1. Introduction
Forge is a morning and evening routine app developed by Opalno, a software company based in the Netherlands. Forge helps you build disciplined daily protocols with timed routines, streak tracking, morning scores, and identity progression.
This Privacy Policy explains what data Forge collects, why we collect it, and how you can control it. We believe in transparency and collect only what is necessary to provide the service and improve the experience.
Opalno is the data controller for the processing described in this policy. We are subject to the General Data Protection Regulation (GDPR) as an EU-based company.
2. Data We Collect
Account & Profile Data
Forge uses anonymous authentication via Supabase. No email address or password is required. We collect:
- Anonymous user ID (automatically generated)
- Name (provided by you during onboarding)
- Onboarding answers (your goal, current state, and weakness)
Routine & Progress Data
Core data generated as you use Forge:
- Routine configurations (selected practices and durations)
- Routine completion data (which steps completed, timestamps)
- Morning and evening scores
- Heat streak data (consecutive days of completion)
- Identity level progression
- Weekly reflection journal entries
- Schedule preferences (wake time, sleep goal)
Analytics & Technical Data
We collect anonymous usage data to understand how Forge is used and to improve the app:
- Analytics events (screen views, feature usage)
- App version and platform
- Device type and OS version
Subscription Data
Subscription status is managed through Apple StoreKit 2:
- Subscription status (active, expired, trial)
- Plan type (monthly or annual)
Opalno does not process or store payment information. All payment processing is handled by Apple. We only receive subscription status confirmations.
3. Data We Do Not Collect
Forge is designed with privacy in mind. We explicitly do not collect:
- ✕Email address — anonymous auth, no email required
- ✕Location data — no GPS or location tracking
- ✕Contacts — no access to your address book
- ✕Photos or camera — no media access
- ✕Health data — no HealthKit or health integrations
- ✕Advertising identifiers — no ads in the app
4. How We Use Data
| Data | Purpose |
|---|---|
| Name & onboarding answers | Personalize your experience and tailor routine recommendations |
| Routine & completion data | Provide the core service: tracking routines, calculating scores, maintaining streaks |
| Journal entries | Store your weekly reflections for your review; never shared or analyzed |
| Schedule preferences | Calculate bedtime and send wake notifications |
| Analytics events | Understand app usage, identify popular features, fix bugs, improve the experience |
| Subscription status | Unlock premium features and manage your subscription |
We do not sell your data to third parties. We do not use advertising. We do not track you across other apps or websites.
5. Legal Basis for Processing
Under the GDPR, we process data based on the following legal grounds:
- Contract Performance (Art. 6(1)(b) GDPR)
Processing your routine data, scores, streaks, journal entries, and account information is necessary to provide the Forge service you subscribed to. - Legitimate Interest (Art. 6(1)(f) GDPR)
Anonymous analytics to improve app quality and stability. We have a legitimate interest in understanding how Forge is used. Analytics data is anonymized and poses minimal risk to your privacy. - Consent (Art. 6(1)(a) GDPR)
Push notifications via Expo. You are asked for explicit permission before any notifications are sent. You can disable notifications at any time through your device settings.
6. Third-Party Services
Forge uses the following third-party services:
Supabase
Database and anonymous authentication provider. Hosted in the EU Frankfurt region. Supabase acts as a data processor on our behalf under a Data Processing Agreement (DPA). All user data is stored within the EU.
Supabase Privacy Policy →Apple StoreKit 2
Payment processing for subscriptions. Apple handles all payment data as an independent controller. Opalno only receives subscription status confirmations and does not process or store credit card details.
Apple Privacy Policy →Expo
Push notification service. Used to deliver wake-up reminders and routine notifications when you have opted in. Expo acts as a data processor for notification delivery.
Expo Privacy Policy →7. Data Retention
| Data Type | Retention Period |
|---|---|
| Account & routine data | Retained while your account is active |
| Deleted accounts | All data permanently removed within 30 days of deletion |
| Analytics data | Anonymized after 90 days |
8. Your Rights Under GDPR
If you are in the European Economic Area, you have the following rights regarding your personal data:
- Right to Access — Request a copy of the personal data we hold about you
- Right to Rectification — Request correction of inaccurate or incomplete data
- Right to Erasure — Request deletion of your personal data (“right to be forgotten”)
- Right to Data Portability — Request your data in a structured, machine-readable format
- Right to Object — Object to the processing of your data, including for analytics based on legitimate interest
- Right to Restrict Processing — Request that we limit how we use your data
- Right to Withdraw Consent — Withdraw your consent for push notifications at any time through your device settings
Account deletion is available directly in the app under Settings → Delete Account. This will permanently remove all your data within 30 days.
To exercise any of these rights, contact us at privacy@opalno.com. We will respond within 30 days.
You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.
9. Children's Privacy
Forge is not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us at privacy@opalno.com and we will promptly delete it.
10. Data Security
We implement appropriate technical and organizational measures to protect your data:
- All data transmission uses HTTPS/TLS encryption
- Database hosted in the EU (Supabase Frankfurt region)
- Row-level security policies ensure users can only access their own data
- Anonymous authentication means no passwords to compromise
- Access to production data is restricted to authorized personnel
- Regular security reviews and dependency updates
11. Contact
If you have questions about this privacy policy, your data, or want to exercise your GDPR rights:
12. Changes to This Policy
We may update this privacy policy to reflect changes in our practices or for legal reasons. When we make significant changes, we will:
- Update the “Effective” date at the top of this page
- Post a notice in the app or on our website
- Request new consent if changes affect how we process data covered by your existing consent
We encourage you to review this policy periodically. Continued use of Forge after changes constitutes acceptance of the updated policy.
This privacy policy applies specifically to the Forge app. For Opalno's general privacy policy covering all our apps and services, visit opalno.com/privacy.