Last updated: 2026-05-17 Effective: 2026-05-17
This Privacy Policy describes how Forge (“the App”, “we”, “us”) handles information when you use our iOS application. Forge is operated as a sole proprietorship by Supiphat Kasetrsuwan, located in Thailand. We’ve built the App to do as little as possible with your data. Read on to see what that means.
Before the legal detail below, five principles that shape every decision we make about your data:
The data controller responsible for processing your personal data is:
For users in Thailand, this notice is provided in accordance with the Personal Data Protection Act B.E. 2562 (2019) (“PDPA”). For users in other jurisdictions, equivalent rights under your local data-protection law apply (see §9).
All of the above is stored in SwiftData on your device. Forge v1.0 does not synchronize your workout data across devices — it lives on the device where you installed it. Cross-device sync may be introduced in a future update; this Policy will be updated before that happens.
When you use AI-powered features, the following is sent to our backend, hosted on Supabase in the Oceania (Sydney, Australia) region:
We do not store the request payload server-side after the AI response is returned. Rate-limit usage rows are retained for 30 days and contain only (user_id, endpoint, timestamp) — no payload content.
The AI request payloads above are forwarded from our backend to one or both of:
We do not pass identifying information (your name, email, Apple ID, anonymous Forge user ID, etc.) to these providers — only the workout context relevant to the request. The forwarded payload contains no values that would, on their own, identify you to either provider.
If Anthropic or OpenAI updates their published retention or training policies, we will update this Policy to reflect the change. If you are concerned about US-based processing of your data, you can avoid all AI calls by using only the free tier of the App (workout logging, deterministic progressive overload, streaks, volume/PR tracking, template programs).
When you subscribe, payment is processed by Apple via StoreKit. Apple shares with us only the information needed to validate your subscription:
We never see your name, billing address, card number, or Apple ID.
Under PDPA §24, we rely on the following lawful bases:
| Processing activity | Lawful basis |
|---|---|
| Generating AI programs and adaptations from your workout context | §24(3) performance of a contract between you and us — necessary to deliver the paid features you subscribed to |
| Logging anonymous rate-limit rows to prevent automated abuse | §24(5) legitimate interest — protecting the integrity and cost of the AI service |
| Processing StoreKit subscription receipts to grant tier access | §24(3) performance of a contract |
| Writing workout records to your Apple Health | §24(1) consent — you grant HealthKit permission via the iOS system prompt |
We do not rely on consent for processing of the anonymous data described in §2.2 or §2.3 because it is not “personal data” under PDPA §6 — there is no identifiable natural person attached to the anonymous user ID.
Your data leaves Thailand in two ways:
For these transfers we rely on:
If the PDPC issues binding adequacy determinations or model contractual clauses applicable to these transfers, we will update our agreements accordingly.
We do not process your information for advertising, profiling, sale, or analytics.
We do not sell, rent, or trade your information to anyone. We share information only:
We do not embed advertising SDKs, analytics SDKs, or third-party trackers.
To request deletion of any anonymous server-side records, email supiphatk17@gmail.com with your anonymous user ID.
No system is perfectly secure. If you discover a vulnerability, please report it to supiphatk17@gmail.com.
If you are a data subject in Thailand, you have the following rights, exercisable by emailing supiphatk17@gmail.com:
If you are in the European Economic Area, the United Kingdom, California, Australia, or any other jurisdiction with comparable data-protection law, you have equivalent rights under your local regime (GDPR Articles 15–22, UK GDPR, CCPA §1798.100 et seq., Privacy Act 1988 (Cth), etc.). Contact us at the email above to exercise them.
The App is rated 4+ on the App Store and contains no objectionable content, but it is not directed at children under 13 (or the equivalent threshold in your jurisdiction). We do not knowingly collect information from children. If you believe a child has used the App and you wish to delete any associated anonymous records, contact supiphatk17@gmail.com.
We may update this Policy. Material changes will be reflected in the App via an update notice and on the App Store. The “Last updated” date at the top of this document is authoritative.
