Privacy Policy
Last updated 7 October 2026
The short version: we collect what the app needs to work and nothing more. We do not sell your data, we do not run advertising, and we do not track you across other apps or websites. The photos you submit as proof and the list of apps you choose to block never leave your device.
1. Who we are
The Forge ("we", "us") is a discipline and accountability app published by Sharafath Mohamed Technologies, a sole establishment registered in Dubai, United Arab Emirates. For any privacy question, data request, or complaint, contact us at theforgemaster1@proton.me. We are the data controller for the information described below.
2. What we collect
Account information
When you sign in with Google or Apple we receive your email address and a unique identifier for your account. We never receive or store your password. You then choose a username, which other members of your Triad can see. We also generate a referral code and store the date your account was created, which is what determines your free-trial period.
What you write in the app
The Forge is built around what you commit to, so most of what we store is content you deliberately enter:
- Commitments: titles, descriptions, and deadlines
- Your Creed: yearly, monthly, weekly and daily goals, the consequences you set for yourself, and the reasons you wrote for pursuing them
- Daily task lists and which of them you completed
- Evening reflections
- Confessions and Graveyard entries recorded after a failed commitment
- Messages of encouragement you send to your Triad
Activity data
Focus session start and end times, session interruptions, commitment outcomes, streak counts, and completion history. This is what produces your stats, your streak, and your FORGED recap.
Triads and reports
A Triad is a group of up to three people. Members of your Triad can see your username, your current commitment title, and your status. If you report another member, we store the report so we can review it.
Payment information
Subscriptions are handled by Stripe. We never see or store your card details. We store only your subscription status, plan tier, and billing period so the app knows whether your account is active.
Notifications
If you enable notifications we store a push token for your device so we can send reminders. You can revoke this at any time in your device settings.
Website analytics
Our website records anonymous, first-party usage events: page views, scroll depth, and clicks. There are no cookies, no cross-site identifiers, and nothing at all stored on your device. The visit identifier is random, exists only in memory while the page is open, and is gone the moment you navigate away. Because we store nothing on your device and set no cookie, this site needs no cookie banner. We keep only the host a visitor arrived from, never the full referring URL, and we honour the Do Not Track browser signal by recording nothing at all when it is enabled.
We do not store your IP address. Our hosting provider necessarily sees it in order to deliver the page, and to stop flooding and spam we keep a salted, one-way hash of it, from which the address cannot be recovered, for up to 24 hours. It is never used to identify or profile anyone.
Waitlist
If you join the waitlist we store your email address so we can tell you when The Forge is available and, from time to time, send you news and updates from The Forge. Every one of those emails has a one-click unsubscribe. We never sell, rent or share waitlist emails with anyone.
3. What stays on your device
Some of the most sensitive information the app touches is never transmitted to us at all:
- Proof photos. When you photograph evidence of a completed commitment, only a local file reference is recorded. The image itself is never uploaded to our servers.
- Your blocked-app selection. The apps you choose to block during focus sessions and Dark Hours are stored only in local device storage. We never receive that list.
- Screen Time data on iOS. The app uses Apple's Family Controls framework. Apple gives the app opaque tokens rather than app names, and those tokens are stored in a private container on your device. We cannot read which apps you selected, we do not receive your usage statistics, and none of this information is transmitted off the device or used for any purpose other than applying the blocks you asked for.
4. Why we process your data
| Purpose | Legal basis |
|---|---|
| Providing the app's core features | Performance of our contract with you |
| Processing subscription payments | Performance of our contract with you |
| Sending reminders you enabled | Your consent |
| Reviewing reports and preventing abuse | Our legitimate interest in a safe service |
| Anonymous website analytics | Our legitimate interest in understanding usage |
5. Who we share it with
We do not sell your personal data and we never share it for advertising. We use a small number of service providers who process data on our behalf under contract:
- Supabase: database, authentication, and hosting
- Stripe: payment processing
- Expo: delivery of push notifications
- Google and Apple: sign-in, only when you choose it
- Resend: transactional email
Members of your Triad see the limited profile information described in section 2. We may also disclose information where the law requires it.
6. How long we keep it
We keep your account data for as long as your account exists. When you delete your account, your personal data is deleted. Some records may be retained where we are legally required to keep them, such as payment records for tax purposes. Anonymous website analytics are not tied to your account and are retained in aggregate.
7. Your rights
You can:
- Access the data we hold about you
- Correct anything inaccurate
- Delete your account and its data, from within the app
- Export a copy of your data
- Withdraw consent for notifications at any time
- Object to processing based on our legitimate interests
Account deletion is available in the app under Settings. To exercise any other right, email theforgemaster1@proton.me and we will respond within 30 days.
8. Security
Data is encrypted in transit. Database access is restricted per user by row-level security, so one account cannot read another's data. We review the app's security regularly and fix what we find.
9. Children
The Forge is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has given us personal information, contact us and we will delete it.
10. International transfers
We operate from the United Arab Emirates and our service providers operate internationally, so your data may be processed outside your country. Where that happens we rely on our providers' standard contractual safeguards.
11. Changes
If we change this policy we will update the date at the top of this page, and we will tell you in the app before any significant change takes effect.