Privacy Policy

FORS is a strength-training app operated from New York State, USA. This policy explains what we collect, why, who else sees it, and what you can do about it. Questions, requests, or complaints: j@heady.fm.

The short version

We collect what the app needs to program your training and nothing for advertising. We do not run analytics, trackers, or advertising pixels of any kind. We have never sold or shared your data for money or for anyone else’s marketing, and we don’t plan to. You can export your lifting log and delete your account yourself, from inside the app, without asking us.

What we collect

Account. Your email address and password, handled by our authentication provider. Optionally a handle, display name, bio, and avatar. Your handle, display name, bio and avatar are public to anyone using FORS if you set them.

Body and health information. Bodyweight, and optionally sex, age, and height. Most importantly, any injuries or physical limitations you tell us about, such as a bad lower back or a cranky knee. We collect this for one reason: to program weights you can handle and to stop programming movements that would hurt you. In some jurisdictions this counts as health data and gets extra protection. We treat it that way.

Training. Your goal, experience, equipment, available days, session length, your plan, and every workout you log, including exercises, sets, reps, weights, how hard a set felt, and any notes you write. Strength test results. Badges and milestones.

Activities. Cross-training you log, such as runs, classes, or yoga, including anything you type into the location or studio fields.

Coach conversations. What you say to Spot. When Spot makes a lasting change to your program, we also keep a record of the request you made, so the change can be explained and undone.

Photos. Any workout photo or avatar you upload. Photos are resized in your browser before upload, which strips embedded camera metadata such as GPS coordinates. Photos you share to the community are readable by anyone with the link, and they are deleted when you delete your account.

Personal details. If you fill them in: full name, phone number, and a billing address. These are optional, are not used for training, and sit behind a passcode you set. We do not verify your phone number.

Walking routes. If you map a walk, the route stays in your browser’s local storage. It is never uploaded to us. See the Mapbox note below, because your location does leave your device.

Waitlist. If you join the waitlist we store your email, which page you signed up from, the referring URL, and whether you ticked the marketing box.

What we don’t do

No analytics. No Google Analytics, no Vercel Analytics, no PostHog, no Sentry, no session recording, no heatmaps. No advertising pixels, no Meta pixel, no ad networks, no retargeting. No selling your data, and no sharing it for cross-context behavioural advertising. We do not profile you for anything other than writing your training program.

Cookies

We set two, both strictly necessary, and neither is used for tracking. One keeps you signed in. The other, before public launch, remembers that you entered a valid invite password. It contains a signed expiry date and nothing about you, and it lasts 90 days. We do not use advertising or analytics cookies, which is why you have not been shown a cookie banner.

Who else sees your data

We use a small number of providers. We do not sell your data to any of them.

Supabase. Hosts our database, authentication, and photo storage. They hold everything listed above.

Anthropic, via Vercel AI Gateway. Powers Spot, the onboarding consultation, and program import. What gets sent: your conversation, your bodyweight, your sex if you chose to disclose it, your recent training and estimated strength, and any injuries you describe. Because these are open conversations, anything you type reaches Anthropic, so please don’t type anything you wouldn’t want processed. If you import a program by uploading a photo or PDF, that file is sent too, including anything else visible in it. We do not send your name, email, phone, age, height, or billing address.

Mapbox. Powers walking route maps. This is the one place your precise location leaves your device. Your browser sends your coordinates directly to Mapbox to draw a route, and Mapbox sees your IP address. This happens only if you use the walk route map.

YMove. Hosts exercise demo videos. Your browser loads video files directly from them, so they see your IP address and which exercise you are viewing. They receive nothing else and no account information.

FitnessVolt. Provides the strength standards used to rank your lifts. We send your bodyweight, sex, the lift, and your estimated one-rep max, through our own server so your IP address is not exposed. No name, email, or account identifier is attached.

Adobe Typekit. Serves our fonts. Your browser requests them from Adobe on every page, so Adobe receives your IP address and browser details.

Vercel. Hosts the app and keeps standard server logs, which include IP addresses.

Payments

We do not process payments yet and no payment data has ever been collected. When billing goes live, card details will be handled entirely by our payment processor and will never touch our servers. This policy will be updated before that happens.

Your choices

Export. From your Record you can download your lifting log as a spreadsheet, Markdown, or plain text, any time, without asking us. That export covers your lifting history. For a complete copy of everything else we hold, email us and we will put it together by hand.

Delete. Account management, in your account settings, deletes your account and everything described above, including any photos you uploaded.

Reset. Clears your training history and starts you fresh while keeping your login.

Correct. Personal details are editable in the app. Changing your email requires confirming the new address.

Marketing email. Only if you ticked the box, and you can withdraw at any time at /unsubscribe, or from the link in any email we send. We keep a record of when you opted in and when you opted out, because we have to be able to show consent was genuine. Depending on where you live, you may also have rights to access, correct, delete, port, or object to our use of your data, and to complain to your data protection authority. Email us and we will action it.

How long we keep things

Until you delete them. We do not currently expire or auto-purge training data, and we would rather say so than imply a retention schedule we do not run. Waitlist emails are kept until launch or until you ask us to remove you.

Security

Your data is protected by row-level security, so one account cannot read another’s. Your personal details sit behind a passcode stored only as a bcrypt hash, which we cannot read. Traffic is encrypted in transit.

Children

FORS is not intended for anyone under 16, and we ask that you don’t use it or give us your information if you are under 16. If you believe a child has given us data, email us and we will delete it.

Not medical advice

FORS is a coach, not a doctor. We use the injury information you give us to avoid programming movements that could hurt you, but nothing in the app is medical advice or a diagnosis. If something hurts, please see a professional.

Changes

If we change this policy materially, we will update the date above and, where the change matters to you, tell you in the app.

Contact

FORS, New York State, USA. j@heady.fm. We answer privacy requests within 30 days.