Privacy Notice

Healthy men (Steven Mobbs, sole trader), which runs Forge, is the data controller for your personal data. This means we decide how and why it is used. This notice explains what we collect and why.

What we collect and why

• Account details (email, sign-in details, display name, country). Used to create your account and run the service, and to show crisis lines for your country. Legal basis: contract.
• Wellbeing data (workouts, mood and stress ratings, notes, journal entries, goals, coaching sessions). This can be health data. We use it only to show you your logs and progress, and you choose to provide it. Legal basis: your explicit consent, which you can withdraw by deleting the data or your account.
• Check-in text sent for AI tips. Your mood, stress and note are sent to our AI provider to create a coping suggestion. Legal basis: consent, given when you press the button.
• Forum posts. Shown to other signed-in members. Legal basis: contract.
• Technical data (IP address, device and browser details, error logs). Used for security, fraud prevention and fixing problems. Legal basis: legitimate interests.
• Messages to us. Used to answer you. Legal basis: legitimate interests.

Who we share it with

• Service providers who host the app, store data and provide AI processing for us, acting only on our instructions.
• Paddle, our Merchant of Record, for selling Forge Plus, managing subscriptions, payments, tax and invoices.
• Professional advisers, such as lawyers and accountants, when needed.
• Authorities, where the law requires it.

We never sell your data.

International transfers

Some of our providers process data outside the UK. When they do, we rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum to Standard Contractual Clauses.

How long we keep it

We keep your data while your account is open. When you delete your account, we erase your data straight away, apart from records we must keep by law. Paddle keeps its own payment records. We delete or anonymise technical logs within 90 days.

Your rights

Under UK GDPR you have the right to access, correct, delete, restrict or move your data. You can also object to how it is used and withdraw your consent at any time. You can delete everything yourself from the Today menu. For anything else, contact us and we will reply within one month. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

Security

Data is encrypted while it travels and while it is stored. Access controls mean only you can see your private logs.

Cookies

We use only essential browser storage to keep you signed in. We don't use analytics or marketing cookies.