Privacy policy
Last updated 22 October 2026
Forge is operated by forge ("we"). This policy covers the Forge app for Android, the Forge Coach app for Windows, and the Forge service they connect to. Questions or requests: matthewosborne1@live.com.
Forge is for people aged 16 and over. We ask for your date of birth when you register and do not accept registrations from anyone younger.
What we collect
| Information | When | Why |
|---|---|---|
| Email address | Registration | To sign you in, verify your address and reset your password |
| Display name | Registration; you can change it | Shown in the app, and to a coach or athlete you are linked with |
| Date of birth | Registration | To check the minimum age |
| Password | Registration | Stored only as a one-way hash; we cannot read it |
| Google account identifier | Only if you choose "Sign in with Google" | To sign you in |
| Training records: workouts, exercises, sets, repetitions, loads, effort ratings, durations, personal records, programs and session feedback | When you log or complete training | The core function of the app |
| Coaching content: programs and prescriptions a coach writes for you, coach notes and feedback, invitations | When you coach or are coached | Coaching |
| Messages between a linked coach and athlete | When you send them | Coaching |
| Game progress: colony, resources, rewards, achievements, challenges, level | As you use the app | The motivational part of the app |
| Notification settings, your chosen time zone, which notifications you have read | As you use the app | To deliver notifications at sensible times |
| Push token and an app-generated installation identifier (Android) | If you allow notifications | To send push notifications to your phone |
| Consent records: what you agreed to, which version, and when | Registration | Evidence of your agreement |
| Error reports: error type, a cleaned message, code location and app version | When the app hits an unexpected error | To fix faults; not linked to your account |
| Server logs: internal identifiers, request times and outcomes, network address | Whenever the apps talk to the service | Security, rate limiting and fault-finding |
We do not collect your location, contacts, photos, microphone or camera input, health-sensor data, payment details or advertising identifier. The apps contain no advertising and no third-party analytics.
What a coach can see
Nothing is shared with a coach until you accept that coach's invitation. While you are linked, your coach can see your completed workouts (sets, repetitions, loads, effort, duration), personal records, session feedback, program progress including reasons for skipped sessions, and the messages you exchange. Your coach cannot see your email address, date of birth, account settings, colony, resources or rewards. You can end coaching at any time in the app; access stops immediately.
Where it is kept
- On servers and a database we rent from hosting providers. Connections between the apps and the service are encrypted (HTTPS); the released apps refuse an unencrypted connection.
- On your Android phone: your session in the system's protected storage, and an encrypted queue of training entries waiting to be sent. These are excluded from device backup and transfer.
- On your Windows PC (Forge Coach): only your session, encrypted for your Windows user account. It is removed when you sign out or uninstall the app. Forge Coach keeps no copy of athletes' data on the PC.
Who else processes it
We do not sell your information or share it for advertising. These providers process limited data for us:
- Hosting and database providers store the service's data on our behalf.
- Brevo (email delivery) receives your email address and the text of emails we send you: verification, password reset, coach invitations and security notices.
- Google Firebase Cloud Messaging, if notifications are switched on, receives the push token and the notification's generic text, never workout or message content.
- Google Sign-In, only if you use it.
- Google Play and the Microsoft Store distribute the apps under their own policies.
Some of these providers store or process data outside Australia, including in the European Union and the United States. We choose providers that protect information to a standard comparable to the law that applies to us.
How long we keep it
- While your account exists: the information above.
- When you delete your account: your email, password hash, date of birth, sign-in identities, sessions, training records, game progress, notifications, devices and messages are deleted straight away. Conversations are deleted for both participants. Notes a coach wrote about an athlete stay with the athlete, shown as from a "Former coach".
- An anonymous record of the account (an internal identifier, status and dates) and your consent records are kept as evidence of what was agreed, for no longer than 7 years.
- Server logs are kept for no longer than 30 days.
- Database backups expire within 30 days; deleted data can remain in a backup until it expires. If a backup is ever restored, deletions made since are applied again.
- A session ends after 30 days without use, or when you sign out, change or reset your password.
Your choices
- See and correct: your profile and training history are in the app.
- Delete: Profile → Delete account in the Android app (immediate), or see how to delete your account.
- Copy of your data, or a change of email address: ask at matthewosborne1@live.com. We reply within 30 days.
- Notifications: switch categories on or off in the app, or refuse the permission.
- Complaints: contact us first. If you are not satisfied, you can complain to the privacy regulator where you live; in Australia, the Office of the Australian Information Commissioner (oaic.gov.au).
Changes
We will post changes on this page. If a change affects what you agreed to, we will tell you by email or in the app before it takes effect.