Privacy belongs in the product, not only in a policy.

Our approach

ForgeIt is an AI-powered wellness intelligence platform that helps users optimise training, recovery, performance, health behaviours, and movement decisions through personalised insights. We handle health, training, identity, location, and account information as sensitive data. We use it only for stated product purposes, apply access controls, and do not sell personal information.

1. What we collect

• Profile data: training goal, experience level, equipment, days per week, injury areas, bodyweight (optional), motivation style

• Workout data: sessions, exercises, sets, weights, reps, personal records, session notes

• Device data: push notification token, device type, OS version, app version

• Health data (with your permission): steps and active calories from Apple Health or Google Fit. Read-only. Never uploaded to our servers. Used locally to improve calorie estimates only.

• Location data (with your permission): only collected when you enable cardio maps, Tag-Along, or Live Safety. See Section 8 for details.

• Payment data: subscription status only. Card details are handled by Paystack and Apple/Google. We never see or store raw payment credentials.

2. What we do not collect

• We do not collect your precise location unless you explicitly enable a feature that requires it

• We do not track you across other apps or websites

• We do not build advertising profiles

• We do not sell your data to any third party

• We do not share your workout data with anyone without your explicit consent

3. Legal basis for processing

We process your personal data under the following lawful bases:

• Contract performance: processing your data to deliver the ForgeIt service you requested, including generating workouts, tracking progress, and managing your account

• Consent: processing health data, location data, and sending push notifications — each requires your explicit opt-in permission

• Legitimate interest: improving ForgeIt features, preventing fraud, and ensuring service security

• Legal obligation: retaining records where required by applicable tax, accounting, or data protection law

4. How we use your data

• To generate your personalised training sessions and AI-powered recommendations

• To track your progress and personal records

• To send training notifications (with your permission)

• To improve the ForgeIt app, AI models, and features

• To process your subscription payments

• To provide live safety features when you enable them

5. How we protect your data

• All data is encrypted in transit (TLS 1.3)

• Database access is protected by Row Level Security — your data is only accessible to you

• Passwords are never stored — authentication is managed by Supabase's secure auth system

• Payment processing is handled by Paystack, Apple, and Google — industry-standard security

• Health and location data are treated as sensitive categories with additional access controls

• Sensitive production systems are protected through authentication, authorization, audit logging, encryption, and least-privilege access controls

6. AI processing

ForgeIt is an AI-powered wellness intelligence platform. ForgeIt Intelligence combines machine learning models, rule-based decision systems, and contextual user inputs to generate personalised recommendations.

• Generate personalised workout programmes and training recommendations

• Analyse training patterns, volume, and recovery signals

• Provide context-aware coaching cues during active sessions

ForgeIt Intelligence does not:

• Make medical diagnoses or provide medical treatment

• Replace professional medical or physiotherapy advice

• Make decisions on your behalf — you remain in full control of your training

Human judgement remains essential. Always consult a qualified professional for medical concerns.

7. Health data

• Health information (steps, active calories, heart rate from connected wearables) is treated as sensitive data

• Processed only with your explicit consent — you must grant permission via Apple Health or Google Fit

• Used solely to personalise your training recommendations and calorie estimates

• Read-only: ForgeIt does not upload raw health data to our servers unless you explicitly enable a feature that requires it

• You may withdraw consent at any time from your device's health app settings

8. Location data

Location data is optional and only collected when you enable features that require it:

• Cardio Map: records your route during outdoor cardio sessions

• Tag-Along: shares your live location with a selected contact during a workout

• Live Safety (FiGuardian): shares your real-time location with a trusted contact during active training

Key points:

• Location is never collected without your explicit permission

• Live tracking is only shared with contacts you choose

• Location sharing stops when your workout ends

• Location data is never sold or used for advertising

• You can revoke location permission at any time from your device settings

9. Emergency & safety features

ForgeIt includes safety features such as FiGuardian Live Safety and SOS alerts:

• You choose which trusted contacts receive your live location and alerts

• Alerts are sent only with your explicit permission during active sessions

• ForgeIt is not an emergency service and is not a replacement for 911, 112, 999, or local emergency responders

• ForgeIt does not guarantee that emergency contacts will receive or respond to alerts

• Always call your local emergency services in a genuine emergency

10. Wearable & health device integrations

ForgeIt integrates with the following health and wearable platforms:

• Apple Health

• Google Health Connect

• Bluetooth heart-rate chest straps

Data from connected devices remains owned by you. ForgeIt reads data only with your permission and uses it to enhance your training experience. We do not store raw wearable data on our servers unless a specific feature requires it.

11. Your rights

Depending on your jurisdiction, you may have the right to:

• Access: request a full export of your personal data

• Correction: update any incorrect data in your profile

• Deletion: delete your account and all associated data at any time from Settings → Delete Account

• Portability: export your workout history as CSV

• Withdrawal: withdraw consent for health sync, location, or notifications at any time

• Objection: object to processing based on legitimate interest

Depending on your jurisdiction, you may also have rights under applicable privacy laws, including the right to know, access, correct, delete, restrict processing, object to processing, and, where applicable, opt out of the sale or sharing of personal information. ForgeIt does not sell personal information.

To exercise these rights, contact privacy@forgeitapp.com

12. Data retention

• Your data is retained while your account is active

• When you delete your account, all personal data is scheduled for deletion within 30 days, except where retention is required by applicable law for tax, accounting, fraud prevention, or legal obligations

• Anonymous aggregate analytics may be retained for product improvement

13. International data transfers

• Your data may be processed and stored outside Ghana, including in the United States, Europe, and other regions where our service providers operate

• We use service providers that implement appropriate safeguards for international data transfers, including Standard Contractual Clauses where applicable

• We do not transfer your data to countries that lack adequate data protection without appropriate safeguards

14. Third party services

We use the following services to operate ForgeIt:

• Supabase — Authentication & Database

• RevenueCat — Subscription Management

• Paystack — Payment Processing

• Apple App Store — Payment Processing

• Google Play Billing — Payment Processing

• Mux — Video Streaming

• Expo — Push Notifications

Each service has its own privacy policy governing how they handle data.

15. Children

ForgeIt is not intended for users under the minimum digital age required by applicable law (13 years unless local law requires a higher age). We do not knowingly collect data from children under this age. If you believe a child has provided personal data, contact privacy@forgeitapp.com and we will delete it.

16. Changes to this policy

We will notify you of significant changes to this policy via push notification or email before they take effect. Continued use of ForgeIt after the effective date of the updated Privacy Policy constitutes acknowledgement of the updated policy.

17. Contact

Questions about this policy?

• privacy@forgeitapp.com

• security@forgeitapp.com