Privacy Policy

Forge Pulse · Version 3.9 · Effective November 6, 2026

Grey Men Coffee LLC (“Forge Pulse,” “we,” “us”) provides a fitness and wellness app for nutrition logging, workouts, recovery, activity, and optional AI-assisted features. This policy explains what we collect, why we use it, who processes it, how long it is retained, and the choices available to you.

Wellness, not medical care. Forge Pulse does not diagnose, treat, prescribe, or replace a qualified health professional. If you enable GLP-1 Mode, the app may automatically adjust protein, calorie, and training targets using the bounded fitness rules described below. These estimates are not medication or treatment advice; custom targets remain under your control.

1. Information we process

• Account and profile: name, email, Supabase user ID, age, sex, height, weight, goals, preferences, and optional profile photo. The sex you entered also sets the default appearance; the markers the app keeps for that are stored encrypted on your device and are not uploaded to your account or synced.
• Fitness and health: workouts, sets, reps, weights, body measurements, meals, calories, macros, micronutrients, water, steps, sleep, heart rate, HRV, active energy, readiness check-ins, optional menstrual-cycle dates, and an optional self-reported GLP-1 Mode preference.
• Motion sensors: step counts from your phone’s motion sensors (the Motion & Fitness permission on iOS, the physical-activity permission on Android), saved as daily totals with your daily check-in and synced to your account like your other daily logs. If you decline Motion & Fitness, the app does not count steps itself and the step figure comes only from Apple Health or Health Connect, when you have allowed that. On a phone that has one, the barometer is read only while a bike ride shows its grade (steepness) figure; the readings are used only for that figure as it is drawn, are not saved in your account, and are never used to find your location.
• Location: precise GPS samples and route polylines only while you explicitly record an outdoor cardio session. Location is not used for passive tracking.
• Support card: if a message you send to the coach, a note on a scan, or a free-text answer in setup may mean you are struggling, the app shows a card with help lines. That check runs on your phone. We do not save the result or count how often it happens, and the check itself sends nothing. When you write to the coach, your message goes to our AI service like any other message, and the instructions the coach follows for that message are also adjusted to ask it to reply gently; that adjustment is made while the message is handled, and nothing about it is stored or counted. The card chooses help lines from your phone’s region and time zone only; it does not use your location.
• Bluetooth ride sensors (optional): if you connect a heart-rate strap, power meter, cadence or speed sensor, or smart trainer for a bike ride, its live readings are used on your phone during that ride and a summary (average and maximum heart rate, heart-rate zone minutes, power, energy, and cadence) is saved with the workout. Raw Bluetooth traffic and live sample streams are not part of any upload. The sensors your phone remembers are kept on that device only.
• Photos: optional profile photos stored with your account (shown to an accountability partner only after an automatic safety check); meal photos selected or captured for AI analysis and saved meal records. Durable phone copies have no automatic expiry; uncertain local cleanup remains pending after meal deletion.
• Saving meal photos to your Photos app (optional, iPhone only). If you turn on "Save meal photos to Photos" in Profile → settings gear → Privacy & security → Data & Privacy, then when you log a meal with a photo you took with the camera in Forge Pulse, we add a copy of that original photo to the Photos app on your iPhone. It is off until you switch it on. We ask iOS for add-only access, which lets Forge Pulse add photos but not see, change or delete anything already in your Photos library, and you can withdraw it at any time in iOS Settings. We never copy photos you choose from your library, and we do not copy menu, nutrition-label or barcode scans. The copy is made on your device and this feature sends no photo, list or setting anywhere (the photo you scan is still sent for AI analysis, as described above); like any part of the app, an unexpected error in it can show up in our PII-scrubbed error reports. Once a photo is in your Photos library it is yours: deleting a meal, using "Sign out & erase device data" or deleting your account does not remove it, and if you use iCloud Photos, Apple syncs it like any other photo. To keep from adding the same photo twice, Forge Pulse keeps a small list on your device of which photos it has already added (internal ids, times, a try count, a status for each photo and your on/off choice; no pictures); it is erased with your other local data.
• AI content: meal-scan prompts and images, messages and onboarding answers, and relevant profile, fitness and health context included in user-requested coaching, program, or meal-plan features.
• Purchases: subscription status, product, transaction, device, and entitlement identifiers handled by Apple, Google, and RevenueCat.
• Diagnostics: PII-scrubbed crashes and errors; with Analytics consent, performance traces, screen views, feature-use events — including whether a feature worked, for example how many GPS fixes a cardio recording received or rejected, never your location, route or distance — and an account user ID.
• Device safety check: when you open the plan-purchase screen, your profile or your settings, the app checks on your phone whether the phone looks jailbroken or rooted. If it does, the app warns you before a purchase, an account deletion or a change to two-step sign-in, and you can still go ahead. The check runs on your phone and its result is not sent to us, except that with Analytics on, a short “device may be compromised” diagnostic event goes to Sentry with the usual app version, OS version and device model, and may carry your account ID like other Analytics diagnostics.
• Device check (iPhone): to help make sure AI requests come from the real Forge Pulse app on a genuine iPhone, Forge Pulse can ask Apple’s App Attest service to vouch for a key that is created inside the phone’s secure hardware. We switch this check on and off from our server settings. While it is off, the app does not contact Apple for it and nothing new is stored. When it is on, we send Apple none of your Forge Pulse account details. We keep the key’s public part and its identifier, a use counter, the day it was created and last used, and a count for the current hour, not linked to your account; keys unused for 90 days are deleted. Our server then gives the app a short-lived signed pass for your account (valid for a few hours, held only in the app’s memory and not stored by us), which the app sends with AI requests. If a pass is missing or cannot be checked, for example on an older version of the app or a phone that does not support the check, AI features still work but the number of AI requests per minute may be lower. We also count, without any account or device detail, how many requests carried a valid pass and how many did not. With Analytics on, if the check fails the app may also send Sentry a short diagnostic event naming the step that failed and an error code (never a key, a challenge or a pass), with the usual app version, OS version and device model, and it may carry your account ID like other Analytics diagnostics.
• Service-operation records: for each AI request, which model answered and how many tokens it used; for each AI scan, a quality record (scan mode, plan tier, confidence scores, and capture-quality and device-condition counters — never the photo or the meal text). They are linked to your account, are used to enforce usage limits, control cost and keep scan quality accurate, are not analytics, and so do not depend on the Analytics setting. Each AI-request record also holds the time, the kind of request (a meal scan, a label read, or another AI request such as coach chat or plan generation), your plan and how long the request took; it never holds your prompt, photo or the AI’s answer. So that a scan the app retries is counted once, we also keep a one-way fingerprint of the image (not the image) together with your account ID; it is removed when you delete your account. To limit how fast requests can arrive, we also keep counters against your account and against your network (IP) address; they hold only the feature’s name, a time window and a count, never what you sent.
• Device services: push token, app/build version, OS/device class, and permission status needed to deliver app functionality.

