Privacy Policy

Effective date: May 5, 2026 · Last updated: May 5, 2026

This Privacy Policy describes how Forge Labs LLC ("we," "us," "our") collects, uses, and protects information when you use the Forge mobile application (the "App"). Forge is a recovery and sobriety tracking tool that supports streaks, daily check-ins, a community feed, accountability partners, and related features.

We take privacy seriously because the information you share with Forge — your recovery progress, moods, urges, and reflections — is deeply personal. This policy explains what we collect, why, and the control you have over it.

Quick summary

We collect only what Forge needs to work. We do not sell your data. We do not use it for advertising. You can delete your account and all associated data at any time from Settings.

1. Information We Collect

1.1 Information you provide directly

Account information. Email address and password when you create an account. A display name if you choose to set one.
Profile information. Optional goals, recovery start date, and other profile details you enter.
Health-related content. Streak data (the substance or behavior you are tracking, start date, resets), daily check-ins (mood rating, urge level, free-text reflections), journal entries, and milestones you reach.
Community content. Posts, comments, likes, and any text or interactions you share in the Forge community feed.
Accountability partner connections. Requests you send or accept to connect with other Forge users as accountability partners.
Support communications. If you email us or submit feedback, we receive your message and contact details.

1.2 Information collected automatically

Device information. Device model, operating system version, app version, language, and time zone.
Usage information. Aggregated, anonymized data about which screens you visit and which features you use, solely to improve the App. We do not track individual browsing behavior outside Forge.
Diagnostic data. Crash logs and performance data (via Firebase Crashlytics) to help us fix bugs. Crash reports are automatically scrubbed of personally identifying information where technically feasible.
IP address. Briefly logged during authentication for security and abuse prevention.

1.3 Information from Apple Health (optional)

If you enable the Apple Health integration (Settings → Apple Health → Connect), Forge reads the following metrics from the Health app on your iPhone so they can be attached to each daily check-in:

Heart Rate Variability (HRV, SDNN) — most recent sample.
Resting Heart Rate — most recent sample.
Step Count — total for the current local calendar day.
Sleep Analysis — total minutes asleep in the last 24 hours.

This integration is read-only — Forge never writes data back to Apple Health. Apple Health data is processed on the basis of your explicit consent, given both through the iOS Health permission sheet and by enabling the integration in Forge's Settings. You can revoke this consent at any time from iOS Settings → Privacy & Security → Health → Forge, or by disconnecting the integration in Forge.

The values we read are stored alongside your journal entry in Firestore (see Section 4.2) so the App can show trends over time. We do not use Apple Health data for advertising, third-party marketing, data brokering, or any purpose unrelated to the App's core functionality, and we do not share it with anyone other than the sub-processors listed in Section 4.2. This is a requirement of Apple's HealthKit framework and we honor it contractually and technically.

1.4 Information we do NOT collect

We do not collect precise location data.
We do not access your contacts, photos, microphone, or camera unless you explicitly grant permission for a specific feature.
We do not link your Forge activity to third-party advertising identifiers (IDFA).
We do not read any Apple Health data types other than those listed in Section 1.3. We do not write any data to Apple Health.

2. How We Use Your Information

We use the information described above to:

Create and maintain your account and authenticate you when you sign in.
Provide the App's core features — streaks, check-ins, the community feed, badges, accountability partners, and resources.
Save your progress and sync it across your devices.
Send milestone notifications and other in-app messages about features you've enabled.
Respond to your support requests and feedback.
Detect, prevent, and respond to abuse, fraud, and violations of our Terms of Service.
Improve the App through aggregated, anonymized analytics.
Comply with legal obligations.

We do not use your information for advertising, profiling for commercial purposes, or any use incompatible with the purposes described above.

3. Legal Bases for Processing (EU/UK Users)

If you are located in the European Economic Area, United Kingdom, or Switzerland, we process your personal data on the following legal bases under the GDPR and UK GDPR:

Performance of a contract — to provide the App's services you signed up for.
Consent — for optional features such as push notifications. You can withdraw consent at any time.
Legitimate interests — to secure the App, detect abuse, and improve features, where our interests do not override your rights.
Legal obligation — where we are required to process data by law.

Sensitive health-related information (Article 9 GDPR) — such as recovery and mood data — is processed solely on the basis of your explicit consent, given when you create an account. You may withdraw this consent at any time by deleting your account.

4. How We Share Information

4.1 With other Forge users

Content you post to the community feed, comments you write, and likes you make are visible to other Forge users. Your display name is visible on this content. Your email address is never shown publicly.

Private content — streaks, journal entries, daily check-ins, milestones — is visible only to you, unless you explicitly share it with an accountability partner.

