the request
• Contact information for legal assistance resources (legal aid organizations, privacy advocacy groups, etc.)
• Recommended actions (e.g., consult legal counsel, file your own motion to quash, delete data if legally permissible)

16.4.2 Delayed Notification (Gag Order)

If we receive a Legal Request with a gag order prohibiting user notification:

• We will challenge the gag order as part of our legal challenge to the request
• We will notify you as soon as the gag order expires or is lifted
• We will notify you as soon as legally permissible if the gag order is partially lifted
• If the gag order is permanent or indefinite, we will:
  • Disclose the existence of the gag order in our annual Transparency Report (if legally permissible)
  • Continue to challenge the gag order through legal appeals

16.4.3 Exception: Imminent Threat

We may not notify you if:

• We have a good faith belief that notification would create an imminent risk of death or serious bodily harm to any person
• We are legally prohibited from notification by a valid court order (gag order)

In such cases, we will document the reasons for non-notification and disclose them in our Transparency Report (if legally permissible).

16.5 Technical Limitations on Disclosure

Even if legally compelled to disclose data, our technical architecture limits what can be disclosed:

16.5.1 Encrypted Data

• We can only provide encrypted ciphertext of your Sensitive Health Data
• We cannot decrypt this data because we do not possess your Password-Derived Key
• Encrypted ciphertext is cryptographically useless without your Password-Derived Key
• We will inform the requesting party of this technical limitation

16.5.2 Password-Derived Key

• We do not store or have access to your Password-Derived Key
• We cannot provide your Password-Derived Key because we do not possess it
• Your Password-Derived Key is generated on your device and never transmitted to us

16.5.3 Password

• We store only a salted, hashed representation of your password using Argon2id
• We cannot reverse this hash to obtain your plaintext password
• We cannot provide your plaintext password because we do not possess it

16.5.4 Account Data

We can be compelled to disclose Account Data, which may include:

• Email address
• Account creation date and last login date
• Subscription tier and payment status
• IP addresses (retained for 90 days)
• Device and browser information (user agent strings)
• Service usage metadata (feature usage, session duration, page views)

Account Data does NOT include Encrypted Data (cycles, blood work, measurements, photos, etc.).

16.6 Your Right to Independently Challenge

You have the independent right to challenge any Legal Request seeking your data. We will support your challenge by:

• Providing you with copies of all legal documents
• Providing sufficient advance notice (to the extent legally permissible) to allow you to seek legal counsel
• Delaying compliance to the maximum extent legally permissible to give you time to file your own legal challenges
• Providing information about the requesting party and legal basis
• Recommending legal assistance resources (legal aid organizations, privacy advocacy groups, civil liberties organizations)

You may:

• Retain your own legal counsel to challenge the request
• File motions to quash or narrow the scope of the request
• Assert constitutional or statutory protections (privacy rights, medical confidentiality, etc.)
• Negotiate with the requesting party to limit disclosure
• Appeal adverse rulings to higher courts

Our legal challenges are independent of and in addition to your right to challenge.

16.7 Data Deletion Before Compliance

If you receive notification of a Legal Request and the compliance deadline has not yet passed, you may:

• Delete your account and all associated data (if legally permissible)
• Delete specific data sought by the request (if legally permissible)

16.8 Transparency Reports

We will publish annual Transparency Reports detailing:

• Total number of Legal Requests received (by type: subpoena, warrant, court order, administrative demand, etc.)
• Number of Legal Requests challenged and outcomes (granted, denied, partially granted, appealed, etc.)
• Number of Legal Requests complied with (in whole or in part)
• Types and volume of data disclosed (Account Data only; Encrypted Data cannot be disclosed in usable form)
• Number of user notifications sent
• Number of gag orders received and their duration (if legally permissible to disclose)
• Jurisdictions of requesting parties (South African law enforcement, foreign governments, private litigants, etc.)
• Notable cases (with personal details redacted) illustrating our legal challenges and outcomes

Transparency Reports will be published at: [TRANSPARENCY REPORT URL TO BE SPECIFIED]

We will announce each Transparency Report via email to all users.