We do not collect biometric templates. Face ID, Touch ID, and Android biometric matching happen entirely through the operating system, which returns only success or failure. Current Android Coach dictation opens the selected keyboard; Forge Pulse receives entered text and does not request microphone access or call Android SpeechRecognizer in this flow. Keyboard-provider dictation follows that keyboard's settings and privacy policy. On iOS, Forge Pulse uses Apple's Speech framework only when the user taps the mic to dictate a message in the AI Coach. On-device recognition is requested where supported, otherwise Apple's speech service may return a transcription. Forge Pulse does not record or store voice audio or send it to its servers. Coach text the user sends is covered as other user content.

2. How and why we use information

Health permissions, AI processing, GPS recording, Weather on rides, wearable connections, and analytics are optional. You may withdraw consent in Forge Pulse under Profile → Settings → Privacy & security → Data & Privacy and in system settings. Withdrawal stops new processing for that purpose but does not undo lawful processing already completed.

3. AI processing

When you request an AI feature, Forge Pulse sends the necessary photo or text through a Supabase edge proxy to Anthropic’s commercial Claude API. We do not use these inputs to train Forge Pulse models. Under Anthropic’s commercial API terms, inputs and outputs are not used for model training and are deleted within 30 days by default; they may be retained longer for Usage Policy enforcement or legal obligations. On supported LiDAR scans, a depth image of the plate and its surroundings is also included to help estimate portion size.

AI consent covers food scans, coaching, training programs and meal plans. Alongside the photo or text you submit, coaching and planning requests can include your name, age, sex, height, weight, goals, preferences, nutrition targets, logged meals and activity, and summaries such as sleep, steps, heart rate and heart-rate variability (HRV), readiness, measurements and progress. This context may include data imported from Apple Health or Health Connect with your permission. Only context relevant to the requested feature is included. You can keep AI off while using manual logging and other non-AI features. The app asks prior AI users to review this scope before enabling further AI calls; this decision does not change their Apple Health, location or analytics preferences.

