Forge — Privacy Policy

Forge — AI Workout Planner · Last updated 11 July 2026

1. Who this covers

This policy applies to the Forge iPhone app and its Apple Watch companion ("Forge", "the app", "we"). Forge is developed and operated by the Forge team, an independent studio based in Australia. If you have any questions, contact forge.workouts.hq@gmail.com.

2. What data Forge handles — and where it's stored

Everything you put into Forge is stored locally on your device in the app's private database (shared with the Forge Watch app and widgets through a secure Apple "app group" on your devices). This includes:

• Your training programs, workout days and exercises;
• The sets, reps, weights, durations and notes you log;
• App settings (units, equipment, rest timer, rep-counting preferences);
• Any optional profile details and demo photos/videos you add (see below).

We do not transmit this data to us, and Forge has no server that stores it. There is no Forge account and no sign-in. Your data leaves your device only through features you control: the optional AI "Generate" feature (section 5), which sends data directly to a provider you choose; and the optional iCloud backup (section 6), which stores an encrypted copy in your own private iCloud. Neither sends anything to us.

3. Apple Health (HealthKit)

If you grant permission, Forge uses Apple Health to make workout tracking better. Specifically:

• Reads your heart rate and active energy during a workout (via Apple Watch), and — only if you opt in — your age, biological sex, height and body mass, to show session metrics and to help tailor your training program.
• Writes your completed workouts (as standard workout sessions) to Apple Health / Fitness, so your training shows up alongside the rest of your activity.

Health data is processed on your device. Forge never uses Health data for advertising or marketing, never sells it, and never uses it for data mining. The only circumstance in which Health-derived details leave your device is if you use the AI "Generate" feature (section 5), in which case a short profile summary (age, sex, height, body mass) and your heart-rate-derived training effort may be included in the prompt sent to the AI provider you chose. Your raw Apple Health records are never sent. You can review or revoke Forge's Health access at any time in iOS Settings → Health → Data Access & Devices, or in Forge's own Settings.

4. Camera & photo library

Forge lets you attach your own demo photo or video to an exercise so you can capture exactly how you perform it. Forge only accesses the specific photos or videos you choose, and stores them locally with the rest of your data. This media is never uploaded to us or anyone else, and is never included in an AI request.

5. The AI features

Forge can help you build a training program with an AI assistant. There are two ways to use it, and they differ in what leaves your device:

• Copy / paste (no key needed). Forge prepares a text prompt that you copy and paste into your own AI assistant — for example Claude, ChatGPT, Gemini or another tool of your choice. Forge does not transmit anything in this mode; what you do with the text afterwards is between you and that tool.
• Direct "Generate" (you add your own AI key). If you add your own API key in Settings → AI Assistant, Forge can send the prompt for you and read the plan straight back. The first time you use it, Forge asks you to confirm before anything is sent. In this mode:
  • The request goes directly from your device to the AI provider you selected — Google Gemini, Groq, or a custom OpenAI-compatible endpoint you enter yourself. There is no Forge server in between. Forge never receives your prompt, the AI's reply, or your key.
  • Your API key is stored only in your device's Keychain. It is never sent to us, and never written to logs.
  • The prompt contains your training context so the AI can write a useful plan: your goal, weekly schedule, experience level and gym type; anything you typed in the free-text injuries and profile notes fields; a summary of how your recent sessions went (including heart-rate-derived effort where available); your current program; and — if you've connected Apple Health — a short profile line (age, biological sex, height and body mass).
  • It does not include your name, email or contacts (Forge holds none), your demo photos or videos, or your raw Apple Health records.
  • Once your data reaches the provider, it is governed by that provider's terms and privacy policy, including how long they retain requests. We have no control over, or visibility of, what the provider does with it. Review your chosen provider's policy before you enable Direct mode, and use copy/paste mode if you'd prefer nothing leaves your device automatically.

6. Backups and exports

Forge gives you three ways to keep a copy of your data, and you control all of them:

• Manual export. You can export a complete backup of your data (including any demo media) as a file. These backup files are created and shared entirely by you — we never receive them. Where you save or send them (for example to Files, iCloud Drive, AirDrop or a messaging app) is your choice and is governed by those services' terms.
• Automatic iCloud backup (optional). You can turn on an automatic backup to your own private iCloud. Before it leaves the app, the backup is encrypted on your device (AES-GCM) using a key that is held in your iCloud Keychain — so the key syncs privately to your other devices for restore, but Forge and Apple's iCloud only ever hold encrypted data they cannot read. The encrypted file is stored in Forge's folder in your iCloud. There is no Forge server involved, and we never receive your backup or the key. This is an optional Forge Pro feature; turn it off at any time.
• Your device backup. Separately, your iPhone's normal device backup (iCloud Backup or a computer backup) may include Forge's on-device data, encrypted under your own Apple account. That backup is controlled entirely by you and Apple — not by us.

7. What Forge does not do

• No analytics or usage tracking of any kind;
• No advertising, ad identifiers, or marketing trackers;
• No third-party analytics, advertising or social SDKs;
• No selling, renting or sharing of your data;
• No user accounts and no remote servers operated by us.

Forge makes outbound connections only in situations you start yourself: when you use the AI "Generate" feature (section 5); when you turn on the optional iCloud backup (section 6), which talks only to your own iCloud; and when you tap "Search videos online", which opens your web browser to a public video search. Those third-party services have their own privacy policies.

8. Data security

Because your data stays on your device, it is protected by iOS's built-in encryption and your device passcode / Face ID / Touch ID. When you use Direct-mode AI, the request travels over an encrypted HTTPS connection to your chosen provider. When you use the optional iCloud backup, the data is encrypted on your device before it is stored. Keeping your device and its software up to date is the best way to keep your data safe.

9. Children

Forge is a general-audience fitness app and is not directed at children under 13. We do not knowingly collect personal information from children.

10. Your control

You are always in control of your data. Within Forge you can view, edit, export and delete your information at any time, and you can revoke Apple Health access whenever you like. You can turn off Direct-mode AI by removing your key in Settings, after which Forge transmits nothing on your behalf, and you can turn off iCloud backup at any time. Deleting the app removes its data from your device. Since we don't hold any of your data ourselves, there is nothing for us to retrieve or delete on a server. Data you have already sent to an AI provider is held by that provider — contact them to have it deleted under their policy.

11. International users

Forge keeps your data on your own device, so we do not transfer your personal data across borders. The one exception is the optional Direct-mode AI feature: if you enable it, your request goes to the provider you chose, whose servers may be located outside your country (for example, in the United States). That transfer is initiated by you, to a provider you selected, under your own account with them. (The optional iCloud backup stays within your own Apple iCloud account and is not shared with us or any third party.) Because Forge otherwise collects no personal data, this privacy-by-design approach is intended to align with major privacy regulations such as the Australian Privacy Act, the EU/UK GDPR and the CCPA.

12. Changes to this policy

If we update this policy, we'll revise the "Last updated" date above and post the new version at this address. Material changes will be reflected in the app where appropriate.

13. Contact

Questions about privacy in Forge? Email forge.workouts.hq@gmail.com.