Privacy policy

Last updated 12 October 2026

Forge Fitness takes your privacy seriously, especially because coaching involves health information. This policy explains what we collect, why, who helps us process it, and your rights.

1. Who is responsible

Forge Fitness is responsible for your personal data (the “controller” under the GDPR).

Business: Forge Fitness
KvK number: 42179940
Address: Noord Brabantlaan 48 A, 5651 LZ Eindhoven, the Netherlands
VAT number: NL005557763B02
Email: [email protected]
Phone: +31 6 13 77 93 65

2. What we collect

Account details: your name, email address and, if you share it, your phone number and goal.
Coaching information: your workouts, check-in answers, body weight and measurements, progress photos, food diary, habits and messages with your coach.
Health information: details you share such as injuries, medical conditions or pregnancy. This is a special category of data, and we only process it with your explicit consent, which you give when you first sign in to the app.
Payment details: your plan, payment status and invoices. Payments are handled by Stripe; we never see or store your full card or bank details.
Technical details: the information needed to keep you signed in and, if you turn them on, to send notifications to your device.

The website forgefitness.nl uses no cookies and no tracking or advertising tools.

3. Why we use it, and on what basis

To provide your coaching, run the app and stay in touch with you: this is needed to perform our agreement with you.
To use your health information to coach you safely: based on your explicit consent. You can withdraw it at any time, but we can’t coach you safely without it, so withdrawing means your coaching ends.
To handle payments and keep our accounts: needed for our agreement and required by Dutch tax law.
To send reminders and notifications in the app: part of the service. You can turn them off under Profile.

We never sell your data and never use it for advertising.

4. Who helps us

We use a small number of trusted services. They only process your data on our instructions and under data processing agreements.

Supabase: stores the app’s data and your photos, on servers in the EU.
Cloudflare: hosts the website and the app.
Stripe: processes payments and subscriptions.
Resend: sends emails such as your account invite and reminders.
GitHub: stores encrypted backups of the app’s data, which only Forge Fitness can unlock.
Open Food Facts: when you search for a food in the app, your search words are sent from your device to this open food database. No account details are sent.

Some of these companies are based outside the EU. Where data leaves the EU, it is protected by the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.

5. How long we keep it

Your coaching and health information: while you are a client, and up to 12 months after your coaching ends, so you can pick up where you left off if you return. You can ask us to delete it sooner.
Invoices and payment records: 7 years, as Dutch tax law requires.
Backups: replaced automatically and deleted within 30 days.

6. How we protect it

Your data is stored in the EU, sent over encrypted connections, and protected by access rules so that only you and your coach can see your information. Backups are encrypted.

7. Your rights

You have the right to see the data we hold about you, to correct it, to have it deleted, to limit or object to how we use it, to receive it in a portable format, and to withdraw your consent at any time. Email [email protected] and we will respond within one month.

If you’re not happy with how we handle your data, you can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

8. Changes to this policy

If we change this policy in a way that matters to you, we will let you know before the change applies.