Privacy notice
Last updated 3 November 2026
This notice explains what information Forge holds about you, why, who else handles it, and what you can do about it. We've tried to keep it short and plain. If anything isn't clear, email us at forgeperformanceie@gmail.com.
1. Who we are
Forge is a web app for personal trainers, strength and conditioning coaches and physios, and the athletes and clients they coach. Forge is run by Donnacha Holmes. "We" and "us" mean Donnacha Holmes, trading as Forge.
You must be 18 or over to use Forge.
Contact for anything to do with your data: forgeperformanceie@gmail.com.
2. Two roles: us and your coach
Forge has two kinds of users, coaches and athletes (this includes 1:1 clients and squad players). A coach can also train as an athlete.
- Your account is ours to look after. For your login, email address, settings, security records and, for coaches, your Forge plan, Forge is the "controller". That means we decide how that data is used, and we're responsible for it.
- Your training is shared with your coach. When you train with a coach on Forge, the coach decides what you're asked to do and record: programmes, sessions, tests and notes. For that coaching information the coach is the controller, and Forge stores and processes it on the coach's behalf, under the coach terms in our Terms of Use. If you want to know why your coach collects something, ask them first. We'll help either of you with any request.
3. What we hold about you
Everyone
- Account: your name, email address, password (stored only as a scrambled hash, never as the password itself), profile picture if you add one, short bio, time zone, kg or lb setting, and whether you want email notifications.
- Google sign-in: if you sign in with Google, we receive your name, email address, profile picture and a Google account ID that ties your Forge account to Google. We don't get your Google password or anything else from your Google account.
- Agreement records: when you agreed to our Terms, which version, and how (at sign-up or on the "Agree and continue" screen).
- Squads and 1:1s: which squads and 1:1 coaches you're with, and when you joined. Joining is by code or invite.
- Notifications: messages Forge shows you in the app (for example "programme assigned" or "session logged"), and whether you've read them.
- Feedback you send us: your note, your email address, an optional screenshot, the page you were on, your squad, and basic device details (browser type, app version and screen width).
- Activity and security: when you last used the app (recorded at most once an hour), sign-in and sign-up attempt counts, and short-lived email confirmation and password reset links (stored scrambled; they last 24 hours and 1 hour). To stop abuse, we use your IP address when counting attempts.
- Access tokens: if you create a read-only access token to connect another tool to your own Forge data, we store only a scrambled copy of it.
Athletes
- Training sessions: what you did and when, the sets, reps, weights, times and distances you recorded against what was prescribed, how hard it felt (RPE), your notes, and your coach's comments. A coach can also log a session for you.
- Tests: test results and notes, for example jumps, sprints or strength tests.
- Filming consent: whether you agreed to be filmed by a squad's coaches and when you decided.
- Your own versions of exercises, and any videos or pictures your coach made just for you.
Coaches
- Your coaching work: programmes, blocks, exercises, cues, test setups, squad and client names, groups and notes.
- Media: videos, pictures, PDFs and other files you upload, and YouTube or Vimeo links you paste. Uploads are kept in private storage and opened only through short-lived links.
- Staff: people you invite to view a squad read-only, and invite records.
- Interest page and leads: if you turn on a public interest page, we store its name, logo and link, plus the name, email, optional phone number, message and consent time of each person who gets in touch. We hold leads on your behalf.
- Payments (not live yet): if payments are switched on, your Forge plan and payment status, and the link to your Stripe accounts. Card details are handled by Stripe and never reach Forge.
Health information. Training data can reveal things about your health, especially for rehab clients: injuries in notes, RPE, or a programme built around an injury. The law treats health data with extra care.
We don't knowingly collect anything else, and we don't buy data about you from anyone.
4. Why we use it, and our legal basis
| What we do | Legal basis |
|---|---|
| Run your account and let you sign in, train, coach and see your history | Providing the service you signed up for (contract) |
| Store and show coaching data for your coach | On the coach's instructions, as their processor. The coach's own legal basis applies |
| Send emails you need (confirm email, password reset) and notification emails you can turn off in Settings | Contract. Notification emails are optional |
| Keep Forge secure: attempt limits, abuse checks, security records | Our legitimate interest in keeping Forge and your account safe |
| Read feedback you send and fix problems | Our legitimate interest in improving Forge |
| Keep a record of who agreed to which Terms | Our legitimate interest, and to show we follow data protection law |
| Payment and tax records (once payments are live) | Contract and legal obligation |
We don't sell your data. We don't show ads. We don't use your data for marketing to you from other companies.
