Forjex

Forjex legal

Privacy Policy

How Forjex collects, uses, stores, and protects the data behind your training.

Last updated
11 October 2026
Sections
17

1. Who We Are

Forjex is a fitness application operated by Reliability Works Ltd, a company registered in England and Wales under company number 16206723, with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. Reliability Works Ltd is the data controller for the personal data described in this policy, which explains how we collect, use, and protect that data when you use our mobile app, web platform, and marketing site.

2. What Data We Collect

Account data: Name, username, email address, date of birth, profile photo, sign-in credentials, role, account settings, and optional profile fields such as pronouns, a website link, and a free-text location. We also record the country and region we read from your device locale and App Store storefront at signup, which is what the age check runs against.

Phone number: If you sign up or sign in with your phone, or add a phone to your account, we store the number and its country. We use it to sign you in and to recover your account, and our SMS provider, Twilio, sends the code. Other people never see your number. If you turn on Find Me by Phone (it is off by default), people who have your number in their contacts can find your account. Your number is in your data export and is deleted with your account.

Contacts, only when you choose Find Friends: After you agree, the app reads the phone numbers of the contacts you share and hashes them on your phone for matching. Only the hashes are sent. We compare them in real time against accounts that turned on Find Me by Phone and return the matching profiles. We do not store the hashes, your contacts or any match, and we do not log them. We never send text messages to your contacts; an invite is a message you send yourself.

Fitness data: Workout logs, exercise history, personal records, body measurements, progress photos, nutrition and meal logs, and training and nutrition plans.

Health data: What you allow Forjex to read from Apple Health, including heart rate, sleep, steps, workouts, and recovery metrics. Nothing is read until you grant permission, and only for the categories you allow. Once you have granted it, Apple Health can wake the app in the background when a workout finishes, including one you recorded on an Apple Watch, so the app can pull that session in and ask whether you want to log it. That background wake happens for workouts only, and it stops when you turn the permission off. Alongside each sample we store where it came from: the source app name and bundle id, the device name and model that recorded it, and whether you entered it by hand. That device model is the only hardware detail we hold, and it comes from Apple Health, not from profiling your phone. Forjex also writes back to Apple Health, if you allow it: the workout itself, the active energy it burned, and the walking, running, or cycling distance for a session you recorded in the app. That write stays on your phone, in Apple Health. It does not send anything to us.

Social data: Posts, comments, likes, reposts, bookmarks, follows, Bursts, videos, direct messages including photos, GIFs and voice notes, squad activity, reports, and moderation records.

Coach data: If you use the coaching platform, we collect coach profiles, client-coach relationships, program data, check-in responses, intake answers, progress-photo annotations, coach messages, pricing, leads, and payout status. Coaches can also import an existing client list, which means we hold the names and email addresses that coach uploaded until those people either join or the invite is withdrawn.

Payment data:Subscription status, transaction IDs, coach payout status, and receipts. We never see or store card numbers, bank details, or tax details. Apple handles in-app purchases. Clients buy coaching on a coach's Forjex coaching page, and Stripe handles coach billing and payouts on its hosted pages. We keep only the Stripe account id, its status, balances, and a country code.

Identity verification, only when you choose it: If you verify your identity for the Identity verified badge, or as a coach for the coach marketplace, Stripe runs the check on its own hosted page. Stripe takes a photo of your ID document and a selfie, reads your legal name and date of birth from the document, and matches your face to the photo on it. That face match uses biometric data, which is special category data under UK GDPR Article 9. Forjex never receives the images, your legal name, your date of birth or any face template.

Before any check starts, the app shows what is collected, by whom, why, what we keep, for how long, and how to withdraw, and asks you to agree. We process this on the basis of your consent (Article 6(1)(a)) and your explicit consent to the biometric check (Article 9(2)(a)). We record your choice with the date and the version of the wording you saw. If you choose Not Now, no check starts.

When a check has a result, verified or failed, we ask Stripe to delete the images and the details read from your document. Stripe can take up to four days to finish. If that request fails, we retry it, and our team is alerted if it still fails. We keep only the result: the check's status, Stripe's session ID, Stripe's error code if it failed, and the date you were verified. Until Stripe confirms the deletion, we also hold Stripe's report ID and its short reason text if the check failed. We remove both when Stripe confirms. Other people see only the words Identity verified. We keep these records while your account is open, and after deletion as described in section 11.