16.9 Voluntary Cooperation

We will NEVER voluntarily cooperate with non-compulsory data requests, including:

• Informal requests from law enforcement without proper legal authority (subpoena, warrant, court order)
• Requests from private parties without court orders
• Requests from foreign governments without proper legal process (mutual legal assistance treaties, letters rogatory, etc.)
• Requests from researchers, journalists, or other third parties without your explicit consent

If we receive a non-compulsory request, we will:

• Decline to provide any data
• Inform the requesting party that a proper Legal Request is required
• Notify you of the request (unless it would compromise an ongoing investigation)

16.10 National Security and Intelligence Requests

If we receive a national security letter (NSL), FISA order, or similar intelligence request (if applicable under South African law or international cooperation):

• We will challenge the request to the maximum extent legally permissible
• We will seek to narrow the scope and duration of any gag order
• We will disclose the request in our Transparency Report as soon as legally permissible (even if only in aggregate form)
• We will notify affected users as soon as the gag order expires or is lifted

Due to our zero-knowledge architecture, we cannot provide decrypted Sensitive Health Data even in response to national security requests.

---

17. Account Termination

17.1 Termination by You (Voluntary Deletion)

17.1.1 Right to Delete

You have the absolute right to delete your account at any time, for any reason, without justification or penalty.

17.1.2 Deletion Process

• One-click deletion: Navigate to Account Settings > Delete Account
• Confirmation required: You will be asked to confirm deletion and enter your password
• Immediate deactivation: Your account is immediately deactivated upon confirmation
• No recovery: Deletion is permanent and irreversible; you cannot recover your account or data after deletion

17.1.3 Effect of Deletion

Upon account deletion:

• Immediate:
  • Account is deactivated (you cannot log in)
  • Password-Derived Key is destroyed (rendering all Encrypted Data cryptographically unrecoverable)
  • Access to the Service is revoked
• Within 30 days:
  • All Account Data is permanently deleted from production systems
  • All Encrypted Data is permanently deleted from production systems
  • All backup copies are permanently deleted
  • All data is irrecoverably destroyed (cannot be restored)

17.1.4 Refunds Upon Voluntary Deletion

• Pro Tier: No refund for remaining subscription period (you paid for access through the end of the billing period)
• Lifetime Tier: No refund (non-refundable after 30-day refund period)
• Exception: If deletion is due to our material breach of these Terms, you may request a pro-rated refund

17.2 Termination by Us (For Cause)

17.2.1 Grounds for Termination

We may terminate your account for violations of these Terms, including but not limited to:

• Serious violations (immediate termination without notice):
  • Illegal activities (distribution/sale of controlled substances, fraud, etc.)
  • Security violations (hacking, malware, unauthorized access, etc.)
  • Underage use (under 18 years of age)
  • Harassment, threats, or abuse of users or staff
  • Repeated violations after warnings
• Moderate violations (7 days' notice and opportunity to cure):
  • Violation of Acceptable Use Policy (Section 8)
  • Providing medical advice to others
  • Account sharing or unauthorized access
  • Uploading infringing or prohibited content
  • Spam or unsolicited commercial communications

17.2.2 Termination Process

• Serious violations:
  • Immediate account termination without prior notice
  • Email notification of termination and reason
  • No opportunity to cure
  • Data deleted per standard deletion process (30 days)
• Moderate violations:
  • Email notification of violation and 7-day cure period
  • Opportunity to correct the violation or respond
  • If not cured within 7 days, account is terminated
  • Data deleted per standard deletion process (30 days)

17.2.3 Refunds Upon Termination for Cause

• No refunds for accounts terminated for Terms violations
• Exception: If termination is later determined to be in error, we will reinstate your account and provide a pro-rated refund or service credit

17.2.4 Appeal Process

If your account is terminated for cause, you may appeal by:

• Emailing [APPEALS CONTACT TO BE SPECIFIED] within 14 days of termination
• Providing:
  • Account email address
  • Explanation of why termination was in error
  • Evidence supporting your appeal
• We will review and respond within 14 business days
• If appeal is granted, account will be reinstated and any refunds issued

17.3 Termination by Us (Without Cause)

17.3.1 Right to Terminate

We reserve the right to terminate any account, with or without cause, with 30 days' advance notice.

