Privacy Policy

What we collect

Forge collects the minimum data needed to provide the service:

Email address and name
Role and industry selections from onboarding
Drill and scenario responses
Scores, progress data, and streak information
Payment information (processed by Paddle as our Merchant of Record — we never store card numbers)
Product usage events — which drills you start and finish, the score band, and which pages you reach. Only if you agree to analytics; see below.
Technical error reports when something crashes: the error, the page it happened on, and your account ID. No page content, and no drill responses.

How we use your data

Your data is used to provide personalised learning experiences, track your progress, and improve the platform. We do not sell your personal data to third parties. We do not use your data for advertising, and we do not run advertising or social media tracking pixels on this site.

Analytics

We record which drills people finish and where they get stuck, so we can fix the parts that don't teach. Nothing is recorded until you agree to it in the banner shown on your first visit, and you can change your mind at any time in Settings → Data & privacy. If your browser sends a Do Not Track signal we treat that as a decline, whatever the banner says.

These events are behavioural, not content: we store that you completed a drill and what you scored, never the text you wrote in it.

AI and your data

When you complete AI-evaluated exercises, your prompts are sent to Anthropic's Claude API for scoring and feedback. Anthropic does not use API inputs to train models (per their API data policy). Prompts are retained only in your learning history.

Who processes your data

We use a small number of service providers. Each one only receives what it needs to do its job:

Supabase — database, accounts, and avatar storage. This is where your progress lives.
Vercel — hosting and server logs.
Paddle.com Market Limited — payments, as Merchant of Record. Paddle also handles tax collection and remittance for international transactions.
Anthropic — AI scoring, as described above.
Resend — sending transactional email. Receives your address and the message.
Upstash — rate limiting. Sees a hashed identifier and a request count, not your data.
PostHog — product analytics, only if you agree to it.
Sentry — error reports, as described above.

How long we keep it

Your account data is kept for as long as your account exists, so your progress and history stay available to you. Delete your account and it goes with it — see below.

Server logs and error reports are kept for 30 days. Analytics events are kept for 12 months. Waitlist entries are kept until you ask to be removed or your cohort opens and you create an account.

Your rights

Two of these you can exercise yourself, immediately, without asking us. In Settings → Data & privacy you can:

Export your data — download everything held against your account as a JSON file.
Delete your account — permanently remove your profile, attempts, scores, streaks, and progress, and take your address off the waitlist. This is immediate and cannot be undone.
Change your analytics choice — at any time, in either direction.

For correction, restriction, objection, or anything else, email hello@forge-learn.app. We will respond within 30 days.

Cookies

We use two, and neither is for advertising:

An authentication cookie, set by Supabase, that keeps you signed in. Without it you cannot use the app, so there's nothing to consent to.
A consent cookie recording your answer to the analytics question, so we stop asking. It expires after 180 days.

If you agree to analytics, PostHog may set an identifier to distinguish one visitor from another. There are no advertising cookies, no cross-site trackers, and no third-party pixels.

Children

You must be at least 16 years old to use Forge.

Changes to this policy

We will notify you of material changes via email at least 30 days before they take effect.

Contact

For privacy questions, contact us at hello@forge-learn.app.