You can withdraw your consent at any time in Settings, Consent & Permissions, without deleting your account. Withdrawing removes your badge, means a coach must verify again to appear in the coach marketplace, and asks Stripe to delete every check you started. It does not change the lawfulness of processing done before you withdrew. Deleting your account also asks Stripe to delete every check.

Support data: The messages you send us through in-app support and the email address attached to the ticket.

Device and diagnostic data: A push token if you enable notifications, and crash, error and performance reports with a separate opt-out. Optional app-usage events and masked replays require your optional acceptance during onboarding or through Share Diagnostics in iOS Settings. The web platform calls this choice Share diagnostics. Usage events contain the app release, build, environment and a pseudonym, without your name or entered content. Before sign-in, an accepted onboarding journey uses a random journey identifier. Its replay ends at authentication. We keep its diagnostic identity separate from the account identity.

Usage analytics:We combine completed action counts into daily server totals and send them to PostHog. These contain no account, device, session or content identifiers and do not form an individual history. Usage Analytics is on by default. Turn it off in Settings, Consent & Permissions to stop future contributions once the choice reaches our server. Previously combined totals cannot be separated by account. Optional onboarding diagnostics are separate from these aggregate totals.

Separate operational records help us run and improve the service under our legitimate interests. These first-party records are not forwarded to either provider as raw account records. You can object through the privacy request route below.

Crash, error, and performance reports from the iOS app go to Sentry, our crash reporting provider, under our legitimate interests in finding and fixing faults. They are sent from app launch, whether or not Share Diagnostics is on. A report holds the error type, the code stack where it happened, the app screen or server function involved, the server's error code, how long screens and server requests took, the app version and build, the device model, and the operating-system version. Once you are signed in, it also holds a one-way hash of your account id, so we can tell how many people a fault affects without sending your name or email. Before a report is sent, we remove your name, email, request details, raw error messages and unapproved metadata. Fixed event names, bounded operation outcomes and random correlation identifiers connect diagnostics. Sentry deletes reports at the end of its event retention period. To stop crash reporting, see Object in section 12. When you turn Share Diagnostics on, PostHog receives masked screen replays and bounded app-usage diagnostics, and Sentry adds technical session tracking to its reports. Sentry never receives a replay from the iOS app or the web platform. These optional services use technical session and installation identifiers as well as a journey or account pseudonym. Replay masks text fields and images and hides map, camera and video surfaces. PostHog recordings are retained for 30 days. Turning sharing off stops new capture; previously captured, consented data may finish uploading under its original pseudonym. Native PostHog events disable person profiles and location enrichment, and client IP data is discarded. Its SDK also sends device and app metadata when it fetches recording configuration. These SDK requests start only after you enable sharing. Your choice is saved, and you can turn sharing off at any time in Privacy settings. The web platform sends Sentry a bounded error type and PostHog a masked screen replay only after Share Diagnostics is on. Web replay masks all text and inputs and blocks all media, and its PostHog person profiles stay off. Convex server error capture stays off. Health, body, meal, readiness, route, photo, message, authentication, and user-entered fitness content are prohibited from either native diagnostics provider, whether or not diagnostics is on.

What we do not collect:Postal address, card or bank details, a stored copy of your contacts or address book, browsing history, saved search history, and advertising identifiers. The iOS app contains no attribution SDK and no data-broker SDK, it never asks for App Tracking Transparency permission, and we do not track you across other companies' apps or websites.

Ads: The app includes Google Mobile Ads (AdMob). When ads are turned on they appear in the social feeds, Following and Bursts, and nowhere else. Every request Forjex makes is marked non-personalized, so an ad is picked without a profile of you behind it, and the advertising identifier is never read. Google still receives the ad request and any impression or click on it, including your IP address and standard device information, and handles that under Google's ads and data policy.

The ad consent tool:Ads come with a second Google component, the User Messaging Platform (UMP). It is what asks for consent where the law requires it, and nothing is requested from AdMob until it says a request is allowed. If you are in the UK or the EEA and do not consent, you still see ads, but Google serves them as limited ads: no personalization and no device identifier or on-device storage used for ads, though Google still receives the request and your IP address. Before it can answer, it checks with Google once per app session, and that check is itself a connection to Google: it carries our AdMob app id, your app version and language, your device model and iOS version, and your IP address, which Google uses to work out which country's rules apply. It does not read the advertising identifier and it does not tie any of that to your Forjex account. If you have never been asked for consent and ads are switched off for your app, none of it runs: UMP never contacts Google and the ad privacy choices row does not appear in Settings. Once you have answered a consent form, that answer stays on your device even if we pause ads, so the check still runs and the row stays in Settings. Switching ads off is not a way of taking back your consent, and you should not have to wait for ads to come back to change it.

