Privacy Notice

Forge is operated by Forge Loving Relationships LLC ("Forge", "we", "us"). This notice covers the Forge website at forgelovingrelationships.com (the "website") and the Forge app at app.forgelovingrelationships.com (the "app"). It explains what personal information each one collects, why, who it is shared with, how long it is kept, and what you can do about it. It does not cover any other Forge website or service.

The website has no accounts. It collects personal information only when you fill in one of its forms:

• Free cards, the newsletter, and app updates: your email address, and your first name and the topic you're most interested in if the form asks for them.
• Forge Families demo requests: your first and last name, email address, organization, and your consent to be contacted.
• Contact messages: your first and last name, email address, your message, and your consent to be contacted about it.

We also record which form you used. To stop abuse, the free cards, newsletter, app updates, and contact forms count requests by IP address. Those counts are held only in the website's memory, are never saved, and are cleared whenever the website restarts.

• Your email address, to send you sign-in codes and to identify your account.
• A display name, if you give one. If you don't, we use "Learner".
• That you answered yes to our three sign-up questions (18 or older, living in the United States, reading English comfortably), and when you joined. We don't ask for your date of birth or any document. If you answer no, your answers are not sent to us and no account is created.
• Which versions of our terms of use and this notice you accepted, and when.
• What you enter in the app: the relationships you add (a relationship type such as spouse or parent, a name of up to 40 characters, and optional pronouns), your Health Check and check-in answers and scores, your plans, your practice progress, your reflections, and the Sparks you earn. Your reflections are stored encrypted. We hold the key, so this is not end-to-end encryption.
• Your sign-in sessions: the IP address and browser details (user agent) you signed in from, and when each session started and ends.
• Request counts: to stop abuse, we count requests by IP address, and we count sign-in and sign-up code requests using keyed hashes of your email address or IP address. A keyed hash is a one-way code that we can match against but can't turn back into the address.

Neither the website nor the app collects payment details, precise location, contacts, or photos. Neither has advertising, analytics or tracking tools, loads third-party scripts, or uses artificial intelligence on your information.

On the website, we use your information to send you what you asked for (the free cards, the newsletter, or app updates), to follow up on a demo request, to reply to a message you send through the contact form, and to keep the forms working and free of abuse. In the app, we use it only to run Forge for you: to sign you in, to save and show your progress, to keep the app secure and enforce its limits, to answer your requests, and to meet legal obligations.

The app sends only the sign-in codes you ask for. The website sends only what you asked for: the free cards, the newsletter, app updates, a follow-up about your demo request, or a reply to your contact message. We don't sell your information, and we don't share it for advertising.

The website sets no cookies for visitors. The app uses two cookies, both needed to make it work. A sign-in cookie keeps you signed in for up to 30 days, and signing out removes it. A sign-up cookie holds your place in the sign-up steps for up to 30 minutes and does not contain your email address. The app uses no tracking cookies and stores nothing else in your browser.

• DigitalOcean hosts the website, the app, and the app's database in New York, United States.
• Brevo stores the details you give the website's forms and sends the website's emails. It also sends the app's sign-in code emails, for which it receives your email address and the email itself, which contains your code.

We don't share your information with anyone else unless the law requires it, or unless it is needed to protect someone's safety or Forge's security. If Forge Loving Relationships LLC were sold or merged, your information would move with the service and stay covered by this notice.

The people you add are not told about Forge and cannot see anything you enter. At Forge, we don't look at your relationships, answers, scores or reflections to provide support. We access them only when that is needed to keep the app working or secure, or when the law requires it.

From the website:

• The details you give a form: until you ask us to delete them. If you unsubscribe from our emails, we keep your email address on our unsubscribe list so we don't email you again. If you later request a Forge Families demo, we will email you about that request.

From the app:

• Your account and what you enter: until you delete your account.
• Sign-in codes expire after 10 minutes. The keyed hashes used to count code requests are kept for up to 24 hours. A request to change your email address is kept for up to one hour.
• Sign-in sessions end 30 days after your last visit, and never last more than 90 days. Once a session has ended, its record, including the IP address and browser details, is deleted within seven days.
• Request counts stored with an IP address are deleted within seven days of your last request.
• When you delete your account, your access ends straight away and your information is deleted within seven days. We keep a record that the deletion happened (your account's ID and the dates) and our security records of actions on the account (IDs, dates and a keyed hash of your email address). These records contain none of your answers, relationships or reflections.
• Our hosting provider keeps daily backups for seven days, so deleted information can stay in a backup until that backup expires. If we ever restore the app from a backup, we will delete again any account that asked to be deleted before we let anyone use the restored service.

• Stop website emails: use the unsubscribe link in any newsletter or app updates email, or write to us.
• Download your app data: Account, then Download my data.
• Delete your app account: Account, then Delete my account.
• Change your display name or email address from the app's Account screen.
• For anything else, including seeing, correcting or deleting what you gave the website's forms, or questions about this notice, write to privacy@forgelovingrelationships.com. We aim to reply within 30 days.

The app and the website's forms are not for anyone under 18. If we learn that someone under 18 has an app account, we will delete the account. If we learn that they have given us their details through the website, we will delete those details.

Forge uses encrypted connections, stores your app reflections encrypted, and limits who can reach its database. No system is perfectly secure, so we can't promise that your information will never be exposed. If a breach affects your information, we will tell you as the law requires.

We may change this notice by publishing a new version. In the app, we record which version you accepted.

privacy@forgelovingrelationships.com