Privacy Policy

Effective date: June 23, 2026 | Last updated: July 18, 2026

1. Introduction

Forge Note ("we," "our," or "us") operates the Forge Note mobile application (the "Service"), a fitness coaching tool for personal trainers. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our Service.

By downloading, accessing, or using Forge Note, you agree to the data practices described in this policy. If you do not agree, please do not use the Service.

Our legal bases for processing include:

• Contractual necessity — Processing required to provide the Service you requested (e.g., account management, training data storage).
• Legitimate interests — Processing necessary to improve the Service and ensure its security.
• Consent — For optional features such as feedback submissions with contact information, we will obtain your consent before processing.

2. Information We Collect

We collect the following categories of information to provide and improve the Service:

Coach's Responsibility for Client Data: If you, as a fitness coach, enter client names, training data, or health information into the Service, you must ensure that you have obtained the client's explicit authorization to collect and process their personal data. Forge Note acts solely as a data processor providing storage and analysis services on your behalf. We are not responsible for any legal liability arising from your unauthorized collection or processing of client personal data.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Account creation and authentication — To create and verify your account using Firebase Authentication (Google Sign-In, Apple Sign-In, or Email/Password).
• Workout tracking and management — To store, display, and organize training sessions, exercises, and client data.
• Voice-to-text processing — To convert your voice recordings into text for workout entry, using on-device speech recognition as the method.
• AI-powered workout parsing — To send parsed text to AI models (default: Gemini 2.5 Flash; may switch to OpenAI or compatible providers based on service configuration) via our Cloud Functions proxy for intelligent workout structure extraction. API keys are stored server-side; results are always editable before saving.
• Image generation — To create professional, shareable training summary images from your workout data.
• Subscription management — To process and verify your subscription through RevenueCat and Google Play Billing / Apple App Store.
• Customer support — To process your feedback, bug reports, and feature suggestions.
• Legal compliance — To comply with applicable laws and respond to valid legal requests.

4. Third-Party Services

We rely on the following third-party services to operate the Service:

5. Voice & AI Processing

Forge Note offers voice recording to simplify workout entry. We take your privacy seriously when processing voice data:

• On-device speech recognition (default) — Voice recordings are processed locally on your device using the device's built-in speech-to-text engine. The app requires device microphone permission to capture audio. Audio is captured only when you actively trigger the recording button for workout entry. Raw audio data is never stored on our servers or transmitted outside your device.
• Baidu Smart Cloud Short Speech Recognition (optional, China region only) — On Android devices in mainland China where on-device recognition is unavailable, the app may fall back to Baidu Smart Cloud Short Speech Recognition for transcription. In this case, short audio clips are sent to Baidu Smart Cloud via our Cloud Functions proxy for processing. Baidu processes this audio solely for transcription purposes on a transient basis and does not store it after transcription is complete. This feature is disabled by default and must be explicitly enabled in app settings.
• AI-powered workout parsing — The text transcript from voice recording (or manual text entry) is sent to AI models via our Firebase Cloud Functions proxy for structured workout data extraction. The default model is Gemini 2.5 Flash. API keys are stored server-side and never exposed to the client. Only text data is transmitted; no audio is sent. Results are always editable by you before saving.
• AI model flexibility — To provide the best service quality, we may switch AI providers based on service configuration (currently supporting Google Gemini, OpenAI, and OpenAI-compatible interfaces). Regardless of the AI model used, your data is transmitted through our Cloud Functions proxy, API keys remain server-side, and data is used solely for workout parsing, not for model training.
• Enterprise-grade AI data protection — We process all AI parsing requests via Google Gemini enterprise-grade API endpoints, which contractually guarantee that your transmitted data is transient, strictly confidential, and never used by Google or third parties to train or improve underlying AI models. When using OpenAI or compatible providers, equivalent enterprise API terms apply.

6. Data Storage & Security

Storage location: Your data is stored in Firebase Firestore, hosted on Google Cloud Platform servers in the United States (nam5 multi-region). Data is encrypted at rest using AES-256 and in transit using TLS 1.2 or higher.

Security measures:

• All data transmitted between the app and our servers is encrypted using TLS/SSL.
• Data at rest in Firestore is encrypted using Google-managed encryption keys (AES-256).
• Access to Firestore data is governed by Firebase Security Rules, ensuring users can only access their own data.
• AI API keys are stored server-side within Cloud Functions and are never exposed to the client application.
• We follow the principle of least privilege for all service accounts and administrative access.