3. Location Data

Forjex asks for location once, and only for one thing: recording an outdoor activity you start yourself, a walk, run, or cycle. We ask for the "while using the app" permission and never the always-on one, so the app cannot read your location at any other time.

Once you tap start, recording carries on with the app in the background and the screen locked. Without that your route would stop at the moment you pocketed your phone. iOS shows its blue location indicator the whole time. Both stop the moment you pause or finish the activity. We never use location for advertising, tracking, or building a profile of where you go.

We only upload the route coordinates if you opt in for that specific activity. If you do not, the GPS points and coordinate bounds stay on your phone. The activity totals, including distance, duration, elevation, and split summaries, are still saved to your Forjex account. A route you upload is saved with your account, and only you can read its GPS points and coordinate bounds. No other Forjex account can directly read them, and there is no in-app squad or public audience control. You can export a route through the device share sheet. Each uploaded route is capped at 1,200 points.

While you record, the app sends your current coordinates to Apple's weather service to look up the conditions we save alongside the activity. Apple receives that request. We keep only the temperature and the condition it sends back.

Separately, you can attach a place to a post. That check-in saves the place name and its coordinates on the post, and anyone who can see the post can see the check-in, so only add one when you are happy for it to be visible.

4. How We Use Your Data

We use different lawful bases for different purposes:

  • Contract. We use the data needed to create and secure your account, provide training and nutrition logs, plans, posts, messages, squads, coaching, subscriptions, support, notifications you request, and the other features you choose to use. This includes selecting and ordering Feed and Explore posts as part of the personalised social service
  • Consent. We use consent for Apple Health sync, health and body details, outdoor route-point uploads, health or injury answers in a coach intake, health data used by Forjex AI, diagnostics sharing, website analytics, and the Google ads consent form where it is shown. You can turn optional processing off
  • Legal obligation. We use data where the law requires a specific step, including applicable online-safety, child-safety, financial-record, privacy-rights and complaint-handling duties
  • Legitimate interests. We use limited data to keep Forjex secure, prevent abuse, run safety controls beyond a specific legal duty, find and fix crashes, errors, and slow screens in the iOS app and failed server jobs, measure and improve features and recommendations, deliver service and security messages, and answer people who contact us. We assess necessity and the effect on users before relying on this basis

Feed and Explore use interactions, information about the post, recency, and safety eligibility to select and order content. These signal categories and their relative effect can change as we improve recommendations. We do not publish model weights, source code, or anti-abuse logic. Using interaction events to improve the system is a separate legitimate interest purpose from delivering the ranked feed itself.

Health data is special-category data. We rely on explicit consent under Article 9(2)(a) for Apple Health, health and body details, AI health context, and health or injury answers in a coach intake. With your health and body details consent, we count your age group and sex in anonymous audience statistics for creators and pages you follow. Creators and pages see only totals of at least 10 people, never you. Turning that consent off removes you from those totals within a day. Forjex AI sees only the health categories you turn on. Sentry is prohibited from receiving health, body, nutrition, or AI health-context values.

5. AI and Your Data

Each Forjex AI feature has its own consent, and each is off until you turn it on. The features are Form Analysis, AI Coach Chat, AI Plan Building, Food Logging, Progress Photo Analysis and AI Insights. The first time you use a feature, we show what it sends and to which provider, and you choose Allow or Not Now. Not Now keeps only that feature off, and we ask again the next time you start it. AI Insights (readiness reads, coach insights and weekly recaps) run without you starting them each time, so we never ask for them on our own: you turn them on from the feature or in Settings. You can turn each feature on or off in Settings under Consent & Permissions, and the plan checkbox when you set up the app turns on AI Plan Building only. While a feature is off, it does not run for you, scheduled AI work for it skips your account, and coaches' AI tools leave your data out of it. Turning a feature off stops new requests; it cannot recall a request already sent. Each choice is stored with its date and version and is part of your data export.

Content moderation is separate from Forjex AI and does not depend on it. To keep the community safe and enforce our Terms, OpenAI's moderation service screens the social text you write (posts, comments, captions and direct messages) for policy breaches, as described in section 7. Google Gemini screens the text of a custom squad challenge before it is created, for serious physical harm, threats, harassment, fraud and other listed dangers. We do this under our legitimate interest in running a safe service and to perform our Terms, so it runs whether Forjex AI is on or off. Only the text is sent, with no profile or history, and for social text no name, username or account id.