17.3.2 Termination Process

• Email notification 30 days before termination
• Reason for termination (if applicable)
• Opportunity to export data during 30-day notice period
• Account deactivated at end of 30-day period
• Data deleted per standard deletion process (30 days after deactivation)

17.3.3 Refunds Upon Termination Without Cause

• Pro Tier: Pro-rated refund for unused subscription time
• Lifetime Tier: Pro-rated refund based on reasonable expected service lifetime (e.g., 10 years from purchase date)

17.4 Effect of Termination

Upon termination (by you or by us), the following occurs:

17.4.1 Immediate Effects

• Access to the Service is revoked (you cannot log in)
• Password-Derived Key is destroyed (Encrypted Data becomes unrecoverable)
• Subscription is cancelled (no further charges)

17.4.2 Data Deletion (Within 30 Days)

• All Account Data permanently deleted from production systems
• All Encrypted Data permanently deleted from production systems
• All backup copies permanently deleted
• All data irrecoverably destroyed

17.4.3 Survival of Terms

The following sections survive termination and continue to apply:

• Section 9 (Content Ownership and Intellectual Property)
• Section 10 (Medical and Legal Disclaimers)
• Section 14 (Limitation of Liability)
• Section 15 (Indemnification)
• Section 18 (Dispute Resolution)
• Section 20 (General Provisions)

17.5 No Liability for Termination

We are not liable for any losses, damages, or consequences resulting from account termination, including:

• Loss of data (you must maintain backups using export feature)
• Loss of access to the Service
• Inability to track cycles or health data
• Any other consequences of termination

Exception: If termination is due to our material breach of these Terms, we may be liable for actual damages (subject to limitations in Section 14).

---

18. Dispute Resolution

18.1 Governing Law

These Terms and any disputes arising out of or related to these Terms or your use of the Service are governed by the laws of the Republic of South Africa, without regard to conflict of law principles.

18.2 Jurisdiction and Venue

18.2.1 Exclusive Jurisdiction

You agree that any legal action or proceeding arising out of or related to these Terms or your use of the Service shall be brought exclusively in the courts of [SPECIFIC VENUE TO BE DETERMINED], South Africa.

[TO BE SPECIFIED: Specific court venue, e.g., "High Court of South Africa, Gauteng Division, Pretoria" or "Magistrate's Court of [City]"]

18.2.2 Consent to Jurisdiction

You irrevocably consent to the personal jurisdiction of the courts specified above and waive any objection to venue or inconvenient forum.

18.2.3 Exception: Small Claims Court

Either party may bring claims in small claims court (Magistrate's Court) if the claim is within the jurisdictional limits of that court (currently ZAR 20,000 for Magistrate's Court).

18.3 Informal Resolution (Mandatory First Step)

Before filing any legal action, you agree to attempt informal resolution:

1. Contact us: Send a detailed description of the dispute to [LEGAL CONTACT TO BE SPECIFIED], including:
   • Your account email address
   • Nature of the dispute
   • Desired resolution
   • Supporting evidence or documentation
2. Good faith negotiation: We will respond within 30 days and attempt to resolve the dispute in good faith
3. Escalation: If the dispute is not resolved within 60 days of your initial contact, either party may proceed with formal legal action

Failure to attempt informal resolution may result in dismissal of your legal claim.

18.4 Arbitration (Optional)

[TO BE SPECIFIED: Decide whether to include binding arbitration clause]

Option A: No Arbitration (Disputes Resolved in Court)

All disputes that cannot be resolved informally shall be resolved exclusively in the courts specified in Section 18.2.

