Privacy Notice

This Privacy Notice explains how xlc fitness ("we", "us", "our"), the operator of the Forge AI service, collects, uses, and protects personal data. xlc fitness is the data controller for the personal data described in this notice. References to "Forge AI" mean the Service operated by xlc fitness.

We collect the following categories of personal data:

• Account data — name, email address, and login credentials (including authentication via email/password or Google sign-in).
• Health and fitness data — sex, age, height, weight, activity level, fitness goals, workout logs (exercises, sets, reps, weight lifted, duration, calories burned), nutrition logs (meals, calories, macros), calorie targets, and any dietary restrictions or injury notes you provide. Because this can reveal information about your health, it is treated as sensitive personal data.
• Health import data — data you choose to upload from Apple Health export files or Google Fit activity exports, including workout records and calories burned. We only process the data contained in files you voluntarily upload, and we delete the uploaded file after import.
• Support and communications — messages you send us, including support requests.
• Technical and usage data — device and browser information, IP address, and usage/telemetry data such as pages visited and features used, collected through cookies and similar technologies.
• Payment data — collected and processed by our Merchant of Record, Paddle, which handles card details, billing addresses, and transaction history. We do not store your full card details.

We use personal data for the following purposes:

• Account creation, authentication, and providing the Service — including calculating your BMI, calorie and macro targets, and generating personalized workout plans, meal plans, and recipes;
• Storing and displaying your workout and nutrition logs, and computing progress trends and goals;
• Processing your health imports so imported workouts and calories sync into your dashboard;
• Delivering AI coaching feedback based on your logged data;
• Security and fraud prevention, including protecting accounts and detecting abuse;
• Product improvement, analytics, and troubleshooting;
• Customer support;
• Communicating with you about your account, subscription, and important service updates (we do not send marketing communications without your consent).

We process personal data on the following legal bases:

• Contract performance — to provide the Service you have signed up for;
• Legitimate interests — security, fraud prevention, product improvement, and analytics;
• Consent — for the processing of your health and fitness data and for any optional marketing or cookies where required. You may withdraw consent at any time;
• Legal obligation — where we must process data to comply with law.

To generate your workout plans, meal plans, recipes, and coaching feedback, the information you provide (including your profile, goals, dietary restrictions, and logged workouts) is sent to third-party AI providers we use to power the Service. These providers process the data solely to generate the content you requested. We do not use your data to train our AI providers' models, and your personal data is not sold to third parties.

We share personal data with the following categories of recipients:

• Service providers — hosting and database providers, AI model providers, and analytics tooling that help us operate and improve the Service;
• Merchant of Record (Paddle) — for the sale of Forge Pro subscriptions, subscription management, payment processing, tax compliance, and invoicing. Paddle processes your payment data under its own privacy terms;
• Professional advisers — legal, accounting, or other professional advisers where necessary;
• Authorities — where required by law, court order, or to protect our rights or the safety of users.

We do not sell your personal data. Where third parties process data on our behalf, they do so under contractual obligations of confidentiality and security.

We keep your account, health, and fitness data for as long as your account is active, so you can review your history and progress. When you close your account, or when data is no longer needed, it is deleted or anonymized within a reasonable period, unless we are required to retain it by law (for example, for tax or accounting purposes). You can delete individual workout or nutrition log entries at any time from the app.

We apply appropriate technical and organizational measures to protect personal data, including encryption in transit, access controls, and secure authentication. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We use essential cookies to keep you signed in and to operate the Service. Where analytics or marketing cookies are used, they are only set with your consent, and you can manage or withdraw your preferences through your browser settings. Payment-related cookies are managed by Paddle on its checkout pages.

Depending on where you live, you may have the right to access, correct, delete, restrict, or port your personal data, to object to processing, and to withdraw consent. You can exercise most of these rights directly from your account, or by contacting us using the details below. We will respond within one month of a valid request.

UK and EEA users: under the UK GDPR and EU GDPR you additionally have the right to lodge a complaint with your local supervisory authority. You can exercise rights of access, rectification, erasure, restriction, portability, and objection, and withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

Your data may be processed outside your country of residence, including by our hosting, AI, and payment providers. Where data is transferred outside the UK or EEA, we rely on appropriate safeguards such as the European Commission's or UK Secretary of State's standard contractual clauses or an adequacy decision.

If you have questions about this Privacy Notice or wish to exercise your rights, contact us through the Forge AI app or at the contact details published on our site. We will respond to your request promptly.