Privacy Policy

Last updated: 5 August 2026

Overview

The Forge (“we”, “our”, “us”) provides an AI-powered fitness training platform for gym members and personal training clients. This policy explains how we collect, use, and protect your personal data when you use our mobile app and web services.

Data we collect

• Account information: name, email address, and password (stored hashed).
• Profile and fitness data: age, weight, height, training goals, experience level, and personal bests.
• Workout data: exercises, sets, reps, loads, RPE, session duration, and programme progress.
• AI coaching interactions: messages sent to the AI coach and generated programme content.
• Health data (optional): HRV, resting heart rate, and sleep duration read from Apple Health on iPhone, or Health Connect on Android, with your permission.
• Technical data: device type, app version, and error logs.

How we use your data

• Generate and adapt personalised training programmes.
• Track workout history, progress analytics, and personal records.
• Provide AI coaching support and programme recommendations.
• Authenticate your account and maintain session security.
• Improve app reliability and fix errors.

Health data (Apple Health and Health Connect)

You may optionally connect Apple Health on iPhone, or Health Connect on Android. With your explicit on-device permission we read exactly three read-only recovery signals — heart-rate variability (HRV), resting heart rate, and sleep duration. Nothing else is requested, and nothing is ever written back.

These three are read for one purpose: computing your daily readiness score, which adjusts the intensity of the session your programme prescribes and informs the AI coach’s advice. Recovery drives training load, so without them readiness is estimated from logged training alone and is less accurate. They are never sold, never used for advertising, never shared with other members, and never shared with your gym unless you have explicitly granted that gym health scope.

Permission is granted and revoked outside the app — in iOS Settings, or in the Health Connect app on Android — and you can disconnect at any time from The Forge’s own settings, which stops the sync and clears the cached recovery data. Revoking permission does not delete the rest of your account.

AI processing

Workout programme generation and AI coaching use xAI’s Grok API. Relevant profile and workout context is sent to generate responses. We do not sell your data to third parties. AI providers process data under their own terms and data processing agreements.

Data storage and security

Data is stored on secure servers (PostgreSQL on Neon, hosted on Render). Passwords are hashed with bcrypt. Sessions use HttpOnly cookies on web and secure token storage on mobile. All production traffic uses HTTPS.

Data retention

We keep your data only while you have an account, plus the limited periods below. Nothing here is indefinite.

• Account, profile, training programmes and workout history — kept while your account is open, so your history and progress remain available to you. Deleted when you delete your account.
• Health data (HRV, resting heart rate, sleep) — deleted automatically 30 days after the day it relates to, by a scheduled job that runs daily. This is the only category we delete on a timer, because it is the most sensitive and because readiness only ever uses recent readings.
• AI coaching conversations — kept while your account is open so the coach has context, and deleted with your account.
• Error and diagnostic logs — held by our hosting provider and rotated out on their schedule. They contain technical detail, not training or health data.
• Payment and invoice records — held by our payment provider, and retained by them for as long as UK tax and accounting law requires. These are not linked to your training data.

When you delete your account, your personal data is permanently and irreversibly removed from our production database immediately — it is a hard delete, not a flag, and it cascades to your programmes, workouts, conversations and health readings. Residual copies in encrypted infrastructure backups are overwritten in the normal backup rotation. The only records we keep are the payment and invoice records above, which we are legally required to retain.

Your rights

You may access, update, or delete your account and associated data at any time from the app’s settings. For data subject requests under UK GDPR, contact your gym administrator or email william@capstonesoftware.co.uk.

Health and fitness disclaimer

The Forge provides training guidance, not medical advice. Consult a qualified healthcare professional before starting any exercise programme, especially if you have pre-existing conditions.

Nutrition guidance

Where enabled by your gym, The Forge may show general calorie and macronutrient targets calculated from the details in your profile. These are general information only — not personalised nutritional, dietary, or medical advice, and not a meal plan. They do not account for medical conditions, medications, allergies, pregnancy or breastfeeding, or a history of disordered eating. Always consult a registered dietitian, nutritionist, or your GP before changing your diet. If you tell us you are pregnant or breastfeeding, under 18, or have a history of an eating disorder, no figures are shown.

Contact

Capstone Software Ltd — william@capstonesoftware.co.uk

Capstone Software Ltd · Last updated 8 July 2026