Some AI-written suggestions are prepared automatically when you open a screen, rather than when you press a button — for example the adaptive macro suggestion on the Macros screen and the training-trend and performance insights in History and Home. They send the same kinds of context to the same provider, only while AI consent is on, and stop when you turn AI off.

Once a month, while AI consent is on, our server may also send Anthropic the short text description stored with a meal correction you made in the last 30 days (not the photo, your name or your account details) and ask it to write alternative descriptions of the same food, which are used to improve future scan suggestions. This runs without you pressing anything, is covered by the same Anthropic terms as above, and stops when you turn AI off.

Pausing AI features. Besides the usage limits of your plan, AI features can be paused for an account in two ways. Automatically, with no person involved: we add up what an account’s AI requests cost us each day (UTC) and over a rolling 30 days; once an account passes a first limit for the day its AI requests may be answered by a cheaper AI model, and once it passes a higher limit its AI features are paused until 00:00 UTC. By hand: if an account’s AI use is far outside normal personal use, for example automated or shared use, or use that tries to get around the limits or the device checks, a person at Forge Pulse may pause AI features for that account for a set time or until we lift the pause. We decide using the service-operation records. We keep a record of each time an account passes one of those daily limits or the 30-day cost line we watch, and of the latest pause by hand on an account (the account, the day or time, and the amount or the reason). These records are removed when the account is deleted. The rest of the app keeps working, including barcode scans and manual entry, and you can ask us to review a pause at hello@forgepulse.app.

AI nutrition results are estimates. Review them before saving and use manual entry where accuracy matters. If GLP-1 Mode is enabled, the preference stays in encrypted app storage on your device and local calculations may adjust protein, calorie, and training targets. When you request AI coaching, a program, or a meal plan, the prompt tells Anthropic only that GLP-1 Mode is enabled so the response can respect the same wellness boundaries. Forge Pulse does not request or transmit a medication name, dose, dosing schedule, prescriber, diagnosis, or side-effect history through this preference.

Do not use Forge Pulse for diagnosis, medication decisions, or emergency guidance. The app does not recommend dosing, titration, medication choice, interactions, or stopping treatment.

Saved meal photos

Saved meal photos are kept as durable files on your phone, with no automatic 30-day local expiry. Deleting a meal removes its log. After the Undo period, a local photo is removed only when the app can prove no other saved meal needs it; uncertain local cleanup remains pending. A photo still needed by another saved meal is retained. Pending photo saves have a retry action; logging the meal does not prove the photo has finished saving. Removing the app, losing the phone, or device failure can remove local-only photos.

4. Health, location, and background behavior

Apple Health and Health Connect access occurs only after system permission and is limited to the categories shown in the permission flow. Raw period-start dates, cycle length, day-in-cycle, preferences, and symptom or mood logs stay encrypted on the device. If Cycle Sync is enabled and the user invokes AI Coach, an AI training program, or an AI meal plan, only the current phase name (for example, “luteal”) is sent to Anthropic with that request. No date, day number, symptom, or mood log is sent. The one thing derived from cycle data that does sync is the numeric calorie and protein target, which is adjusted for your phase and saved to your account like any other target. Self-reported GLP-1 status is likewise device-local except for the enabled/disabled context described above when the user invokes an AI feature.

Outdoor cardio GPS runs only during an explicitly started session and may continue while the screen is locked so the route remains accurate. The workout rest timer uses an ordinary scheduled local notification when the app is backgrounded. Forge Pulse declares the iOS audio background mode so spoken coaching you switched on can continue through screen lock during that same active session; it plays only coaching audio you asked for, ducks other audio for each cue, needs no microphone access, and is released when the session ends. Forge Pulse does not use a silent-audio keep-alive to hold the app awake, and the rest timer holds no audio session at all.

Bluetooth is used only while you set up or record a bike ride, and never to find your location. If you decline the Bluetooth permission, rides work exactly as before. On Android 11 and earlier, the operating system requires the Location permission before any app can scan for Bluetooth devices; Forge Pulse does not derive your location from Bluetooth. A saved sensor summary syncs with the rest of that workout under the same security controls, is removed with the workout or your account, and is never shared with an accountability partner.

