Privacy policy

• Account: name, email, phone (if you give one) and your password, stored hashed and unreadable, including by us.
• Training: exercises, sets, loads, reps, times, records and any notes you write.
• Body: weight, measurements, progress photos and goals, when you record them. Photos are visible only to you and, if you are coached, to your trainer.
• Messages: conversations with your trainer, including those going over WhatsApp.
• Payment: your plan, the dates and the reference for each payment. Card details never pass through us.
• Technical: access logs with date, IP address and device type, used for security and diagnostics.

To provide the service you asked for: show your plan, keep your history, work out progression and let your trainer coach you.

To meet legal obligations, mainly tax obligations around payments.

To keep the platform safe: detecting unauthorised access and abuse.

We do not sell data to anyone and we do not run advertising on it.

You and, if you have a personal trainer on Forja, that trainer.

Each trainer sees only their own clients.

In a crew, other members see only what you posted there, and nothing else from your account.

Providers who serve us technically: server and database hosting, file storage, email and WhatsApp delivery, and payment processing. Each one handles only what that task needs.

While your account exists. Once deleted, personal data is erased within 30 days, except what the law requires us to keep.

Payment records are kept for the period tax law requires.

Backups are erased on rotation, within a maximum of 90 days.

You can access your data, correct it, export it and erase it.

Export lives in settings, on the plans that include it. Account deletion lives in settings and needs no request and nobody's approval.

To exercise any of these rights in writing, email [EMAIL DE CONTACTO] and we answer within 30 days.

Connections are encrypted in transit. Passwords are stored with a password specific hashing algorithm, and WhatsApp session credentials are stored encrypted.

Changing your password closes your other sessions, and a refresh token presented twice forces everyone back to the login screen.

No system is unbreakable. If there is a breach affecting you, we tell you.

Forja is not intended for anyone under 16. If we learn an account belongs to someone below that age, we delete it.

If we change anything that matters, we say so inside the app before it takes effect. The date at the top always tells you which version is in force.

We use none. Forja does store things on your device, but none of it serves to follow you, and there is no third party measurement. The cookie policy lists item by item what is kept and how to clear it.

The controller is [NOME LEGAL DA EMPRESA], [MORADA], tax number [NUIT].

The person answering for personal data, and to whom complaints and questions should be addressed, is [NOME DO RESPONSAVEL PELOS DADOS], at [EMAIL DE CONTACTO] and the address above.

We answer within 30 days. If our answer does not satisfy you, you may take it to the competent authorities and to the courts.