Our AI coaching features analyse your workout history, body metrics, stated goals, check-ins, uploaded form-analysis media, and progress photos when you ask for AI help. We use these AI and safety providers, each for the requests below.

  • Fireworks writes AI chat responses.
  • OpenAI generates training plans and nutrition plans, does imported plan extraction, and reviews plans. Google Gemini also reviews plans, and is the fallback for chat and plan generation. OpenAI also screens social text.
  • Google Gemini analyses form-analysis videos and progress photos, and writes check-in suggestions and squad summaries. It also produces meal-photo estimates, lift verification, squad challenge judgements, real-world battle judgements, and reads imported plan images and PDFs. It produces scheduled weekly progress-photo digests and coaching-roster insights from relevant weight, mood, prior analysis, streak, workout-volume, personal-record, check-in, training-summary, and opted-in body-trend data. It also screens the text of a custom squad challenge for safety, with no profile or history attached.
  • Sightengine checks images for nudity and gore.

A requested readiness insight can include readiness score, state, summary, signals, trajectory, recovery history, recent training, plans, body trends, and goals. Imported plans send the complete pasted text or original uploaded image or PDF bytes. Forjex AI image attachments send the original image bytes. Lift verification and battle judging send the proof videos submitted for those features. We send only the data needed for each request or scheduled feature. Health context is sent only from the categories you turn on in Health & Data.

When you turn on AI analysis for a progress-photo session, Forjex sends the original photos from that session, including your face, to Google Gemini. A comparison can also send original photos from the previous session and limited workout context. Google may retain the request and response for a limited period to detect and prevent abuse and make required legal or regulatory disclosures. Forjex cannot recall a request after it has been sent to Google.

None of these providers trains on your data. Fireworks keeps no inference data by default. OpenAI keeps abuse-monitoring logs for up to 30 days and nothing from moderation. Google keeps logs for a limited time to detect abuse.

The returned analysis stays with the session in your Forjex account. Deleting one session hides it from active views and marks its database rows as deleted. The current app does not provide recovery for that action or remove its stored image files. Delete all progress photos starts a 24-hour grace period, then removes the stored analyses and moves the image files to deletion storage, where they are purged within 30 days. Account deletion also removes the Forjex copies. These Forjex deletion controls do not delete a request that Google has already processed.

6. Who Can See Your Data

Public: Your profile name, avatar, public stats, and any posts, Bursts, comments, lift submissions, or leaderboard entries you share publicly, including any check-in place you attach to a post.

Your coach: If you hire a coach, they can see your workout history, check-in responses, adherence data, progress photos you share, and messages you send them.

Squad members: Members of your squad can see your squad activity and challenge participation.

Private: Your health data, nutrition logs, AI chat history, and payment information are not visible to other users. Only you can read saved-route GPS points. Progress photos stay private unless you turn on AI analysis, share them with a coach or linked training partner, or create a separate social share.

7. Third Parties We Share Data With

We do not sell your personal data and we do not share it with data brokers. One advertising company is on this list: Google Mobile Ads receives what it needs to serve and count an ad in the iOS app, which is your IP address, standard device information, and the impressions and clicks. Nothing you train, eat, measure, or post is sent to it, and the requests carry no advertising identifier, so it cannot build a profile of you from what we send. This is the full list of companies that receive personal data from Forjex:

  • Convex hosts our database and backend, so effectively everything in this policy is stored there
  • Cloudflare stores your uploaded media (photos, videos, voice notes) in R2, runs the bot check on our website forms, and sits in front of our backend, so it sees the request your app makes. It tells us which country the request came from, which the age check weighs alongside your device locale and storefront
  • Vercel hosts forjex.com and the web platform
  • Google Cloud hosts Forjex media-processing services. The AI video worker receives signed proof or form-video links and the exercise or health context needed for the request. The pose service receives a signed workout or form-video link. The timelapse service receives rendered progress-photo frames
  • Fireworks writes AI chat responses from the data described in section 5. It keeps no inference data by default and does not train on it
  • Google Gemini generates meal-photo estimates, form feedback, progress-photo analysis, lift verification, squad challenge judgements, real-world battle judgements, and reads imported plan images and PDFs from the data described in section 5. It reviews plans and is the fallback for chat and plan generation. It also produces scheduled weekly progress-photo digests and coaching-roster insights from relevant weight, mood, prior analysis, streak, workout-volume, personal-record, check-in, training-summary, and opted-in body-trend data. It screens the text of a custom squad challenge for safety, as content moderation, with no profile or history attached. A requested readiness insight can include readiness score, state, summary, signals, trajectory, recovery history, recent training, plans, body trends, and goals. Meal-photo estimation, progress-photo analysis, and Forjex AI image attachments receive the original photo bytes. Progress photos can include the face. Imported plans send the complete pasted text or original uploaded image or PDF bytes. Lift verification and battle judging receive the proof videos submitted for those features
  • OpenAI and Fireworks AI run the other models in the Forjex AI chain described in section 5. They receive the text requests (training plans, nutrition plans, chat responses, plan reviews, readiness and coaching insights, and imported plan mapping) and a photo you attach in Forjex AI chat, only while Forjex AI is on for you
  • Twilio sends the SMS code when you sign in with your phone. It receives your phone number and the code request, and nothing else from your account
  • Applehandles in-app purchases and tells us your subscription status. Apple's weather service also receives your coordinates while you are recording an outdoor activity, as described in section 3. If you authorize Apple Health writes, Apple Health receives completed strength workouts and active-energy samples, or completed outdoor workouts with their distance and elevation. If you enable notifications, Apple Push Notification service receives the device token and notification title, body, route, and type needed to deliver alerts. These can describe training, form-analysis, check-in, or coaching activity, even when lock-screen previews use generic text. Apple's MapKit service receives a complete place-search term and standard request data when you search for a location to attach to a post. MapKit also receives route-derived coordinates and standard request data when it renders a live outdoor activity, saved route, or route-animation preview
  • Linked websites and preview-image hostsreceive data when a post contains a link. The destination server receives the complete URL, including its path and query, during automatic preview generation. A third-party preview-image host receives each viewer's IP address and standard request details when the image loads
  • Stripehandles coach billing and payouts. Card, bank, tax, and address details are entered on Stripe's own pages and never reach us. If a coach puts health information in the optional note for a payment request, Stripe receives that note as the checkout product name when the client opens checkout. Coach-subscription checkout also sends the athlete's email address and internal user ID, coach, offer, and session IDs, and the coach-entered offer description. Stripe Identity runs the identity check you choose (section 2): it receives your ID photo and selfie, and your internal user ID and email address, and deletes the images when we ask after the result
  • Diditverifies businesses for page verification, as our processor. The page owner enters company details, documents and any officer identity check on Didit's own pages, and Didit keeps them. We send Didit the page name, the registry country and any company number the owner gives, and we keep only the result: the status, the company registration number, the registry country, the date and Didit's session ID. When a verified page changes its name, we send Didit the registration number to check the registry again. For a UK company we first look the number up with the free Companies House service
  • Resend delivers transactional email such as password resets. If you use the website contact form, it receives your name, email address, subject, and complete message so it can deliver the request and our reply. For authenticated privacy requests, it receives your email address, ticket subject, complete written response, any appeal instructions, and an internal ticket ID tag
  • Giphypowers GIF and sticker search. Your search term goes to Giphy through our server, so Giphy does not learn who searched. But when a GIF or sticker is shown, your phone loads the image file straight from Giphy's network, which means Giphy receives your IP address and the standard request details any website sees
  • USDA FoodData Central returns food and nutrition details for a food search. It receives the search term through our server, without your Forjex account id
  • Open Food Facts returns food and nutrition details for a food search or barcode scan. It receives the search term or barcode through our server, without your Forjex account id
  • OpenAI generates, reviews, and extracts training plans and nutrition plans from the data described in section 5. It also screens user-authored social text, including posts, comments, captions, and direct messages, for policy breaches. This content moderation runs under our legitimate interest in a safe service and our Terms, whether Forjex AI is on or off. For screening we send the text and nothing else, with no name, username, or account id attached. OpenAI does not train on API data and keeps abuse-monitoring logs for up to 30 days. Moderation keeps nothing
  • Sightengine checks every finalized image post for nudity and gore in a shadow classifier. It also checks images when a post has been reported several times and images held during a first-contact message request before the recipient can view them. We mint a short-lived signed link and Sightengine fetches the image from it
  • Sentryreceives crash, error, and performance reports from the iOS app under our legitimate interests: the error type, stack frames, the screen or server function involved, the server error code, timings, the app version and build, the device model, the operating-system version, and a one-way hash of the account id. Sentry receives no replay from the iOS app or the web platform. Bounded app-usage logs and session tracking are sent only after Share Diagnostics is on. Accepted pre-sign-in onboarding uses a separate random journey pseudonym. Consented sessions also use random session and installation identifiers. Safe event names, operation outcomes and random correlation identifiers connect logs and traces. The web platform sends Sentry a bounded error type only after Share Diagnostics is on; its masked screen replay goes to PostHog. Convex server jobs and webhooks also send Sentry the error type, the operation name, whether the failure was handled and the environment, with no account id. Forjex removes names, email, request details, raw error messages and unapproved metadata before sending diagnostic events. Health, body, meals, readiness, routes, photos, messages, auth data, and entered fitness content are prohibited. Sentry stores this event data and its backups in Frankfurt. Account, organisation, and project administration metadata may be stored in the US under Sentry's Data Privacy Framework and UK Extension, with standard contractual clauses as an alternative
  • PostHog receives daily aggregate usage totals without account, device, session or content identifiers. Usage Analytics in Settings controls future contributions. It receives detailed native app-usage events and masked session replays from the iOS app and the web platform only after Share Diagnostics is on. Events use a journey or one-way account pseudonym, app version, installation channel, fixed screen names and operation outcomes. We disable person profiles and location enrichment and discard client IP data. The SDK sends device and app metadata when fetching recording configuration. Native recordings mask text fields and images and hide map, camera and video surfaces. Web recordings mask all text and inputs and block all media. Recordings are retained for 30 days. Turning sharing off stops new capture; data already captured while sharing was on may finish uploading under its original pseudonym. PostHog also collects consented website analytics as described in section 13
  • Google Mobile Ads (AdMob) serves the ads described in section 2, from the iOS app only. It receives the ad request and any impression or click, including your IP address and standard device information. Requests are non-personalized and carry no advertising identifier
  • Google User Messaging Platform (UMP)is the consent tool described in section 2, from the iOS app only. It is a separate Google SDK from AdMob. Once per app session, while ads are switched on or you have already answered a consent form, it sends Google our AdMob app id, your app version and language, your device model and iOS version, and your IP address, so Google can tell it which country's consent rules apply and whether there is a form to show you. Your current consent answer also stays in the app's local storage until you change it or remove the app's stored data