4.2 With service providers

We use the following third-party service providers, who process data on our behalf under contracts that limit their use of the data to providing services to us:

Google / Firebase — authentication, database (Firestore), serverless functions, crash reporting (Crashlytics), and analytics. Firebase operates in the United States and other countries. See Firebase's privacy documentation.
Apple — App Store distribution, TestFlight, and (if enabled) Sign in with Apple. See Apple's Privacy Policy.

4.3 For legal reasons

We may disclose information if we believe in good faith that disclosure is reasonably necessary to: comply with a legal obligation, valid court order, or government request; protect the safety of any person; address fraud, security, or technical issues; or protect our rights or property.

4.4 We do NOT sell your data

We have never sold personal information and we have no plans to. We do not share personal information for cross-context behavioral advertising.

5. International Data Transfers

Forge is operated from the United States. Firebase stores data in Google Cloud data centers located in the United States and other regions. If you access Forge from outside the United States, your information will be transferred to and processed in those locations.

Where data is transferred out of the EEA, UK, or Switzerland, the transfer is protected by the European Commission's Standard Contractual Clauses or equivalent safeguards as required by applicable law.

6. Data Retention

We retain your information for as long as your account is active. When you delete your account:

Your account credentials, profile, streaks, journal entries, daily check-ins, and milestones are deleted from our production systems within 30 days.
Posts and comments you made in the community feed are either anonymized (author replaced with "[deleted user]") or removed, at your choice during deletion.
Backup copies are purged within 90 days.
Aggregated, fully anonymized analytics (which cannot be tied back to you) may be retained indefinitely.
We may retain limited information longer where legally required or to resolve disputes.

7. Your Rights and Choices

Regardless of where you live, you can:

Access your data from within the App (Settings → Profile).
Correct your data at any time (Settings → Edit profile).
Delete your account and all associated data (Settings → Delete account).
Export a copy of your data by emailing us at [email protected] We will respond within 30 days.

7.1 EU/UK users (GDPR)

You have the right to: access, rectify, erase, restrict processing, object to processing, and data portability. You also have the right to withdraw consent at any time and to lodge a complaint with your local supervisory authority (e.g., the UK Information Commissioner's Office at ico.org.uk).

7.2 California users (CCPA / CPRA)

California residents have the right to: know what personal information we collect and how it is used; request deletion of their personal information; correct inaccurate personal information; opt out of sale or sharing of personal information (note: we do not sell or share personal information for cross-context behavioral advertising); and be free from discrimination for exercising these rights. Contact [email protected] to exercise these rights.

7.3 Other US states

If you are a resident of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, or another US state with a comprehensive privacy law, you have rights similar to those described above. Contact us at [email protected] to exercise them.

8. Security

We protect your information using industry-standard security practices:

All data is encrypted in transit using TLS 1.2 or higher.
Data at rest in Firebase is encrypted using AES-256.
Access to production systems is restricted to authorized personnel, protected by strong authentication.
Firestore security rules enforce that private collections (streaks, journal entries, milestones) can only be read by the account that owns them.
We use Firebase App Check to limit backend access to genuine Forge app instances.

No system is perfectly secure. If we ever learn of a breach affecting your personal information, we will notify you as required by applicable law.

9. Children's Privacy

Forge is not intended for children under 17 and we do not knowingly collect personal information from anyone under 17. If you believe a child has created an account, contact us at [email protected] and we will delete the account promptly.

10. Medical Disclaimer

Forge is not medical care

Forge is a self-help tool. It is not a substitute for medical, psychological, or psychiatric care, and it is not designed to diagnose, treat, cure, or prevent any disease, addiction, or mental health condition. Nothing in the App is medical advice. If you are in recovery, please work with a qualified healthcare professional.

11. If You Are in Crisis

If you are experiencing a mental health crisis, having thoughts of self-harm, or are in danger, please reach out for help immediately:

United States: Call or text 988 (Suicide and Crisis Lifeline).
SAMHSA National Helpline (substance use, free, confidential, 24/7): 1-800-662-4357.
United Kingdom: Samaritans — 116 123.
International: findahelpline.com lists crisis lines worldwide.
Emergency: Call 911 (US), 999 (UK), 112 (EU), or your local emergency number.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the App or by email at least 30 days before taking effect. The "Effective date" and "Last updated" fields at the top of this policy will reflect the most recent revision. Continued use of the App after an update means you accept the revised policy.

13. Contact Us

Questions, requests, or concerns about this Privacy Policy or your personal information:

Email: [email protected]
Mail: Forge Labs LLC, 26 University Place Boulevard #26-551, Jersey City, NJ, 07305

If you are an EU/UK user and prefer to contact a Data Protection Officer, email [email protected].