Forge

Privacy Policy

Effective 5 September 2026 · Last updated 5 September 2026

Forge is a strength-training app: you log your workouts and a companion creature grows as you train. This policy explains what information Forge collects, why, and the choices you have. It covers the Forge iOS app and its backend service.

Forge is operated by Judy Leach (“we,” “us”). If you have questions about this policy or your data, contact us at privacy@forge-app.ca.

1. Information we collect

Information you provide

Your name — the display name you enter during onboarding or later change in Settings. Used only to personalize the app.
Your appearance preference — the accent colour you pick for your companion.
Your workouts — for each session you log: the date, an optional title you choose (for example “Push Day”), and each exercise’s name, weight, repetitions, and sets. Forge derives totals (such as training volume) and your companion’s progress from this.

Information from Sign in with Apple

Forge uses Sign in with Apple for accounts. When you sign in, Apple gives Forge a stable identifier that is unique to your Apple ID and to Forge. We store this identifier to recognise your account on future sign-ins.

We do not receive or store your email address, real name, or Apple ID credentials. Apple’s handling of Sign in with Apple is governed by Apple’s Privacy Policy.

Information collected automatically

When the app communicates with our servers, our hosting infrastructure records standard technical information for operating and securing the service: the time of the request, which feature or endpoint was used, your Forge account identifier, your device’s IP address, and diagnostic details when an error occurs. These logs are used for debugging, security, and reliability. They are not used for advertising or profiling.

Information stored on your device

Forge keeps a login token in the iOS Keychain so you stay signed in, and a local copy of your account details (identifier, name, colour, subscription tier) so the app can start without a network request. This data stays on your device and is removed when you sign out or delete the app.

Category	Examples	Purpose
Account identity	Sign in with Apple identifier, account creation date	Create and secure your account
Profile	Display name, accent colour	Personalise the app
Fitness activity	Workout dates, titles, exercises, weight/reps/sets, derived volume and streaks	The core feature — track training and grow your companion
Subscription status	Free or Pro tier, monthly workout count	Apply the free-tier monthly limit
Diagnostics	Request logs, IP address, error traces	Operate, debug, and secure the service

2. What we don’t collect

Forge does not collect, and has no code to collect:

your email address or a password;
your precise or approximate location;
Apple Health / HealthKit data;
your contacts, photos, calendars, or files;
device advertising identifiers;
analytics or behavioural telemetry from third-party SDKs (Forge includes none).

3. How we use your information

To provide the app: authenticate you, save your workouts, and calculate your companion’s stage, intensity, and progress.
To enforce the free tier’s monthly workout limit.
To keep the service running, diagnose problems, and protect against abuse and security threats.
To respond to your support or privacy requests.

We do not sell your personal information, we do not share it for advertising, and we do not use it to build profiles of you.

4. Where your information is stored

Your account and workout data are stored in a managed PostgreSQL database hosted on Amazon Web Services in the United States (Ohio region). Data is encrypted in transit (HTTPS) and at rest. Automated database backups are retained for up to about seven days.

We share information only in these cases:

Service providers. Amazon Web Services provides our hosting, database, logging, and content delivery. AWS processes data on our behalf under its own security and privacy commitments.
Apple. Sign in with Apple is provided by Apple as part of authentication.
Legal reasons. If required by law, or to protect the rights, safety, or property of Forge, our users, or others.
Business transfer. If Forge is involved in a merger, acquisition, or sale of assets, your information may be transferred, and we will notify you of any change in ownership or use of your personal data.

Payments. Forge does not currently process any payments. If a paid subscription launches, billing will be handled by Apple and/or a PCI-compliant payment processor, and this policy will be updated to describe it. Forge does not receive or store your card details.

Advertising and analytics. Forge shows no third-party ads and uses no third-party analytics services. If that changes, we will update this policy and, where required, ask for your consent first.

6. How long we keep it

Your account and workout data are kept for as long as your account exists.
When your account is deleted, your personal data is removed from the live database. Copies in routine backups age out on their normal cycle (about seven days); diagnostic logs age out on their retention schedule.
We may retain limited information where necessary to comply with legal obligations or resolve disputes.

7. Your rights and choices

Depending on where you live, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing. We honour these requests regardless of your location.

Access or correct. You can view and edit your name and workout history in the app. For a full copy of your data, email us.
Delete your account. Email privacy@forge-app.ca from the request and we will delete your account and associated workout data within 30 days. Deleting your account is permanent. (In-app account deletion is in development and will be added to Settings.)
Sign out. Signing out removes your login token and cached profile from the device.
Withdraw from the service. Deleting the app stops all further data collection; it does not by itself delete your server-side account — use the deletion request above for that.

We will not discriminate against you for exercising any of these rights. If you are in the EEA or UK and believe we have mishandled your data, you may complain to your local supervisory authority.

8. International users

Forge is operated from Ontario, Canada and stores data in the United States. If you use Forge from outside the United States, you understand that your information will be transferred to and processed in the United States, which may have different data-protection laws than your country. Where required, we rely on appropriate safeguards for such transfers.

9. Children’s privacy

Forge is not directed to children. We do not knowingly collect personal information from anyone under 13 (or under the minimum age of digital consent in your country, such as 16 in parts of the EEA). If you believe a child has provided us personal information, contact us and we will delete it.

10. Security

We protect your information with encryption in transit and at rest, a database that is not publicly reachable from the internet, scoped access controls, and short-lived login tokens. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your information and to address vulnerabilities promptly.

11. Changes to this policy

We may update this policy as Forge evolves. When we do, we will change the “Last updated” date above. For material changes, we will provide a more prominent notice, such as in the app or on the App Store listing, before the change takes effect.

12. Contact

Questions, requests, or complaints about your privacy: privacy@forge-app.ca.

Judy Leach
Ontario, Canada