18.5 Class Action Waiver

[TO BE SPECIFIED: Decide whether to include class action waiver; may not be enforceable in South Africa]

Option A: No Class Action Waiver

You retain the right to bring claims as part of a class action, collective action, or representative proceeding.

18.6 Limitation Period

Any claim arising out of or related to these Terms or your use of the Service must be brought within three (3) years of the date the claim arose, or it is permanently barred. This limitation period applies to the maximum extent permitted by South African law.

18.7 Injunctive Relief

Notwithstanding any other provision of these Terms, we may seek injunctive or equitable relief in any court of competent jurisdiction to prevent:

• Actual or threatened infringement of our intellectual property rights
• Actual or threatened violation of these Terms that would cause irreparable harm
• Disclosure of confidential information or trade secrets

18.8 Legal Fees

In any legal proceeding arising out of or related to these Terms:

• Each party bears its own attorneys' fees and costs, unless:
• The prevailing party may be awarded reasonable attorneys' fees and costs if:
  • The losing party's claim or defense was frivolous, brought in bad faith, or for purposes of harassment
  • Applicable law provides for fee-shifting (e.g., consumer protection statutes)

---

19. Modifications to Terms

19.1 Right to Modify

We reserve the right to modify, amend, or update these Terms at any time, at our sole discretion.

19.2 Notice of Material Changes

For material changes (changes that significantly affect your rights or obligations), we will provide 30 days' advance notice via:

• Email to your registered email address
• Prominent in-app notification banner
• Notice on the website homepage

Material changes include:

• Changes to privacy commitments or data handling practices
• Changes to encryption or zero-knowledge architecture
• Changes to pricing or payment terms (for existing subscribers)
• Changes to limitation of liability or indemnification
• Changes to dispute resolution or governing law
• Removal of core features

19.3 Notice of Non-Material Changes

For non-material changes (minor clarifications, corrections, or updates that do not significantly affect your rights), we may provide notice via:

• In-app notification
• Notice on the website
• Email (at our discretion)

Non-material changes include:

• Clarifications of existing terms
• Corrections of typographical errors
• Updates to contact information
• Addition of new features (without removing existing features)
• Minor changes to service descriptions

19.4 Effective Date

• Changes become effective 30 days after notice (for material changes)
• Changes become effective immediately upon posting (for non-material changes)
• The effective date will be clearly stated in the updated Terms

19.5 Acceptance of Changes

Continued use of the Service after the effective date of changes constitutes your acceptance of the updated Terms.

19.6 Rejection of Changes

If you do not agree to the updated Terms:

• You must stop using the Service before the effective date
• You may delete your account before the effective date (no penalty)
• If you are a paid subscriber:
  • Pro Tier: You may cancel your subscription before the effective date; access continues until the end of the current billing period (no pro-rated refund unless the change materially reduces your rights)
  • Lifetime Tier: If the change materially reduces your rights, you may request a pro-rated refund within 30 days of the effective date

19.7 Version History

All previous versions of these Terms are available for review at: [TERMS VERSION HISTORY URL TO BE SPECIFIED]

Each version includes:

• Version number
• Effective date
• Summary of changes
• Full text of the version

19.8 No Retroactive Application

Changes to these Terms apply prospectively only (from the effective date forward) and do not apply retroactively to past conduct or disputes.

---

20. General Provisions

20.1 Entire Agreement

These Terms, together with the Privacy Policy and Cookie Policy, constitute the entire agreement between you and BB Tracker regarding your use of the Service and supersede all prior or contemporaneous agreements, understandings, representations, or communications (whether written or oral).