We respond to verified data-subject requests within 30 days of receipt (per PDPA §30, GDPR Art 12(3), and equivalent timelines in CPRA / Privacy Act 1988 / POPIA).
The provisions in this §13 are in addition to §§1–12 and grant additional rights to users in specific regions. Nothing here reduces rights granted under §§1–12 or under the regional law itself.
If you are in the EEA, the United Kingdom, or Switzerland, the General Data Protection Regulation (Regulation (EU) 2016/679) or its UK / Swiss equivalent governs our processing of your personal data.
Data Controller. Supiphat Kasetrsuwan, Thailand. Acting DPO contact: supiphatk17@gmail.com.
EU/UK Representative. Forge does not currently have a designated representative within the EU or UK under GDPR Art 27 / UK GDPR Art 27. Forge’s processing falls within the limited scope exemption of GDPR Art 27(2)(a) because it is occasional, does not include large-scale processing of special-category data, and is unlikely to result in a risk to data subjects’ rights — but we will appoint a representative if our EU/UK user base or processing volume grows to require it.
Lawful bases for processing (Article 6).
| Processing | Article 6 basis | Notes |
|---|---|---|
| Workout logging and overload calculations | 6(1)(b) — necessary for performance of the contract you entered when subscribing to the App | Core service |
| AI program generation, weekly check-in adaptation, in-workout coach cards | 6(1)(b) for paid users, or 6(1)(a) explicit consent at first AI use | Combined with Art 49 derogation for US transfers (see §13.1 below) |
| Rate-limit logging (anonymous user ID + endpoint + timestamp) | 6(1)(f) — legitimate interest (anti-abuse, fair-use enforcement) | Balancing test documented in our internal RoPA |
| HealthKit body-mass read | 6(1)(a) — your explicit consent given via the iOS HealthKit permission prompt | Consent can be withdrawn anytime in iOS Settings → Privacy & Security → Health |
| Subscription/payment data (handled by Apple) | 6(1)(b) — performance of contract | Apple is the merchant of record |
Special-category data (Article 9). Body-weight readings via HealthKit may, in combination with other health context, constitute “data concerning health.” We process such data only on the basis of Art 9(2)(a) — your explicit consent, given through the iOS HealthKit permission prompt — and only for the in-app fitness purposes described in §5.
Your rights under GDPR (Articles 15–22).
Automated decision-making (Article 22). Forge’s AI-generated training programs and adaptations are suggestions, not binding decisions. They do not produce legal effects, do not affect your access to goods or services, and they require your action (logging a set, accepting a weight increase) to take effect. Article 22 protections nonetheless apply: you have the right to obtain human review of any AI-generated suggestion, to contest it, and to express your view. You may exercise this right by emailing supiphatk17@gmail.com — we will manually review any disputed suggestion within 30 days.
International data transfers (Article 49 derogation). Where you use AI features, anonymized workout context is transferred to Anthropic PBC and OpenAI OpCo LLC in the United States. The United States has not been determined adequate by the EU Commission for the purposes of GDPR Art 45. We rely on:
We do not transfer special-category data internationally. We have reviewed Anthropic’s and OpenAI’s published data-processing agreements and confirmed their use of Standard Contractual Clauses (SCCs) for their own international transfers, providing belt-and-suspenders safeguards.
Right to lodge a complaint (Article 77). If you believe our processing violates GDPR or UK GDPR, you may lodge a complaint with:
ico.org.uk (UK users)edoeb.admin.ch (Switzerland)Retention. On-device data: as long as you keep the App installed (you can erase anytime via Settings → Privacy → Delete My Data). Server-side rate-limit rows: 30 days. AI provider data: per provider policy (Anthropic deletes prompts after 30 days unless retained under enterprise terms; OpenAI policy as published).
Breach notification (Article 33–34). We will notify the competent supervisory authority within 72 hours of becoming aware of a personal-data breach affecting EEA/UK users, and notify affected users where the breach poses a high risk to their rights and freedoms.
