Privacy Policy.

01The short version

• Everything you enter is stored on your phone first. The app works without an account and without an internet connection.
• If you create an account, your data is copied to our database so it is backed up and available on your other devices.
• We do not show ads, we do not use advertising or analytics trackers, and we do not sell or share your personal information for advertising.
• You can export a copy of your data, and delete your account and everything stored with it, from Settings.

02What the app collects

Information you give us: your name, age, sex, height and body weight; your goal, training experience, schedule and where you train; injuries and areas of pain; sleep, stress and daily activity level; diet preferences and foods you avoid; daily check-ins (sleep, soreness, stress, mood); workouts, sets and weights you log; meals you log; weigh-ins.

Activity recording: when you record an outdoor activity, the app uses your phone’s precise location, including in the background while the recording is running, to measure your route, distance, pace and elevation. When you open the Move screen, the app also reads your current location once to center the map; that location is not saved or sent to us. Location is not collected in the background when you are not recording.

Sensors: if you connect a Bluetooth heart-rate strap, power meter, smart trainer, treadmill or footpod, the app reads heart rate, power, cadence and speed during your session and saves them with that session.

Account: if you create an account, the email address or phone number you sign in with, or the basic profile Apple or Google shares with us when you use them to sign in (name and email).

Health information. Much of the above is health information: body measurements, injuries and pain, heart rate, sleep and stress, diet and calories. We use it only to build and adjust your training and nutrition plan and to show you your progress. See “Consumer health data” below.

03Where your information is stored

On your phone. By default everything stays in the app’s storage on your device.

In your account. If you sign in, your data is synced to a database hosted for us by Supabase, Inc. in [DATA REGION, e.g. United States (us-east-1)]. Each record is tied to your account and protected so that only you can read or change it. Data travels over encrypted connections.

04What other people can see

Nothing, unless you choose to share it.

• Posts. If you post an activity to the feed, other users see your handle, the activity’s title, sport, distance, time and climb, and a map of the route. The first and last 250 meters of the route are removed before it leaves your phone so it does not show where you start or finish, and posts are grouped by an area of roughly 10 km (6 miles), never an address. You can take a post down at any time.
• Leaderboards. If you take part, your handle, level, XP and streak are visible to other users.
• Riding or running with others indoors. When you are signed in and start an indoor session, other people on the same virtual course see your first name and your position on that virtual road, live. No real-world location is ever sent, and these positions are not stored.

05Other services the app uses

• Supabase — account sign-in, database and live indoor sessions.
• Apple and Google — only if you choose to sign in with them.
• CARTO — map images. To draw a map, your device requests map tiles for the area shown, which tells CARTO your IP address and that area.
• Unsplash — some photos in the app are loaded from Unsplash, which receives your IP address.
• Google Analytics (the forgeachieve.com website only) — if you accept cookies, Google Analytics measures visits to the site (pages viewed, time spent, device type, approximate country) so we know which pages are useful. Nothing loads if you decline, and you can change your mind any time with the “Cookies” link at the bottom of every page. We don’t use this data for advertising and we don’t sell it.

These providers process information to run their service for us. We do not give them your training, health or nutrition data except Supabase, which stores it for us.

06Reminders

If you turn on reminders, they are scheduled on your phone. No reminder content is sent to us.

07Claiming a reward

If you claim a physical gift, you give us a shipping name, address, country and, optionally, a phone number for the courier. With the claim, the app sends a summary of your training so we can check it is genuine: account age, level and XP, the number of sessions, sets and activities, how your indoor time was measured, your streak, badge count, weight change since you started, and a list of your last dozen sessions and activities (date and title). No GPS track is sent. Only you and our team can see a claim. We use the address only to ship that gift, and share it only with the carrier that delivers it. Addresses are erased 120 days after a claim is shipped or refused; the training summary stays with the claim record so we can answer questions about it.

08How long we keep it

Data on your phone stays until you delete it (Settings → Reset this device) or remove the app. Data in your account stays until you delete it or delete your account. When you delete your account, it is removed from our database immediately; copies in our provider’s encrypted backups expire on their normal schedule.

09Your choices and rights

• Access and portability: Settings → Backup → Export a copy.
• Correction: edit your profile, logs and activities in the app.
• Deletion: delete any activity or post; Settings → Delete account removes your account and all of its data.
• Withdraw consent: stop sharing by taking posts down, sign out to stop syncing, or delete your account. Location and Bluetooth permissions can be turned off in your phone’s settings.

Depending on where you live — including California, Washington, other US states, the UK, the EU and the European Economic Area — you may have further rights, such as to know what we hold, to object to or restrict processing, and to complain to a data protection authority. To exercise any right, write to [PRIVACY CONTACT EMAIL]. We will not discriminate against you for exercising them.

10Consumer health data

This section is our consumer health data privacy policy under Washington’s My Health My Data Act and similar state laws.

Categories collected: body measurements (height, weight), age and sex; injuries and pain; heart rate; sleep, soreness, stress and mood check-ins; diet, food intake and calories; exercise and activity data, including location while recording.

Sources: you, and Bluetooth sensors you connect.

Purpose: to build and adjust your training and nutrition plan, record your activities and show your progress. We do not use it for advertising.

Sharing: with Supabase, which stores it for us. We do not sell consumer health data. Only what you choose to post (see “What other people can see”) is visible to other users.

Your rights: to confirm whether we collect it, access it, delete it and withdraw consent, as described above.

11Legal bases (EU, EEA and UK)

We process your information to provide the app you asked for (contract), and your health information with your explicit consent, which you give when you set up your plan and can withdraw at any time. Where data is transferred outside your country, we rely on the safeguards our providers offer, such as the European Commission’s Standard Contractual Clauses.

12Children

FORGE is not for children. You must be at least 13 to use it, or 16 in the EU, the EEA and Switzerland. If you believe a child has given us information, contact us and we will delete it.

13Security

We use encrypted connections, per-account access rules in our database, and keep what we collect to what the app needs. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.

14Changes

If we change this policy in a way that matters, we will tell you in the app before the change applies.

15Contact

[COMPANY LEGAL NAME] · [MAILING ADDRESS] · [PRIVACY CONTACT EMAIL]