20.2 Severability

If any provision of these Terms is found to be invalid, illegal, or unenforceable by a court of competent jurisdiction:

• The invalid provision will be modified to the minimum extent necessary to make it valid and enforceable while preserving the parties' intent
• If the provision cannot be modified, it will be severed from these Terms
• All other provisions remain in full force and effect

20.3 No Waiver

Our failure to enforce any provision of these Terms, or to exercise any right or remedy, does not constitute a waiver of that provision, right, or remedy. Any waiver must be in writing and signed by an authorized representative of BB Tracker.

20.4 Assignment

20.4.1 Assignment by Us

We may assign, transfer, or delegate these Terms and our rights and obligations hereunder, in whole or in part, without your consent, including in connection with:

• Merger, acquisition, or sale of assets
• Corporate reorganization or restructuring
• Transfer to an affiliate or subsidiary

20.4.2 Assignment by You

You may not assign, transfer, or delegate these Terms or your rights and obligations hereunder without our prior written consent. Any attempted assignment without consent is void.

20.5 Force Majeure

We are not liable for any delay or failure to perform our obligations under these Terms due to events beyond our reasonable control, including but not limited to:

• Natural disasters (earthquakes, floods, fires, hurricanes, etc.)
• War, terrorism, or civil unrest
• Pandemics or public health emergencies
• Government actions, laws, or regulations
• Labor disputes or strikes
• Internet outages or telecommunications failures
• Third-party service provider failures
• Cyberattacks or security incidents

During a force majeure event, our obligations are suspended for the duration of the event. We will make reasonable efforts to resume performance as soon as practicable.

20.6 Notices

20.6.1 Notices to You

We may provide notices to you via:

• Email to your registered email address
• In-app notification
• Notice on the website

Notices are effective 24 hours after sending (for email) or upon posting (for in-app or website notices).

20.6.2 Notices to Us

You may provide notices to us via:

• Email to [LEGAL CONTACT TO BE SPECIFIED] (for legal matters)
• Email to [SUPPORT CONTACT TO BE SPECIFIED] (for general inquiries)
• Postal mail to [PHYSICAL ADDRESS TO BE SPECIFIED]

Notices are effective upon our receipt.

20.6.3 Keeping Email Address Current

You are responsible for keeping your email address current. If your email address changes, update it immediately in your account settings. We are not responsible for notices sent to an outdated email address.

20.7 Language

20.7.1 Official Language

These Terms are drafted in English. The English version is the official, authoritative version.

20.7.2 Translations

We may provide translations of these Terms in other languages for convenience. In the event of any conflict or inconsistency between the English version and a translated version, the English version controls.

20.8 Relationship of Parties

You and BB Tracker are independent contractors. These Terms do not create any partnership, joint venture, employment, agency, or franchise relationship. Neither party has authority to bind the other or make commitments on the other's behalf.

20.9 Third-Party Beneficiaries

These Terms are for the benefit of you and BB Tracker only. No third party has any right to enforce or benefit from these Terms, except:

• Indemnified Parties (as defined in Section 15) may enforce indemnification provisions
• Third-party service providers may enforce confidentiality obligations (if applicable)

20.10 Headings

Section headings and the table of contents are for convenience only and do not affect the interpretation of these Terms.

20.11 Interpretation

• "Including" and "includes" mean "including without limitation" and "includes without limitation"
• Singular includes plural and vice versa
• "Or" is not exclusive (means "and/or")
• "May" means discretionary; "shall" or "will" means mandatory
• "You" and "your" refer to the user; "we," "us," and "our" refer to BB Tracker

20.12 Electronic Signatures and Records

You consent to the use of electronic signatures, records, and communications for these Terms and all related transactions. Electronic signatures have the same legal effect as handwritten signatures.

20.13 Export Control

You agree to comply with all applicable export control and sanctions laws, including South African export control laws and international sanctions regimes. You represent that you are not:

• Located in a country subject to comprehensive sanctions (e.g., North Korea, Iran, Syria, Cuba)
• Listed on any government restricted party list (e.g., UN sanctions lists, EU sanctions lists, US OFAC lists)

20.14 Government Users

If you are a government entity or using the Service on behalf of a government entity, these Terms apply to you, and you agree to comply with all applicable procurement laws and regulations.