5. Who can see your data
- Your coach sees the training you log on their squad or 1:1, and your test results there. Read-only staff your coach adds to a squad can see the same.
- Other athletes on a squad don't see your sessions.
- The Forge team looks at data only to support you, fix problems or keep Forge safe.
- Service providers that run parts of Forge for us (see section 6).
- Authorities, if the law requires it.
6. Service providers we use
| Provider | What for | Where |
|---|---|---|
| Supabase | Database and private file storage | EU (Ireland, AWS eu-west-1) |
| Vercel | Hosting the app | App servers in Dublin. Vercel is a US company, and its network can serve pages from elsewhere |
| "Sign in with Google", if you use it | Google's own terms apply | |
| Resend | Sending emails (confirmations, resets, notifications) | US company |
| Stripe | Payments, only once switched on | Stripe's own terms apply |
| YouTube and Vimeo | Playing videos your coach links to. We use YouTube's privacy-enhanced player and Vimeo's "do not track" setting, and the video is only loaded when you open it | Their own terms apply |
Where data leaves the EU (for example to US providers), we rely on the EU–US Data Privacy Framework or the EU's standard contractual clauses.
7. How long we keep it
- Your account and training history: for as long as you have an account. Leaving a squad doesn't delete your history (see section 8).
- When you delete your account: you get 14 days to change your mind (just sign back in). After that your account and data are deleted for good. Until this is live in the app, email forgeperformanceie@gmail.com to delete your account.
- Leads from a coach's interest page: deleted 12 months after their last message. Anti-spam records (a scrambled IP address) are deleted after 2 days.
- Email confirmation and password reset links: they expire after 24 hours and 1 hour.
- Feedback, notifications and security records: for as long as you have an account.
- Payment records: usually 6 years for Irish tax law, once payments are live.
8. Leaving a squad, being removed, and when a coach leaves
- If you leave a squad or 1:1, or your coach removes you: your coach (and their staff) stop seeing your training straight away. Your sessions and test results stay on your own account. Anything made just for you on that squad, like your personal exercise videos, is deleted. If you rejoin later, your coach can see your old history again.
- If your coach deletes their account: their squads pause straight away and you'll get an email. You have 14 days to download your training history. After that the coach's squads and programmes are deleted, along with the sessions you logged on those squads. Anything on other coaches' squads isn't affected.
- If you delete your account: your coaches are told you've left once the 14 days are up.
9. Your rights
Under data protection law (the GDPR and the Irish Data Protection Act 2018) you can:
- See your data and get a copy. In Forge: Settings → Your data → Download your data. Until this is live in the app, email us.
- Correct it. Most of it you can edit yourself in Settings.
- Delete it. Settings → Your data → Delete account. Until this is live in the app, email us.
- Take it with you in a format other apps can read (CSV and JSON).
- Object to us using it for our legitimate interests, or ask us to limit how we use it.
- Withdraw consent any time, where we rely on consent (for example filming consent, which you can change on your squad).
For coaching data, where your coach is the controller, you can ask your coach or us. We'll help either way. We reply within one month. We won't charge you, and we may need to check it's really you.
Not happy? Talk to us first at forgeperformanceie@gmail.com. You can also complain to the Irish Data Protection Commission: www.dataprotection.ie, 21 Fitzwilliam Square South, Dublin 2, D02 RD28.
10. Cookies
Forge only uses cookies it needs to work: one to keep you signed in, and one to remember which squad you're looking at. We don't use analytics or advertising cookies, so there's no cookie banner. If that changes, we'll ask you first. YouTube or Vimeo may store their own data when you play a linked video.
11. Keeping your data safe
Passwords and tokens are stored scrambled. Uploaded files are private and opened through short-lived links. Our database is in the EU. Attempt limits slow down anyone guessing passwords. Resetting your password signs you out on every device. No system is perfect. If something goes wrong that puts your data at risk, we'll tell the Data Protection Commission within 72 hours where the law requires it, and tell you if you're affected.
12. Changes to this notice
If we change this notice in a way that matters, we'll update the date at the top and show you a short note in the app the next time you sign in.
Questions? forgeperformanceie@gmail.com