Privacy Policy

Effective date: May 5, 2026 · Last updated: September 12, 2026 (added Sections 1.4, 1.5, 4.5 and 6.1 covering the Forge Shield browser extension and scheduled check-in calls)

This Privacy Policy describes how Forge Labs LLC ("we," "us," "our") collects, uses, and protects information when you use the Forge mobile application (the "App"). Forge is a recovery and sobriety tracking tool that supports streaks, daily check-ins, a community feed, accountability partners, and related features.

This policy also covers our desktop products, which are sold and billed separately from the App: the Forge Shield browser extension (Section 1.4) and scheduled check-in calls (Section 1.5). Where this policy says "the App," read it as "the App and the desktop products" unless a section says otherwise. You can use the App without the desktop products, and the desktop products without the App.

We take privacy seriously because the information you share with Forge — your recovery progress, moods, urges, and reflections — is deeply personal. This policy explains what we collect, why, and the control you have over it.

Quick summary

We collect only what Forge needs to work. We do not sell your data. We do not use it for advertising. You can delete your account and all associated data at any time from Settings.

1. Information We Collect

1.1 Information you provide directly

Account information. Email address and password when you create an account. A display name if you choose to set one.
Profile information. Optional goals, recovery start date, and other profile details you enter.
Health-related content. Streak data (the substance or behavior you are tracking, start date, resets), daily check-ins (mood rating, urge level, free-text reflections), journal entries, and milestones you reach.
Community content. Posts, comments, likes, and any text or interactions you share in the Forge community feed.
Accountability partner connections. Requests you send or accept to connect with other Forge users as accountability partners.
Support communications. If you email us or submit feedback, we receive your message and contact details.

1.2 Information collected automatically

Device information. Device model, operating system version, app version, language, and time zone.
Usage information. Aggregated, anonymized data about which screens you visit and which features you use, solely to improve the App. We do not track individual browsing behavior outside Forge.
Diagnostic data. Crash logs and performance data (via Firebase Crashlytics) to help us fix bugs. Crash reports are automatically scrubbed of personally identifying information where technically feasible.
IP address. Briefly logged during authentication for security and abuse prevention.

1.3 Information from Apple Health (optional)

If you enable the Apple Health integration (Settings → Apple Health → Connect), Forge reads the following metrics from the Health app on your iPhone so they can be attached to each daily check-in:

Heart Rate Variability (HRV, SDNN) — most recent sample.
Resting Heart Rate — most recent sample.
Step Count — total for the current local calendar day.
Sleep Analysis — total minutes asleep in the last 24 hours.

This integration is read-only — Forge never writes data back to Apple Health. Apple Health data is processed on the basis of your explicit consent, given both through the iOS Health permission sheet and by enabling the integration in Forge's Settings. You can revoke this consent at any time from iOS Settings → Privacy & Security → Health → Forge, or by disconnecting the integration in Forge.

The values we read are stored alongside your journal entry in Firestore (see Section 4.2) so the App can show trends over time. We do not use Apple Health data for advertising, third-party marketing, data brokering, or any purpose unrelated to the App's core functionality, and we do not share it with anyone other than the sub-processors listed in Section 4.2. This is a requirement of Apple's HealthKit framework and we honor it contractually and technically.

1.4 Forge Shield browser extension

Forge Shield is a Chrome extension that blocks adult and gambling websites and reports blocked attempts to an accountability partner you nominate. It is a paid product, separate from the App.

What the extension sends to us:

Blocked-attempt events. For each request the extension blocks: the hostname only (for example example.com), the category that matched (adult or gambling), whether you stopped or chose to continue, and a timestamp. The path, the query string, and any search terms are stripped before the event leaves your browser, and stripped again on our server.
A device identifier and pairing token. Generated when you pair the extension with your Forge account. Stored locally in the browser and sent with each report.
An hourly heartbeat. The device identifier, token, and extension version, so we can tell whether the extension is still running. This exists because a silent uninstall is the obvious way around an accountability tool.
An uninstall signal. If you remove the extension, Chrome opens a URL containing the device identifier and token so we know it was removed.
Your accountability partner's name and email address, which you enter yourself when pairing.

What the extension does not collect: your browsing history, the contents of any page, your searches, your keystrokes, your form data, or anything at all about websites that were not blocked. The extension does not request Chrome's tabs or history permissions, and it cannot read the URL of a page you are viewing.

Because the purpose of the product is disclosure to a third party, see Section 4.5 for exactly what your accountability partner is told.

