Draft for review. This is a plain-English draft prepared for Steve to review. It is not legal advice; have it checked before launch. Placeholders in [BRACKETS] still need filling in.

Privacy Policy

Effective date: [DATE] · Forged is operated by [LEGAL NAME / LLC] ("we", "us").

The short version

Your training log lives on your phone. We don't have a copy.
Only if you turn on Friends do a few numbers go to our server: your display name, rank and simple counts. Never your notes, weight, food or injuries.
We don't sell your data, and we never use your health or fitness data for ads.
You can export everything, or delete it all, at any time.

1. Data stored on your device

Everything you log in Forged stays in your browser's or app's local storage on your device. That includes workouts, notes, techniques, rounds, weights and reps, body weight, food and water, injuries, belts, competitions, goals and settings. It is not sent to us. If you delete the app or clear your browser data, it's gone unless you exported a backup (Profile → Your data → Export backup).

2. Friends (optional, off by default)

If you choose to turn on Friends and sign in with your email, we store the following with our hosting provider, Supabase:

your email address (to sign you in with a one-time code), and an account ID;
your display name, avatar initial and colour, rank, level, XP and belt colour;
daily counts used for friend challenges and leaderboards: number of sessions, push-ups, mat minutes, daily challenges done, and XP;
your friend connections, invites and the challenges you join.

We never upload your workout notes, techniques, body weight, food or nutrition, water, injuries, or any other details of your log. Your friends see only your display name, rank, and the counts above.

Supabase stores this data for us under a data-processing agreement. Access is restricted so that each person can read only their own data and the data their friends share.

Shared photos and videos: if you post a clip or photo to friends, it's stored privately, only you and your friends can see it, and it's automatically deleted 30 days after you post it. You can delete it sooner at any time.

3. Food lookups (Open Food Facts)

When you search for a food or scan a barcode, Forged sends that search text or barcode to Open Food Facts, a free, open food database, so it can return nutrition info. Nothing else is sent with it: no account, no log data. Open Food Facts' own privacy policy covers that request. Foods in Forged's built-in list are looked up on your device and are not sent anywhere.

4. What we don't do

We don't sell, rent or trade your personal data.
We don't use your health, fitness, weight, food or injury data for advertising or marketing, and we don't share it with advertisers or data brokers.
We don't show third-party ads and we don't use advertising trackers.

5. Payments (Forged Pro)

If Forged Pro subscriptions are offered, payments are handled by Apple (App Store), Google (Google Play) or our payment processor. We don't see or store your card number. We receive only what we need to know your subscription status.

6. Analytics and errors

Forged does not currently use analytics. If we add it, it will be a privacy-friendly service that counts page views or errors without cookies, cross-site tracking or personal profiles, and we'll update this policy first.

7. Deleting your data and your account

On your device: Profile → Your data → Clear all data deletes your log from the device.
Friends account: Profile → Friends → Delete account permanently deletes your account, profile, friend connections, challenges and synced counts from our server.
You can also email us at [CONTACT EMAIL] and we'll delete your account within 30 days.

8. Children

Forged is for people aged 13 and over. We don't knowingly collect personal data from children under 13. If you believe a child under 13 has created a Friends account, contact us and we'll delete it.

9. Your rights

Depending on where you live (for example, the EU, UK or California), you may have the right to access, correct, export or delete your personal data, or to object to how it's used. Most of this you can do yourself in the app. For anything else, email [CONTACT EMAIL].

10. Security and storage

Friends data is sent over encrypted connections (HTTPS) and stored by Supabase. No system is perfectly secure, but we keep what we store to the minimum listed above.

11. Not medical advice

Forged's tips, plans, calorie and macro estimates are general information only and not medical advice. See our Terms of Use.

12. Changes

If we change this policy, we'll update the date at the top and, for significant changes, tell you in the app.

13. Contact

[LEGAL NAME / LLC] · [CONTACT EMAIL]