01Introduction

FORGE ("we", "us", "our") operates klemforge.com and the FORGE app. This policy explains what data we collect, why, who it reaches, and how we protect it. By using FORGE you agree to this policy.

FORGE handles health data. Section 02 lists exactly what, section 04 explains that an AI processes it, and section 05 names every company that receives any of it.

02Data We Collect

Account and identity

• Name and email address.
• Password — hashed by our authentication provider, never stored in plain text and never visible to us.
• Consent records: the date and time you accepted the Terms and this policy, and which version of the policy you accepted.
• Your marketing email choice (see section 06).

Health and body data

• Age, sex, height and weight, and your target weight.
• Injuries and physical limitations — a free-text field. Whatever you type here is stored, including medical history if you choose to give it.
• Dietary restrictions — a free-text field, which in practice often contains allergies and intolerances.
• Body measurements you log: chest, waist, hips, arm, thigh, body fat percentage, and any free-text note attached to a measurement.
• Bodyweight history over time.
• Exercise history, session logs and personal records: which exercises, how many sets and reps, at what weight, on what date.
• Training goal, experience level, available equipment, and how many days a week you train.

AI coach conversations

• Every message you send to the AI coach and every reply it gives. These are stored against your account.
• You control what goes into these messages. They may contain anything you type, including health disclosures you have not entered anywhere else in the app.

If you have a human coach

• Your coach can see your profile, your training data and your logged measurements.
• Your coach writes private notes and session feedback about you, which may include their observations about your body and your training. Notes are visible to your coach and not to you. Session feedback is private unless your coach chooses to share it with you. Written reviews your coach produces are shared with you.
• We generate an AI-written summary of you for your coach, built from the data above.

Payment

• Card details are entered on Stripe's own checkout page and never reach FORGE. We do not see, store or process card numbers.
• We store your Stripe customer and subscription identifiers, your subscription status and tier, and your billing currency.

Device and technical

• Device type and browser (User-Agent).
• IP address. Our hosting providers receive it with every request as a matter of how the internet works. Our own application writes an IP address to the server log when an authentication attempt fails.
• Push notification token, if you turn on notifications.
• Your device's time zone, when you set a workout reminder. We also read your time zone in the browser to guess which currency to show you — that guess is made on your device.

Preferences

• Language, units (kg / lbs), notification settings, colour theme, and currency.

03How We Use Your Data

• To generate and personalise your workout and nutrition programme.
• To give the AI coach the context it needs to answer you.
• To show your progress, streaks, records and measurements back to you.
• To let a coach you have connected to do their job, if you have one.
• To process payments and manage your subscription.
• To send service emails and, only if you asked for them, marketing emails (section 06).
• To send push notifications, if you enable them.
• To keep the service secure and diagnose faults.

We do not sell your data. We do not share it with advertisers. We do not use it to train anyone's AI models.

04AI and Automated Processing

An AI generates your workout and nutrition plans, and an AI is the coach you chat with. The AI provider is Anthropic (Claude).

When a plan is generated or you send a coach message, the following is sent to Anthropic on our servers: your name, age, sex, height, weight, goal, training experience, days per week and preferred days, available equipment, diet style, dietary restrictions, injuries, your recent exercise history, your current plan, and the recent messages in that conversation. If you have a coach, the same health fields are sent when your coach uses an AI feature about you.

Anthropic processes this to produce a response and returns it to us. Under our arrangement with them this data is not used to train their models.

The AI is not a medical professional and its output is not medical advice. It is automatically generated fitness guidance and may be wrong or unsuitable for you. See section 02 of our Terms of Service for the full disclaimer and the recommendation to consult a doctor.

These automated outputs are suggestions. They do not produce legal effects for you and nothing is decided about you automatically — you choose whether to follow a plan.

05Who Receives Your Data

Thirteen companies are involved in running FORGE. This is all of them and what each one gets.

Sent by our servers

• Supabase — database and authentication. Your data is stored on servers in the European Union. Supabase holds everything listed in section 02 that we store. It also receives your IP address directly from your browser, because sign-in and session refresh go straight from your device to Supabase.
• Anthropic — the AI provider. Receives the profile, health and conversation data listed in section 04.
• Stripe — payments. Receives your email address, your name, your FORGE account identifier, your chosen plan, billing period and currency. Your card details go to Stripe directly from your browser on Stripe's own checkout page and never pass through us.
• Mailchimp — email delivery and list management. Receives your email address, first and last name, and lifecycle tags (for example: on trial, upgraded, opted in to marketing).
• Railway — hosts our backend. All API traffic passes through it and it holds our server logs.
• Google (YouTube Data API) — receives exercise names from your plan as search queries, so we can attach a demonstration video. Sent from our servers, not linked to you.
• MuscleWiki — exercise reference data. Receives exercise identifiers from our servers. Demonstration videos are fetched by our server and passed on to you, so your IP address is never exposed to MuscleWiki.
• Resend — an email provider we have configured but which is currently sending nothing and receiving no data at all. If that changes we will update this policy first.

