Privacy Policy — Forge
This Privacy Policy explains how Spirish (“we”, “us”, or “our”) collects, uses, and safeguards information when you use the Forge mobile application and related web services.
1. Information We Collect
- Account Information: Email address, display name, and authentication identifier (Email, Google Sign-In, or Sign in with Apple).
- Workout & Fitness Data: Logged workouts, exercises, sets, body weight entries, and progress photos you choose to store.
- Health Connect & HealthKit Data (Optional, With Explicit Consent): Step counts, weight measurements, and historical fitness entries read from Android Health Connect or Apple HealthKit only when you explicitly grant permission.
2. Device Permissions
Forge requests device permissions strictly on an opt-in, feature-specific basis:
- Health Connect / HealthKit (Read Weight, Steps & Fitness History): Accessed strictly with your explicit permission to display unified progress charts inside Forge.
- Camera: Used only when scanning barcodes/QR codes or capturing optional progress images.
- Push Notifications: Optional workout timers and reminders.
3. How We Use Information
- To operate, synchronize, and improve core features of Forge.
- To authenticate your account (where applicable), prevent fraud, and maintain service security.
- To verify in-app purchases and subscriptions without storing payment card details.
- To respond to customer support or privacy inquiries sent to support@spirish.com or privacy@spirish.com.
Health Connect & Apple HealthKit Limited Use Disclosure
Forge’s use of information received from Android Health Connect and Apple HealthKit adheres strictly to the Google Health Connect Permissions Policy (including the Limited Use requirements) and Apple HealthKit Guidelines:
- Health data read from Health Connect or HealthKit is used solely to display and synchronize your personal fitness, step, and weight metrics directly to you inside the Forge app.
- We never sell, rent, or share Health Connect or HealthKit data with advertising platforms, data brokers, or information resellers.
- We never use Health Connect or HealthKit data for personalized advertising, marketing, creditworthiness, or training generalized third-party AI models.
- You can revoke Health Connect or HealthKit access at any time in your Android or iOS system settings.
4. Service Providers & Data Processing
We do not sell your personal data or share personal data with third-party advertisers. We rely only on vetted infrastructure processors necessary to deliver the app:
- Google Firebase (Authentication, Cloud Firestore, Cloud Storage, Cloud Messaging)
- Google Play Billing / Apple App Store / RevenueCat (subscription validation)
All data transmitted between the app and cloud endpoints is encrypted in transit using HTTPS/TLS.
5. Data Retention & Account Deletion
We retain account data for as long as your account remains active. You may permanently delete your account and associated personal data at any time directly inside the app or via our Forge Account Deletion page. Verified deletion requests are completed within 30 days (excluding minimal transaction records required by tax or payment law).
6. Your Privacy Rights (UK GDPR, EU GDPR & CCPA)
Depending on your jurisdiction, you have the right to access, correct, export, restrict, or erase your personal data, and to withdraw consent at any time. To exercise any right, email privacy@spirish.com.
7. Children’s Privacy
Forge is not directed to children under the age of 13 (or 16 where required by local law), and we do not knowingly collect personal information from children. If you believe a child has submitted personal data, contact privacy@spirish.com and we will promptly delete it.
8. Contact Us
Data Controller: Spirish
Privacy Inquiries: privacy@spirish.com
General Support: support@spirish.com