While we implement industry-standard security measures, no system is completely secure. We cannot guarantee the absolute security of your data.

7. Data Sharing & Disclosure

We do not sell, rent, or trade your personal data to third parties. We share data only in the following circumstances:

• Service providers — We share data with the third-party services listed in Section 4 solely for the purpose of operating the Service.
• Share links — When you create a share link, a read-only snapshot of the selected training data is stored in a publicly accessible Firestore collection. See Section 8 for details.
• Legal requirements — We may disclose data if required by law, regulation, legal process, or governmental request.
• Safety and harm prevention — We may disclose data to prevent fraud, protect the safety of our users, or address security vulnerabilities.
• Business transfers — In the event of a merger, acquisition, or sale of assets, user data may be transferred, subject to this Privacy Policy.

We do not use your data for advertising purposes.

8. Share Links

Forge Note allows you to create share links for training sessions. When you create a share link:

• A read-only snapshot of the selected training data is stored in a publicly accessible Firestore collection ("sharedLinks").
• Anyone with the share link URL can view the snapshot data without authentication.
• Snapshots include training session details, exercises, and any information you have entered for that session.
• Snapshots do not include sensitive client data beyond the training session you chose to share.
• Share links expire after 90 days by default. Once expired, the link becomes inaccessible.
• You can delete share links at any time, which immediately removes the snapshot from public access.

Important: Once a share link is created, you are responsible for controlling who has access to the link. We cannot prevent recipients from copying or redistributing shared content.

9. Data Retention

We retain your personal data for as long as your account is active. Specifically:

• Account data is retained until you delete your account.
• Training and client data is retained until you delete it or delete your account.
• Share link snapshots are retained until you delete the share link, the link expires, or you delete your account.
• Voice audio is never stored. Text transcripts are retained as part of your training data.
• Feedback data is retained until you delete your account.

When you delete your account, we will delete all associated personal data from our systems within 30 days (actual deletion is typically immediate), except where we are legally required to retain certain information.

10. Your Rights

Depending on your jurisdiction, you may have the following rights:

General Rights:

• Access — Request a copy of the personal data we hold about you.
• Rectification — Request correction of inaccurate or incomplete data. You can correct most data yourself through the app.
• Deletion — Request deletion of your data. You can delete your account at fitlog-5c993.web.app/delete-account or through the in-app feature.
• Data portability — Request your data in a structured, commonly used format. Contact us for data export.
• Object to processing — Object to certain types of processing of your personal data.
• Restrict processing — Request that we limit how we use your data.

GDPR (European Economic Area & UK):

• Legal bases for processing are set out in Section 1 (contractual necessity, legitimate interests, consent).
• You may contact us for data protection matters at support@forgenote.app.
• Where processing is based on consent, you may withdraw consent at any time without affecting prior lawful processing.
• You have the right not to be subject to decisions based solely on automated processing, including profiling.
• You have the right to lodge a complaint with a supervisory authority in your country of residence.

CCPA (California Residents):

• Right to know — You have the right to know what personal information is collected, used, and shared. Categories collected in the past 12 months are listed in Section 2.
• Right to delete — You have the right to request deletion of your personal information.
• Right to opt-out of sale — We do not sell personal information, so no opt-out is necessary.
• Right to non-discrimination — We will not discriminate for exercising your privacy rights.

To exercise any of these rights, please contact us at support@forgenote.app. We will respond within 30 days.

11. Children's Privacy

Forge Note is not intended for use by children under 13. We do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected such data, we will take steps to delete it promptly.

Parents or guardians who believe their child has provided personal information to us should contact support@forgenote.app.

12. International Data Transfers

Your data is stored on Google Cloud Platform servers in the United States. If you access the Service from outside the US, your data will be transferred to and processed in the United States.

We rely on the following mechanisms to ensure lawful international data transfers:

• EU-U.S. Data Privacy Framework — Google LLC has certified its compliance.
• Standard Contractual Clauses (SCCs) — Google Cloud Platform offers SCCs for international data transfers.

By using the Service, you consent to the transfer of your data to the United States in accordance with this Privacy Policy.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes:

• We will update the "Last updated" date at the top of this page.
• If the changes are material, we will notify you via a prominent notice in the app or by email before the changes take effect.
• We encourage you to review this Privacy Policy periodically.

Your continued use of the Service after any changes constitutes your acceptance of the updated Privacy Policy.

14. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices:

• Email: support@forgenote.app
• Account deletion: fitlog-5c993.web.app/delete-account

We aim to respond to all inquiries within 30 days.