1.5 Scheduled check-in calls

If you subscribe to check-in calls, Forge places automated phone calls to you at times you choose. To do that we collect and store:

Your phone number and first name.
Your chosen call times, days, and timezone. Calls are confined to 08:00–21:00 in your local time.
A record of your consent. The exact consent text you agreed to, its version, the time you agreed, your IP address, and your browser's user-agent string. This is a legal record under US telephone-consumer law and is kept as an immutable log separate from your settings. It is retained after you opt out — see Section 6.
Call outcomes. Whether the call was answered, whether the right person answered, the keypad response you gave, and the call's technical status.

Calls are not recorded and not transcribed. There is no microphone capture and no speech recognition; you answer with the keypad. Consent is tied to a specific phone number — if you change the number, we ask for consent again rather than carrying the old one over. You can stop calls at any time from your account page or by pressing the opt-out key during a call.

1.6 Information we do NOT collect

We do not collect precise location data.
We do not access your contacts, photos, microphone, or camera unless you explicitly grant permission for a specific feature.
We do not link your Forge activity to third-party advertising identifiers (IDFA).
We do not read any Apple Health data types other than those listed in Section 1.3. We do not write any data to Apple Health.

2. How We Use Your Information

We use the information described above to:

Create and maintain your account and authenticate you when you sign in.
Provide the App's core features — streaks, check-ins, the community feed, badges, accountability partners, and resources.
Save your progress and sync it across your devices.
Send milestone notifications and other in-app messages about features you've enabled.
Respond to your support requests and feedback.
Detect, prevent, and respond to abuse, fraud, and violations of our Terms of Service.
Improve the App through aggregated, anonymized analytics.
Comply with legal obligations.
Block the website categories you asked us to block, and send the accountability reports you asked us to send (Forge Shield).
Place the check-in calls you scheduled, and keep a record that you consented to them.
Take payment for the desktop products and manage your subscription.

We do not use your information for advertising, profiling for commercial purposes, or any use incompatible with the purposes described above.

3. Legal Bases for Processing (EU/UK Users)

If you are located in the European Economic Area, United Kingdom, or Switzerland, we process your personal data on the following legal bases under the GDPR and UK GDPR:

Performance of a contract — to provide the App's services you signed up for.
Consent — for optional features such as push notifications. You can withdraw consent at any time.
Legitimate interests — to secure the App, detect abuse, and improve features, where our interests do not override your rights.
Legal obligation — where we are required to process data by law.

Sensitive health-related information (Article 9 GDPR) — such as recovery and mood data — is processed solely on the basis of your explicit consent, given when you create an account. You may withdraw this consent at any time by deleting your account.

4. How We Share Information

4.1 With other Forge users

Content you post to the community feed, comments you write, and likes you make are visible to other Forge users. Your display name is visible on this content. Your email address is never shown publicly.

Private content — streaks, journal entries, daily check-ins, milestones — is visible only to you, unless you explicitly share it with an accountability partner.

4.2 With service providers

We use the following third-party service providers, who process data on our behalf under contracts that limit their use of the data to providing services to us:

Google / Firebase — authentication, database (Firestore), serverless functions, crash reporting (Crashlytics), and analytics. Firebase operates in the United States and other countries. See Firebase's privacy documentation.
Apple — App Store distribution, TestFlight, and (if enabled) Sign in with Apple. See Apple's Privacy Policy.
Stripe — payment processing for the desktop products. Stripe receives your email address and handles your card details directly; we never see or store your card number. See Stripe's Privacy Policy.
Resend — delivery of transactional email, including accountability-partner reports and account emails. See Resend's Privacy Policy.
Twilio — placing scheduled check-in calls. Twilio receives your phone number in order to connect the call. See Twilio's Privacy Notice.

Apple receives nothing about the desktop products, and Stripe and Twilio receive nothing about the App.

4.3 For legal reasons

We may disclose information if we believe in good faith that disclosure is reasonably necessary to: comply with a legal obligation, valid court order, or government request; protect the safety of any person; address fraud, security, or technical issues; or protect our rights or property.

4.4 We do NOT sell your data

We have never sold personal information and we have no plans to. We do not share personal information for cross-context behavioral advertising.

4.5 With the accountability partner you nominate (Forge Shield)

Forge Shield exists in order to tell someone else. If you nominate an accountability partner, that person receives by email:

A weekly summary listing the hostnames of blocked sites and how many times each was reached for, and whether you stopped or continued.
A message if the extension is uninstalled, disabled, or stops reporting in.
A message on the day you add them, so that no one is ever receiving reports about you without your knowledge and theirs.

They are never sent your searches, the contents of any page, full URLs, your App data, your journal entries, your mood or check-in history, or anything about websites that were not blocked.

This sharing happens because you instructed it and it stops when you remove the partner or cancel the subscription. You can remove or change your partner at any time from your account page at forgefreedomlabs.com/desktop/account.

