Privacy Policy
This policy explains what information Forge collects, how we use it, who we share it with, and the choices you have. Forge is operated by Gavin Bebee. We keep data collection to what the service needs. We do not sell your personal information, we do not show advertising, and we do not use advertising or analytics trackers.
1. Information we collect
| What | Details |
|---|---|
| Account | Email address, a securely hashed password (we cannot read it), and the display name you choose. Guests have a generated placeholder email and no password. |
| Profile (optional) | A profile photo, and your notification preferences. |
| Learning activity | Your answers, scores, points, streaks, daily-challenge and practice history, and the statistics we calculate from them. |
| Social | Your invitation code, friend connections, and friend challenges and their scores. |
| Subscription | Your plan, status and renewal date, and the Stripe customer reference. Your card details go directly to Stripe; we never see or store them. |
| Technical | Two cookies (below); your timezone, so “today” and streaks follow your calendar day; and your IP address, used briefly to limit sign-in, sign-up and reset attempts and stop abuse. Our hosting provider also keeps standard server logs. |
| Messages | If you email us, we keep the correspondence so we can help you. |
2. How we use it
- To provide Forge: sign you in, build your daily challenge, score answers, track streaks, show your statistics and run friend challenges.
- To process subscriptions and send transactional email such as password resets and receipts.
- To keep Forge secure and prevent abuse and fraud, and to fix problems.
- To send reminders or summaries only if you turn those preferences on (delivery of reminders may be added later; your preferences are stored now).
- To meet legal obligations.
3. Who can see your information
Other members can see only what friends see: your display name, photo, points and challenge scores, and only if you have connected as friends. There is no public worldwide leaderboard. Our administrators can access account and content data as needed to run and support the service.
4. Service providers who process data for us
| Provider | Purpose |
|---|---|
| Vercel | Hosting and delivery of the site, and storage of profile photos. |
| Neon | Database hosting for your account and activity data. |
| Stripe | Payment processing and subscription billing, and the billing portal. Stripe’s own privacy policy applies to its handling of your payment data. |
| Resend | Sending transactional email such as password resets. |
| Google Fonts | Delivers the site’s typefaces to your browser, which means your IP address is visible to Google when a page loads. |
These providers may only use your data to provide their services to us. We may also disclose information if required by law or to protect rights, safety and the security of the service, or in connection with a sale or reorganisation of the business, in which case this policy will continue to apply to your data unless you are told otherwise.
5. Cookies
Forge uses only essential cookies, so there is no cookie banner for advertising or analytics:
forge_session: keeps you signed in (up to 30 days). It is HttpOnly, so scripts on the page cannot read it.forge_tz: remembers your timezone (up to 1 year).
6. How long we keep data
- Your account and activity data are kept while your account exists. When you delete your account, we delete your profile, photo, activity, friend connections and subscription record from our systems. Copies in encrypted backups age out within about 30 days.
- Sign-in sessions expire after 30 days; rate-limit records are deleted within about 24 hours; password-reset tokens expire after one hour and are then deleted.
- Guest accounts inactive for about 30 days are deleted.
- Stripe keeps payment and tax records as the law requires, even after your account is deleted. We may also keep limited information needed to resolve disputes, prevent fraud or meet legal duties.
7. Your choices and rights
- Access and correct: change your display name, photo and notification preferences in Profile at any time.
- Delete: use Profile → Delete account. This also cancels any active subscription.
- Copy or other requests: email gavinbebee@icloud.com to ask for a copy of your data, a correction, or to object to or restrict a use. We will respond within the time the law requires (generally 30 to 45 days).
- California and similar laws: you may have the right to know, delete and correct your personal information and to opt out of sale or sharing. We do not sell or share personal information for advertising, and we will not discriminate against you for exercising your rights.
- EEA, UK and similar: where those laws apply, our legal bases are performing our contract with you (running your account and subscription), our legitimate interests (security, fraud prevention and improving the service), legal obligation, and your consent where we ask for it. You can also complain to your local data-protection authority.
8. Security
We use encrypted connections (HTTPS), hash passwords, restrict access to administrative tools, and limit repeated sign-in attempts. No system is perfectly secure, so please use a strong, unique password. If a breach affects your data we will notify you as the law requires.
9. Children
Forge is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us information, email gavinbebee@icloud.com and we will delete it.
10. Where data is stored
Our service providers host data primarily in the United States. If you use Forge from elsewhere, your information will be transferred to and processed in the United States.
11. Changes
We may update this policy. For material changes we will notify you by email or in the app before they take effect. The effective date is at the top of this page. See also our Terms of Service and Refund Policy.
12. Contact
Gavin Bebee
gavinbebee@icloud.com