---

21. Contact Information

For questions, concerns, or notices related to these Terms or the Service, contact us at:

General Inquiries:

Email: [SUPPORT EMAIL TO BE SPECIFIED]
Response time: 24-48 hours (Pro/Lifetime); 48-72 hours (Free)

Legal Matters:

Email: [LEGAL EMAIL TO BE SPECIFIED]
Postal address: [PHYSICAL ADDRESS TO BE SPECIFIED]

Privacy and Data Protection:

Email: [PRIVACY EMAIL TO BE SPECIFIED]
Data Protection Officer: [NAME TO BE SPECIFIED]

Security Issues:

Email: [SECURITY EMAIL TO BE SPECIFIED]
PGP Key: [PGP KEY FINGERPRINT TO BE SPECIFIED]
For responsible disclosure of security vulnerabilities

Billing and Payments:

Email: [BILLING EMAIL TO BE SPECIFIED]

Abuse and Terms Violations:

Email: [ABUSE EMAIL TO BE SPECIFIED]

Appeals (Account Termination):

Email: [APPEALS EMAIL TO BE SPECIFIED]

Company Information:

Legal Name: [COMPANY LEGAL NAME TO BE SPECIFIED]
Registration Number: [COMPANY REGISTRATION NUMBER TO BE SPECIFIED]
Registered Address: [REGISTERED ADDRESS TO BE SPECIFIED]
VAT Number: [VAT NUMBER TO BE SPECIFIED]

---

22. Acknowledgment and Consent

By creating an account, accessing, or using BB Tracker in any manner, you acknowledge and agree that:

22.1 Reading and Understanding

• You have read and understood these Terms of Service in their entirety
• You have read and understood the Privacy Policy and Cookie Policy
• You have had the opportunity to seek legal advice before agreeing to these Terms
• You understand the legal and health risks associated with use of the Service and tracked substances

22.2 Age and Eligibility

• You are at least 18 years of age
• You meet all eligibility requirements in Section 5
• You are legally capable of entering into binding contracts under South African law

22.3 Agreement to Terms

• You agree to be bound by these Terms and all incorporated policies
• You consent to data processing as described in the Privacy Policy
• You accept all risks and responsibilities described in these Terms

22.4 Health and Legal Risks

• You acknowledge and understand the health risks described in Section 10.4
• You assume all risks associated with your use of performance-enhancing substances
• You understand the legal status of controlled substances in South Africa (Section 10.2)
• You are solely responsible for compliance with all applicable laws
• You release and hold harmless BB Tracker from all liability for health and legal consequences

22.5 Privacy and Encryption

• You understand that your Sensitive Health Data is encrypted client-side with your Password-Derived Key
• You understand that we cannot decrypt your data or recover your password
• You understand that if you lose your password, your encrypted data is permanently and irrecoverably lost
• You accept responsibility for password security and backup

22.6 No Medical Advice

• You understand that BB Tracker is not a medical service and we are not healthcare providers
• You understand that the Service provides educational information only, not medical advice
• You agree to consult qualified healthcare professionals before making health decisions
• You will not rely solely on the Service for medical decisions

22.7 Limitation of Liability

• You acknowledge the limitations of liability in Section 14
• You understand that our maximum liability is limited to the amount you paid in the past 12 months (or ZAR 1,000, whichever is greater)
• You agree that we are not liable for health outcomes, legal consequences, or data loss

22.8 Dispute Resolution

• You agree to the dispute resolution procedures in Section 18
• You agree to attempt informal resolution before filing legal action
• You consent to the exclusive jurisdiction of South African courts [or arbitration, if applicable]

22.9 Voluntary Agreement

• You acknowledge that your agreement to these Terms is voluntary and not coerced
• You have the option to not use the Service if you do not agree to these Terms
• You understand that continued use of the Service constitutes ongoing acceptance of these Terms

---

---