Google's AdMob retention page says User Activity reports are kept for 90 days, while Ads Activity and Privacy & Messaging reports are kept for 2,555 days. Google is an independent controller for the ad and consent-tool data it holds. You can use the Google Privacy Help Center to ask Google for access to or deletion of that data. For the copies held by Forjex, use the rights in section 12.

Sentry, PostHog, Google Mobile Ads, and Google's User Messaging Platform are the third-party SDKs inside the iOS app. There is no attribution or data-broker SDK. Optional native product analytics and PostHog replay follow Share Diagnostics. The iOS app records replays with PostHog only.

We may also share data if required by law or to protect our legal rights.

8. Data Storage and Security

Your data is stored on servers in the United States and Europe. All data is transmitted over HTTPS and encrypted at rest. We use access controls, audit logging, and regular security reviews.

Sending your data outside the UK: Some of the companies in section 7 process data outside the United Kingdom, mostly in the United States. UK data protection law lets us do that only where the destination gives your data the same protection it has here. For transfers that Forjex makes, we use one of the following safeguards.

  • Adequacy. The UK recognises the European Economic Area as providing equivalent protection. PostHog uses its EU Cloud. Sentry stores and processes the limited event data described in section 7 in Frankfurt.
  • The UK-US Data Bridge. Cloudflare, Vercel, Google LLC for Gemini and UK advertising or consent-tool processing, Resend, and Sentry are certified under the EU-US Data Privacy Framework and its UK Extension.
  • Standard contractual clauses.The standard data-processing terms published by Convex, Fireworks, OpenAI, Google, and Sentry incorporate the EU Standard Contractual Clauses and the UK Addendum when a transfer is not covered by adequacy or the UK-US Data Bridge. Fireworks' terms include Module 2.
  • Contractual safeguards. Sightengine moderates images under contractual safeguards.