On iOS, Forge Pulse declares the Bluetooth background mode so a sensor you have connected for a bike ride can keep sending readings while your screen is locked or the app is in the background during that ride, subject to how iOS manages background apps. It is used only to talk to sensors you chose: Forge Pulse does not advertise or broadcast over Bluetooth, starts a search for new sensors only when you open the Bluetooth sensors screen or tap Find sensors, and closes its sensor connections when you stop, save, or discard the ride or close the ride screen.

Cardio maps are drawn with Mapbox. When Mapbox is unavailable, Forge Pulse draws your route on a plain background with no map tiles and contacts no other map-tile provider. To draw the map, Mapbox receives the map area being shown — during a live session, the area around your current position — but not your recorded route or your Forge Pulse account identifier. Forge Pulse switches off Mapbox’s optional telemetry. See section 5.

When you save an outdoor cardio session on iPhone, Forge Pulse asks Apple’s maps service what place the route is in, so a route you repeat can be named for it (for example “Delta Park loop”) instead of only by its shape. The only location sent is one coordinate near the middle of the route, rounded to about 100 metres (finer east–west the further you are from the equator). Your route and your Forge Pulse account are not sent, and neither is your start point: if the middle of the route is within about 250 metres of where you started or finished, such as a lap of a block, nothing is sent at all. As with any network request, Apple also receives ordinary request details such as your IP address. This happens at most once each time you save a session, and when you race a ghost to its finish and the ghost’s run already has a place name, Forge Pulse reuses that name and sends nothing. Apple’s answer is used only to name the route. It is stored encrypted on your device, is not uploaded to your account or synced, and stays there until you delete the session, clear older history, reset the local cache, erase device data or delete your account; names for sessions that automatic history trimming has already removed are not shown anywhere and are dropped, oldest first, once about 500 are kept. On Android no lookup is made; offline, or if Apple does not answer, nothing is stored. In each case routes keep their descriptive names. Apple handles the request under Apple’s own privacy terms. See section 5.

Weather on your ride map (optional, only if you say yes)

If you turn on Weather on rides, the 3D map of a live walk, run or ride can show the sky for the weather where you are. To do that, while that map is on screen Forge Pulse sends one rounded position to Apple Weather (Apple’s WeatherKit service) through our server: when the map starts, and then about every five minutes. The position is rounded to a grid cell up to about 5.6 km (3.5 miles) across before it leaves your phone. We do not send your exact position, your route, your name or your account to Apple. We do not store the position or the weather that comes back: neither is written to our database or logs, and the reply is held in memory for a few minutes only (a request counter with no position is kept briefly to stop abuse). Apple handles the request under Apple’s own privacy terms. When the sky is drawn from Apple’s weather the map shows the Apple Weather mark and a link to Apple’s weather data sources; your phone loads that mark from Apple’s servers, so Apple also receives ordinary request details such as your IP address when it is first shown.

The question is asked once, the first time a map could use it, and the feature is off unless you say yes. You can change your answer at any time in Profile → settings gear → Privacy & security → Data & Privacy → Weather on rides; turning it off stops the requests at once. The feature stays off for everyone until we switch it on in the app’s server settings.

5. Processors and recipients

Before we share data with a provider, we confirm that its written terms commit it to give that data the same or equal protection that this policy states and that Apple’s App Store Review Guidelines require. This covers Supabase, Anthropic, RevenueCat, Sentry, PostHog, Expo, Mapbox and Cloudflare. Apple, Google, Open Food Facts, USDA FoodData Central and jsDelivr handle requests under their own terms and privacy policies.

If you pair with an accountability partner, each of you sees the other’s display name and profile photo (the photo only after it has passed an automatic safety check, while AI consent is on), whether the other has checked in that day (yes/no) or is taking a rest day, and the nudges and reactions you send each other; this drives your shared streak. Logging a workout checks you in for the day automatically. When your own readiness check-in says to rest, you can choose “Take a rest day” to protect the streak, and your partner then sees that you are resting today and that your readiness was low. You can also switch on, one at a time and each off by default, whether you trained today (yes/no), whether you did cardio today (yes/no), whether you logged nutrition today (yes/no), how many workout sessions you have done this week (a count), and an approximate daily step count (rounded, not exact). Exact figures, individual workouts or sets, meals, body weight and GPS or route data are never shared, and nothing is shared with anyone except your one partner. You can switch any of those optional signals off at any time, which stops future sharing immediately. Partner features include report/block controls. We do not sell personal information or share it for cross-context behavioural advertising.