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, grants you the following rights:
Categories of personal information collected (Civil Code §1798.140).
| CCPA category | What we collect | Purpose |
|---|---|---|
| Identifiers | Anonymous Supabase user ID (UUID, per-install) | Rate-limit enforcement, AI request routing |
| Commercial information | Subscription status, transaction identifier | Apple is merchant of record; we receive entitlement status only |
| Internet or other electronic network activity | Rate-limit logs (endpoint, timestamp) | Anti-abuse |
| Geolocation | None collected | — |
| Sensory information | None collected | — |
| Professional information | None collected | — |
| Inferences | Training-related inferences derived from your inputs (e.g., experience level, training-day pattern) | AI personalization (Pro users) |
| Health & medical information (CMIA proxy) | Body-mass reading from HealthKit (if you grant permission); workout history | AI personalization, scaling calculations |
| Other categories | None | — |
Categories of sources. Directly from you via in-app input; via Apple HealthKit with your permission; via Apple StoreKit (subscription state only).
Categories of third parties to whom we disclose. Anthropic PBC (US) and OpenAI OpCo LLC (US) for AI inference; Supabase Inc. (Sydney, Australia) for backend hosting; Apple Inc. (US) for App Store and payment processing.
Sale or sharing. We do not sell personal information for monetary or other valuable consideration. We do not share personal information for cross-context behavioral advertising. No opt-out from “sale or sharing” is required, but if you wish to ensure no such disclosure, contact us.
Your CCPA/CPRA rights.
Verifying a request. We verify you via your anonymous Supabase user ID, your subscription transaction ID (if applicable), and a confirmatory reply to the email address you contact us from.
Response time. 45 days from receipt; we will inform you in writing if we need an additional 45 days under §1798.130(a)(2).
Non-discrimination (§1798.125). We will not deny goods or services, charge different prices, or provide a different level of service in retaliation for exercising any right under CCPA/CPRA.
Authorized agents. You may designate an authorized agent to make a request on your behalf; we will verify the agent’s authority before disclosing or deleting any information.
California Shine the Light (Civil Code §1798.83). We do not share personal information with third parties for those parties’ direct-marketing purposes.
If you reside in Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, or another US state with a comprehensive consumer-privacy statute, you have the rights granted by your state’s law, which substantively mirror those in §13.2 above. Procedurally, exercise them through the in-app flows or email; we will apply the response timelines, exemptions, and appeal rights of your state’s statute.
If you are an Australian resident, the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) govern our processing of your personal information. You have rights of access (APP 12) and correction (APP 13), exercisable through the in-app Export and Delete flows or email.
Notifiable Data Breaches scheme. We will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals of any eligible data breach in compliance with Part IIIC of the Privacy Act.
Complaints. You may complain to the OAIC at oaic.gov.au.
If you are a New Zealand resident, the Privacy Act 2020 governs our processing. You have rights of access (Information Privacy Principle 6) and correction (IPP 7). Complaints: the Office of the Privacy Commissioner at privacy.org.nz.
If you are domiciled in a Canadian province or territory other than Quebec (we do not currently offer Forge in Quebec — see TERMS.md §19.4), the Personal Information Protection and Electronic Documents Act (PIPEDA) governs our processing of your personal information. You have rights of access and correction, exercisable via the in-app flows or email. Complaints: the Office of the Privacy Commissioner of Canada at priv.gc.ca.
If you are a Singapore resident, the Personal Data Protection Act 2012 governs our processing. You have rights of access, correction, and withdrawal of consent. Complaints: the Personal Data Protection Commission Singapore at pdpc.gov.sg.
If you are a South African resident, the Protection of Personal Information Act, 2013 governs our processing. You have rights of access, correction, deletion, and objection. Complaints: the Information Regulator at inforegulator.org.za.
If you are domiciled in a region not specifically addressed here but covered by an applicable data-protection statute (e.g., Brazil LGPD, Japan APPI), the rights granted by that statute apply to your personal information regardless of any contrary provision in this Policy. Contact us to exercise them.
This Policy is provided in English. A Thai-language version may be made available for users in Thailand on request and prior to widespread Thai-market marketing. Region-specific addenda in §13 reflect commitments to non-Thai users in territories Forge supports — see docs/MARKETS.md for the current territory list.