Apple and Stripe are different. They decide for themselves how they handle the payment and subscription data they receive, and Apple does the same with the coordinates its weather service receives, so they are responsible for those transfers under their own terms rather than ours. Giphy, USDA FoodData Central, and Open Food Facts also decide how they handle the public search-service data they receive. We send search terms and barcodes through our server without your Forjex account id. When your phone loads a GIF, it connects to Giphy directly and shares your IP address and standard request details. Ads work the same way: your phone requests them from Google directly, and Google decides how it handles what that request carries.

You can ask us which mechanism covers a particular company, and get a copy of the relevant clauses, by emailing privacy@forjex.com.

9. Data Retention

We keep your data for as long as your account is active. When you delete your account, we hide it at once, sign you out, and keep it for 30 days so you can restore it. After 30 days, or at once if you choose Delete Now, we remove your sign-in access. A background cleanup job then removes your profile, remaining account data, and stored media, apart from the four groups described in section 11. Crash, error, and performance reports in Sentry hold only a one-way hash of your account id and expire with Sentry's event retention. Daily aggregate usage totals contain no account identifier and are retained for 13 months. Earlier app versions sent pre-account onboarding records with a random installation identifier. Those existing records expire after 13 months.

Some records are cleared on a fixed schedule whether or not you delete your account. A nightly job removes them once they pass these windows:

  • Usage events, the record of which features were used and when: 24 months
  • Notification delivery records and media request logs: 24 months
  • Notifications in your in-app inbox: 12 months once you have read one, 24 months if you never open it
  • Reports and the moderation decisions taken on them: 5 years from the decision. A report that is still open is kept until it is decided, however long that takes
  • Failed sign-in counters, which are how we lock out password guessing: 90 days at the outside, and in practice about a day after the last failed attempt
  • Aggregate usage totals and earlier pre-account onboarding records: 13 months
  • Closed support tickets, including privacy requests: 2 years from the last update. An open ticket is kept until it is closed
  • Administrative audit records: 6 years from the action
  • Financial and identity-verification records: 6 years from the end of the UK tax year they last changed in, once every account they name has been deleted

Apple and Stripe keep their own transaction records for as long as tax and accounting law requires them to.

10. Deleting Your Account

You can delete your account from inside the app. Open Settings, tap Account, then Delete Account and confirm. The app asks you to prove that you signed in recently. There is no form to fill in and no need to email us.

Your account is hidden from everyone at once and every device signs out. We keep it for 30 days. If you sign in during those 30 days, you can tap Restore Account to get everything back as it was, or Delete Now to delete it at once. We email you when you ask to delete your account and when you restore it. If you do nothing, the deletion completes on its own after 30 days. To skip the 30 days, tap Delete Now Instead on the Delete Account page. Delete Now also removes the Forjex workouts the app can find in Apple Health. If Apple Health access is off, or the deletion completes after 30 days, those workouts stay on your device and you can remove them in the Health app.

When the deletion completes, Forjex removes your sign-in record. A durable background job removes your profile, workouts, health data, body records, progress photos, nutrition logs, posts, comments, messages, squad membership, coaching records, usage events, and stored media. The job works in bounded steps and retries safely if a step fails. If automatic retries cannot finish the work, the job remains visible to our operations team in a manual-intervention state so we can inspect and resume it. The deletion cannot be undone once your sign-in record is removed.

If you cannot use the in-app flow, email privacy@forjex.com. We verify account ownership before starting a support deletion request. This is a separate process from in-app deletion.

One thing to know: deleting your Forjex account does not cancel a subscription you bought through Apple. Cancel that in your App Store subscription settings.

11. What We Keep After Deletion

Some records can remain after account deletion. They fall into four groups:

  • Financial and transaction records: payments, subscriptions, payouts, refunds, and identity-verification records needed for financial and compliance duties
  • Trust, safety and appeal records: reports, appeals, bans, moderation decisions, and competition rulings needed for safety and review history
  • Administrative audit and configuration: administrative decisions, access records, and shared configuration needed for audit history
  • Shared product records: shared catalog data, squad configuration, and abuse-control records needed by other users or for system safety

We also keep a small set of operational records so deletion can finish safely. The deletion job keeps opaque deleted-user and sign-in identifiers, plus completion and retry facts. It does not keep your profile or email address. We have not set an automatic expiry for this job record.

Media cleanup records keep an opaque user id, the exact storage object key, and the cleanup state for 30 days after they become tombstones. This covers uploads and generated files that can finish late. We remove each tombstone only after confirming that the stored object is absent or has been deleted.