6. Retention and deletion

• Profile, workout, nutrition, recovery, and optional route data remain while your account is active so the app can provide history and trends.
• Operational analytics are targeted for pruning after 90 days. Sentry event retention follows the configured Sentry plan, currently targeted at 90 days.
• Service-operation records (AI usage and scan-quality records, section 1) are pruned after 90 days.
• Consent and deletion-accountability records may be retained for up to 24 months after closure, then anonymised, where needed to document compliance.
• Phone meal photos have no automatic 30-day expiry. Uncertain local cleanup after Undo remains pending. See the photo controls above.
• Provider backups may take up to 90 days to expire after primary deletion.

Delete your account in Profile → settings gear → Privacy & security → Delete my account, or use the public deletion page. Primary account records are removed through the deletion service. External processors may complete accepted deletion work asynchronously or require manual follow-up; we complete account-deletion requests within 30 days. Active subscriptions must be cancelled separately through Apple or Google to prevent future renewal.

7. Your choices and rights

Depending on where you live, you may request access, correction, export, deletion, restriction, objection, or portability, withdraw consent, or appeal a response. California residents may request information about collected data and opt out of sale or cross-context behavioural sharing; Forge Pulse does neither. European and UK residents may contact their supervisory authority after contacting us.

Turn off Weather on rides at any time: Profile → settings gear → Privacy & security → Data & Privacy → Weather on rides. It is off unless you turn it on.

Use in-app export and deletion controls or email hello@forgepulse.app. We may verify your identity before fulfilling a request.

8. Security and international transfers

We use TLS in transit, app-private storage, OS secure storage for encryption keys, row-level database security, token validation, least-privilege server functions, and PII scrubbing for telemetry. No system is perfectly secure. Processors may handle data outside your country. Optional product analytics is processed by PostHog US Cloud in the United States. Contact hello@forgepulse.app for information about the safeguards applicable to your data.

9. Children

Forge Pulse is intended for users age 18 and older and is not directed to children. Contact us if you believe a child provided personal data so we can investigate and delete it.

10. Changes and contact

We update the version and effective date at the top of this policy when what we collect, why we use it, or who receives it changes materially. After such a change the app shows a notice the next time you open it, with a button to read the full policy and a button to be reminded on your next visit. Confirming that you have reviewed the policy is saved on your phone only; it does not switch any AI, health-sync or analytics choice on or off. Those choices change only when you change them, or when we ask you again in the app because the choice itself has changed. We do not currently email members about policy changes.

Version 3.9 (November 6, 2026) adds our confirmation that the eight providers that process data for us give that data the same or equal protection; describes the on-phone device safety check, the monthly use of meal-correction descriptions by Anthropic and more detail on service-operation records; names Continue with Google and speech recognition among the recipients in section 5; corrects the accountability-partner paragraph (rest days and automatic check-in); describes the optional Weather on rides feature (a rounded position sent through our server to Apple WeatherKit, only if you say yes), the iPhone device check and the pausing of AI features for an account; describes saving meal photos to your Photos app (optional, iPhone only); removes the description of the optional photo backup, which the app no longer has; says that the sex you entered also sets the default appearance; and describes how the in-app policy notice works. It also includes three changes that were added to this text without a version change: the corrected account-deletion path in section 6 (October 25, 2026), the Support card paragraph in section 1 (October 31, 2026) and the profile-photo paragraphs (November 7, 2026), which say that an accountability partner sees your profile photo after an automatic safety check. Version 3.8 (October 22, 2026) clarifies deferred per-meal remote photo cleanup and pending local cleanup when shared use cannot be ruled out. Delete all photo backups and account deletion remain available. Version 3.7 (October 22, 2026) adds separately opted-in private meal-photo backup, its retention and deletion controls, and clarifies durable phone storage. Policy acknowledgement does not enable backup. Version 3.6 (October 3, 2026) adds Cloudflare to section 5 and formally versions the Bluetooth ride-sensor disclosure in sections 1 and 4, which was added to this text earlier without a version change. Version 3.5 (September 21, 2026) replaced MapTiler and OpenStreetMap with Mapbox as the cardio-map provider.

On October 12, 2026 sections 1, 3 and 6 were clarified to name automatic AI suggestions and service-operation records. This is a clarification of existing behavior: what is collected, why, and who receives it did not change, so the version and effective date in force at that time were unchanged.