5. International Data Transfers

Forge is operated from the United States. Firebase stores data in Google Cloud data centers located in the United States and other regions. If you access Forge from outside the United States, your information will be transferred to and processed in those locations.

Where data is transferred out of the EEA, UK, or Switzerland, the transfer is protected by the European Commission's Standard Contractual Clauses or equivalent safeguards as required by applicable law.

6. Data Retention

We retain your information for as long as your account is active. When you delete your account:

Your account credentials, profile, streaks, journal entries, daily check-ins, and milestones are deleted from our production systems within 30 days.
Posts and comments you made in the community feed are either anonymized (author replaced with "[deleted user]") or removed, at your choice during deletion.
Backup copies are purged within 90 days.
Aggregated, fully anonymized analytics (which cannot be tied back to you) may be retained indefinitely.
We may retain limited information longer where legally required or to resolve disputes.

6.1 Desktop products

Blocked-attempt events are retained for 90 days, long enough to produce weekly reports and show recent activity on your account page, then deleted.
Your accountability partner's name and email are deleted when you remove them, cancel, or delete your account.
Emails already delivered to your partner are in their inbox and outside our control; we cannot retract them.
Your phone number and call schedule are deleted when you opt out of calls or delete your account.
Consent records for check-in calls are retained for five years after the last call, including after you opt out. US telephone-consumer law requires us to be able to prove consent was given, and a deleted consent record cannot do that. This is the one category of data we keep after an opt-out, and it contains only the consent text, timestamp, phone number, IP address, and user-agent — no call content.
Billing records held by Stripe are retained as required by tax and accounting law.

7. Your Rights and Choices

Regardless of where you live, you can:

Access your data from within the App (Settings → Profile).
Correct your data at any time (Settings → Edit profile).
Delete your account and all associated data (Settings → Delete account).
Export a copy of your data by emailing us at [email protected] We will respond within 30 days.

7.1 EU/UK users (GDPR)

You have the right to: access, rectify, erase, restrict processing, object to processing, and data portability. You also have the right to withdraw consent at any time and to lodge a complaint with your local supervisory authority (e.g., the UK Information Commissioner's Office at ico.org.uk).

7.2 California users (CCPA / CPRA)

California residents have the right to: know what personal information we collect and how it is used; request deletion of their personal information; correct inaccurate personal information; opt out of sale or sharing of personal information (note: we do not sell or share personal information for cross-context behavioral advertising); and be free from discrimination for exercising these rights. Contact [email protected] to exercise these rights.

7.3 Other US states

If you are a resident of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, or another US state with a comprehensive privacy law, you have rights similar to those described above. Contact us at [email protected] to exercise them.

8. Security

We protect your information using industry-standard security practices:

All data is encrypted in transit using TLS 1.2 or higher.
Data at rest in Firebase is encrypted using AES-256.
Access to production systems is restricted to authorized personnel, protected by strong authentication.
Firestore security rules enforce that private collections (streaks, journal entries, milestones) can only be read by the account that owns them.
We use Firebase App Check to limit backend access to genuine Forge app instances.

No system is perfectly secure. If we ever learn of a breach affecting your personal information, we will notify you as required by applicable law.

9. Children's Privacy

Forge is not intended for children under 17 and we do not knowingly collect personal information from anyone under 17. If you believe a child has created an account, contact us at [email protected] and we will delete the account promptly.

10. Medical Disclaimer

Forge is not medical care

Forge is a self-help tool. It is not a substitute for medical, psychological, or psychiatric care, and it is not designed to diagnose, treat, cure, or prevent any disease, addiction, or mental health condition. Nothing in the App is medical advice. If you are in recovery, please work with a qualified healthcare professional.

11. If You Are in Crisis

If you are experiencing a mental health crisis, having thoughts of self-harm, or are in danger, please reach out for help immediately:

United States: Call or text 988 (Suicide and Crisis Lifeline).
SAMHSA National Helpline (substance use, free, confidential, 24/7): 1-800-662-4357.
United Kingdom: Samaritans — 116 123.
International: findahelpline.com lists crisis lines worldwide.
Emergency: Call 911 (US), 999 (UK), 112 (EU), or your local emergency number.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the App or by email at least 30 days before taking effect. The "Effective date" and "Last updated" fields at the top of this policy will reflect the most recent revision. Continued use of the App after an update means you accept the revised policy.

13. Contact Us

Questions, requests, or concerns about this Privacy Policy or your personal information:

Email: [email protected]
Mail: Forge Labs LLC, 26 University Place Boulevard #26-551, Jersey City, NJ, 07305

If you are an EU/UK user and prefer to contact a Data Protection Officer, email [email protected].