Contacted directly by your browser

These receive your IP address and browser User-Agent without our servers being involved. We cannot prevent this while these services are in use, and several are in the United States.

• GitHub Pages — hosts the website and the app itself. Sees your IP and User-Agent on every page load.
• Google Fonts (fonts.googleapis.com and fonts.gstatic.com) — sees your IP and User-Agent on every page of FORGE, including this one.
• jsDelivr — a content delivery network that serves one JavaScript library. Sees your IP and User-Agent every time you open the app.
• YouTube (youtube-nocookie.com) — sees your IP only when an exercise demonstration video is displayed. We use the no-cookie embed, which does not set tracking cookies before you press play.
• Your push provider — Google, Apple or Mozilla, depending on your browser and device, and only if you enable notifications. It receives the push address for your device. The contents of each notification are encrypted, so the push provider relays the message without being able to read it.

We do not sell your data. We do not share it with advertisers.

06Email: Service and Marketing

There are two kinds and they are handled separately.

• Service email — everyone receives this. Account confirmation, password reset, subscription and billing notices, and a 7-day onboarding sequence that explains the trial you have started. This is part of providing the service and is not marketing. You cannot opt out of it while you hold an account.
• Marketing email — only if you ask for it. Training tips and offers. There is a separate, unticked checkbox at sign-up. If you leave it unticked you get no marketing email.

You can turn marketing email on or off at any time from the Account panel in the app, or with the unsubscribe link in any marketing email. Changing it does not affect your service email.

07Data Retention

• Your data is kept while your account is active.
• When your account is deleted, your personal data is removed within 30 days. Section 08 explains exactly what that covers.
• Records of payments you made are retained by Stripe, and by us in summary form, for as long as accounting and tax law requires.
• Server logs, which may contain an IP address, are held for a short period for security and fault diagnosis and then discarded on our hosting providers' normal cycle.

08Deleting Your Account

There is no delete button in the app. To close your account, email support@klemforge.com from the address on the account. We handle it manually and complete it within 30 days.

Deletion removes your authentication account and your profile, and with it: your plans, workout and session logs, exercise history, personal records, bodyweight log, body measurements, AI coach conversations, streaks and statistics, weekly and monthly reviews, onboarding tasks, push subscriptions, programmes, AI usage counters, trial feedback, any promotional code redemption, your connection to a coach, and any pending coach invitation addressed to you. If you have a coach, their private notes about you, their session feedback, their written reviews and their per-client settings are deleted with it. We also remove you from our mailing list.

Two things are deliberately kept, with you removed from them:

• A coach's commission records. If a coach earned commission on your subscription, that entry is their financial record of a payment that actually happened, and they need it for their own accounting. Your identifier is stripped from it, so the entry no longer points at you.
• Training programmes a coach built. A programme your coach wrote is their work. Your identifier is stripped from it so it is no longer attached to you.

Payment and invoice records held by Stripe are also retained where accounting and tax law requires it.

09Your Rights (GDPR / UK GDPR)

If you are in the EU, the UK or Switzerland you have the right to:

• Access your personal data.
• Correct inaccurate data.
• Delete your data ("right to be forgotten") — see section 08.
• Export your data in a portable format.
• Withdraw consent at any time, including for marketing email.
• Object to processing, and ask us to restrict it.
• Lodge a complaint with your supervisory authority.

To exercise any right, email support@klemforge.com. We respond within 30 days.

10California Residents (CCPA)

California residents have the right to know what personal information we collect, request deletion, and opt out of sale. We do not sell personal information. Contact support@klemforge.com to exercise these rights.

11International Transfers

Some of the companies in section 05 are based in the United States, and the ones your browser contacts directly are reached from wherever you are. Where data is transferred out of the EEA, the UK or Switzerland, it relies on the transfer mechanisms those providers have in place, such as the EU Standard Contractual Clauses.

12Health Data

The health and body data listed in section 02 is used to personalise your programme, power the AI coach, and — if you have one — let your coach do their job. It is shared only with the companies named in section 05 and only for those purposes. It is never sold, never used for advertising, and never used to train AI models.

By entering this data and using the AI coach you are asking us to process it for those purposes. You can withdraw that by deleting your account (section 08).

13Cookies and Local Storage

FORGE uses only functional storage: your session, your preferences and a local cache of your profile and plan so the app opens quickly. We use no tracking cookies, no advertising pixels and no analytics products. The YouTube no-cookie embed is used so that video embeds do not set tracking cookies before you press play.

14Children's Privacy

FORGE is not intended for anyone under 18. You must be at least 18 to hold an account. We do not knowingly collect data from anyone under 18.

15Security

Data is encrypted in transit (HTTPS) and at rest. Passwords are hashed by our authentication provider and never stored in plain text. Database access rules restrict every account to its own data, and administrative access is limited to authorised personnel.

16Changes to This Policy

We may update this policy. We will update the "Last updated" date at the top and, for material changes, notify you by email. Continued use of FORGE after a change constitutes acceptance.

17Contact

Questions about this policy, or to exercise any right in section 09: support@klemforge.com

FORGE, Rue du Rhône 14, 1204 Genève, Switzerland.