UK tax law requires us to hold transaction records for six years (UK GDPR Article 17(3)(b)). We can also keep records needed to bring or defend a legal claim (Article 17(3)(e)). Financial records are kept for six years from the end of the relevant tax year. Reports and moderation decisions are kept for five years from the decision. Administrative audit records are kept for six years from the action, and closed support tickets for two years from their last update. Other administrative and shared product records are kept only while their audit, safety, or shared-product purpose still applies.

Linked retained rows use an opaque account reference that no longer resolves to your Forjex profile. Older audit text without an immutable account link can remain when we cannot safely identify it from a changeable email address. We do not use retained records to rebuild your profile.

12. Your Rights

You have the right to:

  • Accessyour data. Settings, then Health & Data, has an Export my data button that builds a machine-readable JSON archive of the personal data Forjex can provide. The archive explains any limits or omissions inside the file
  • Correct inaccurate data through your profile settings
  • Delete your account, as described in sections 10 and 11
  • Withdraw consent for optional processing such as Apple Health access, health and body details, route uploads, diagnostics sharing, website analytics, and the ads consent form. Withdrawal stops new processing. It does not always erase rows already stored unless you delete the account or use a delete control that already exists for that item
  • Object to processing, including direct marketing and any processing we rely on as a legitimate interest, such as first-party measurement, recommendation improvement and safety processing beyond a specific legal duty. An objection is reviewed against your circumstances. It is not an automatic product switch. Direct-marketing objections are followed without a balancing override. To object, email privacy@forjex.com. To object to crash, error, and performance reports from the iOS app, turn on Stop Crash Reports in Settings, Consent & Permissions. The choice is stored on your account: once the app reads it after sign-in, it stops these reports from your account on every device. Reports from launch before sign-in are still sent, without your account id, so we can find faults that stop the app starting. An emailed objection to these reports turns the same setting on
  • Restrict processing while we look at a correction, deletion, or objection. Same routes as objection. Restriction is a human action on the request, not an automated product setting
  • Port your data to another service. The export is a machine-readable JSON archive
  • Ask about automated processing.Forjex ranks feeds and Explore using view events, and it can auto-hide content that fails a safety screen. Auto-hide is appealable in Settings > Content decisions. A different reviewer decides the appeal. We have not classified either process as a solely automated decision with a legal or similarly significant effect. Email the mailbox above to ask how the processing worked for your account

Email the mailbox above to make any of these requests. Privacy Rights in the app's Settings and Help & Support opens this section. We aim to acknowledge a rights request within five working days and normally respond within one calendar month. A complex request may take up to two additional months, but we will tell you during the first month if that applies.

13. Cookies and Website Analytics

forjex.com and the web platform use essential cookies to keep you signed in and Cloudflare Turnstile on forms to block bots. PostHog, which measures page views and clicks, runs on this site only if you accept it on the consent banner shown on your first visit. Declining means it never loads, and if your browser sends a Global Privacy Control signal we treat that as a decline. Once you sign in on the web, PostHog events carry your account id.

Your choice is stored on this device. Clearing your browser's site data removes it and brings the banner back.

The iOS app does not use cookies for analytics.

14. Children

Forjex is for adults who are at least 18. We check date of birth before signup and block accounts that do not meet this requirement. If you believe someone under 18 has provided us with personal data, please contact us and we will delete it.

15. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes by email or in the app. Where a new agreement or consent is required, we will ask you to review it before the new processing starts.

16. Contact

Callum Spencer is Forjex's privacy lead. He is not appointed as a data protection officer. Questions about this policy can be sent to privacy@forjex.com, or write to us at Reliability Works Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Section 12 lists your rights and how to use them.

17. Complaints

If you are unhappy with how Forjex has used your personal data, we recommend contacting us first so we can investigate. You may complain to a regulator at any time. Email privacy@forjex.com. Section 12 lists your rights and how to use them. We aim to acknowledge a data-protection complaint within five working days, investigate it, keep you informed, and normally provide the outcome within one calendar month. The inbox is not monitored continuously outside ordinary working hours.

You can complain to the UK Information Commissioner's Office (ICO) at any time. The ICO recommends giving us a chance to resolve the complaint and keeping a copy of what you send. It cannot award compensation. Start here: ico.org.uk/make-a-complaint/data-protection-complaints. The ICO can also be reached on 0303 123 1113.

If you live in the EU or EEA, you can also complain to your local data protection authority. The European Data Protection Board lists them here: edpb.europa.eu/about-edpb/about-edpb/members_en. We have not named a lead EU authority in this notice.