Forge Español

Privacy policy

Last updated: October 1, 2026.

Who is responsible

Forge is developed by Álvaro Arcos García as an individual developer. For any privacy question or to exercise your rights, write to forge@arcos.dev.

Data that stays on your device

Everything you log in Forge is stored in a local database on your iPhone, and what a workout needs on your Apple Watch: sessions, sets, routines, records, your own exercises and their photos, body measurements, your training profile, settings and Coach reports already generated. It is not uploaded to any Forge server or sync service. If you delete the app, it is deleted.

Apple Health (optional)

Only if you allow it, with separate switches in Settings:

• Read: weight, body fat, lean mass, waist, height and BMI for the Body section; your walks, runs, rides and other workouts with their distance, active energy, heart rate and route, to show them next to your sessions; and, if you turn on “Read HRV, resting heart rate and sleep”, heart rate variability, resting heart rate and sleep, to compare them with your own 30-day median.
• Write: the sessions you finish, as strength workouts (start, end and, if you use the Apple Watch, the session’s heart rate).

Health data is never used for advertising or sold, and it does not leave your device except as described in the Coach section, and only if you allow it. Activity routes are never stored or sent.

AI Coach (optional)

The Coach generates reports and routines with Google Gemini. Nothing is sent until you ask for a report, and only what that report needs:

• Session report: the session’s title, date and duration; each exercise’s name and muscle; for each set, its type, weight, reps, time, effort and whether it was a record; your previous sessions of the same routine and your records on those exercises.
• Progress report: weekly totals for the last three months and your most trained exercises; and, only if you allow it in “Data the Coach uses”, weight and body fat and weekly minutes of Health activities.
• Routine: what you write in the form and the exercise catalog.
• Fill in from a photo: the photo you choose and the lists of muscles and equipment.
• Training profile: if you filled it in, your goal, experience, available days and minutes, sex, age and injuries or limits.
• Today’s health: HRV, resting heart rate and sleep, only if you allow it with a separate switch.

Never sent: your name, your email, your Hevy key, or anything in the background.

How it travels and who processes it

• Requests travel encrypted (HTTPS) to Forge’s own server on Cloudflare, which forwards them to Gemini through Cloudflare’s AI Gateway, configured not to store the content.
• To prevent abuse, the app proves with Apple’s App Attest that it is the genuine Forge. The server keeps the public key your device creates, a counter and a monthly request count for the quota. It does not keep report content or data that identifies you.
• Google processes each request under the Gemini API terms.
• Reports are stored on your iPhone; you can delete them in Settings.

Suggestions are AI-generated and are not medical advice: adjust them to how you feel.

Hevy (optional)

If you paste your Hevy API key, Forge downloads your workouts and routines directly from Hevy to import them. The key is stored in your iPhone’s keychain and is only sent to Hevy. You can also import a CSV exported from Hevy, which is processed on your device.

Backups and exports

Backups (JSON) and CSV exports are saved where you choose: Files, iCloud Drive or another app. If you turn on automatic backup, Forge writes a backup to the folder you chose after each session. Forge has no access to those copies outside your device; the service you choose to store them handles them.

Camera, photos and sharing

• Camera: only if you use it to photograph a machine when creating your own exercise. The photo stays on your iPhone.
• Photos: Forge can only add to your library the workout cards you choose to save; it never reads your photos.
• Sharing: cards are made on your iPhone and only leave it when you share them, with the app you choose. They contain no body data.

Siri, widgets and Apple Watch

Siri shortcuts, widgets and the watch complication show data that is already on your device (today’s routine, the current set, your week). They are made locally and are not sent to any Forge server.

What Forge does not do

• No sign-up and no user accounts.
• No advertising, no analytics SDKs, no tracking across apps or websites.
• No data is sold or shared with third parties, except as described for the Coach (Google, through Cloudflare) and Hevy, always at your request.

Retention and deletion

Your data stays on your device until you delete it: you can delete sessions, Coach reports or everything at once in Settings › Data, or uninstall the app. On the server only the App Attest public key, its counter and the monthly request count remain; you can ask for their deletion at forge@arcos.dev.

Your rights

Under the GDPR you can request access, rectification, erasure, restriction or portability, or object to processing, by writing to forge@arcos.dev. Since almost everything is only on your device, you exercise most of these rights directly in the app. You can also complain to the Spanish Data Protection Agency (aepd.es).

Children

Forge is not directed at children under 16 and does not knowingly collect their data.

Changes

If this policy changes, it will be published here with its new date.