Privacy Policy

1. What we collect

• Account information. Your email address, a hashed password, and optional Google sign-in identifier. Your display name if you set one.
• Training data. Your goals, schedule, equipment access, injury history, workout logs (weight, reps, RPE), program history, and any chat messages you send to the AI coach.
• Usage analytics. Anonymized request logs (endpoint, response time, error status), feature usage counters, and performance metrics. These let us diagnose bugs and improve the product.
• Billing information.Stripe holds your card details; we only see a customer ID, the plan you're on, and whether you're current on payments. We do not store card numbers.

2. How we use your data

• Personalize your program. Your goals, equipment, and history feed the AI that builds and adapts your training.
• Power the AI coach. When you chat with the coach, your workout state and relevant history are sent to our AI provider so the coach can answer in context.
• Keep the service running. Logs and metrics help us detect outages, investigate bugs, and plan capacity.
• Bill your subscription. Stripe processes payments and sends us an event when a charge succeeds, fails, or is refunded.

We do not sell your personal data. We do not share training data with advertisers.

3. How we store and secure your data

Your data lives in a PostgreSQL database on servers we operate. Passwords are hashed with Argon2id; sessions are stored as random tokens that cannot be reversed. Backups are encrypted and kept on a separate network. Traffic between your device and the app is always over TLS.

4. Third-party services

We rely on a small number of vendors to run the product. Each receives only what it needs:

• Stripe — payment processing. Stripe sees your card and billing details; we do not.
• Anthropic— AI provider for the coach. Your coaching messages and relevant workout context are sent to Anthropic to generate responses. Per Anthropic's commercial policy, these are not used to train their models.
• Amazon Web Services (SES) — transactional email (verification, password reset, billing receipts).
• Amazon Web Services (S3) — stores static media like exercise demonstration images. Your personal training data is not kept in S3.
• Google Identity — if you sign in with Google, Google verifies your identity and shares your email with us.

5. How long we keep your data

Your account and training data are kept for as long as your account is active. If you delete your account we remove your personal data within 30 days, except for a minimal set of billing records we're legally required to retain. Anonymized analytics may be retained indefinitely because they no longer identify you.

6. Your rights and choices

• Access. See what we have on file from your Profile page.
• Export. Download your training history as JSON from Profile → Settings.
• Correction. Update your goals, equipment, and limitations anytime from Profile.
• Deletion. Delete your account from Profile → Security. You can also email support@bodyforge.ai and we'll handle it for you.

7. Cookies

We use a small number of cookies strictly to make the app work — specifically, a session cookie that keeps you logged in, and a CSRF token. We do not use advertising, tracking, or analytics cookies.

8. Where this policy applies

Body Forge AI is operated from the United States and is intended for users in the United States. We design our data handling around US law. If you access the service from outside the US, you're transferring your data to the US and consenting to this policy as written.

9. Changes

If we update this policy in a way that materially affects your rights, we'll email you before the change takes effect. Smaller edits (typo fixes, clarifications) are posted here with an updated effective date.