Draft for review

Privacy policy

Effective: [date of publication]

This policy explains what personal data the Fora app and the website forafitness.app process, why, where it is stored, who it is shared with and what rights you have. We try to work only with the data the features need.

1. Who we are

The data controller is Fora Holding LLC (Georgian: შპს ფორა ჰოლდინგი), identification code 421286423, registered in Georgia on 16 October 2026. Legal address: Tskaltubo, Georgia.

For privacy matters: privacy@forafitness.app. For help: support@forafitness.app.

2. What data we process

We do not collect everything automatically. Much of the data appears only when you enter it or connect a service yourself.

Account: Email address, name, language and password. We store the password only in a one-way scrambled form (a hash), never in readable form.
Profile and body: Sex, year of birth, height, weight and its history, body measurements (waist, hips, chest, upper arm, thigh, neck).
Progress photos: Only photos taken with the in-app camera. You cannot pick a photo from your gallery. In the app, only you see your photos.
Training: Chosen programmes, workout logs (weight, reps), routines, personal records, and sharing links you create.
Food: Diary entries, calorie goal, your own foods, taste settings, meal plans.
Health and activity data: When you connect Apple Health or Health Connect yourself: steps, distance, sleep, heart rate, resting heart rate, active calories and workouts. The app only reads and never writes to Apple Health. Also workouts imported from files (FIT, TCX, GPX).
Strava: Only when you connect it: your Strava user identifier and name, and your activities. Access tokens are stored encrypted.
Community: After you join the club: display name and level, leaderboard results, confirmation videos, forum posts and replies, reactions, reports. Also direct messages (off by default) and chat with a trainer.
Level and goals: Level, points, daily activity, goals and a private rank. Only you see the rank.
Purchases and orders: We do not see your card or Apple account details: Apple processes the payment. We store a record that a purchase was activated. For a shop order we store name, phone, address, city, note, items and payment method (pay on delivery).
Technical data: IP address in server logs, statistics on time spent on screens (which screen and how many seconds), error reports and app update checks.

3. Why we process it and on what legal basis

We process data in line with the Law of Georgia on Personal Data Protection.

Performance of a contract: Your account, training and food features, activating purchases, delivering a shop order.
Your consent: Health-related data (weight, body measurements, sleep, heart rate, activity) and progress photos, connecting Apple Health, Health Connect and Strava, and joining the club. You give consent by turning a feature on and can withdraw it at any time by turning it off or deleting your account. Withdrawal does not affect processing that already took place.
Legitimate interest: Security, preventing abuse, finding and fixing errors, and statistics on screen use to improve the app.
Legal obligation: Keeping orders and financial records as tax and accounting rules require.

We do not sell your data and we do not use it for advertising or to track you.

5. Transfers outside Georgia

Some of the providers above process data outside Georgia and the European Union, for example in the United States. In that case we transfer data only on a basis the law of Georgia allows, with suitable safeguards, and only as much as the feature needs.

6. Where it is stored and how we protect it

Data is stored on servers located in Germany (netcup GmbH).
The connection between the app and the server is encrypted (HTTPS).
Passwords are stored as a hash and Strava access tokens are encrypted.
Progress photos are not shown to other members. They are tied to your account.
Access to data is limited to the people who need it for their work.

No internet service or storage is perfectly secure, but we aim for protection that matches the risk.

7. How long we keep it

We keep your account data for as long as you have an account. When you delete the account, the data is removed from the main database at once.
Data disappears from backup copies when those copies expire.
Shop orders are kept as financial records for as long as tax and accounting law requires.
Server logs are kept for a short period needed for security.
Error reports are kept by Sentry for its own retention period.

8. How to delete your account

In the app open Profile > Settings > Account > Delete account, tap Continue to delete, type the word DELETE, enter your password and confirm.

This removes: workouts, plans and history; measurements, weight, sleep and progress photos; your nutrition diary; leaderboard claims, videos and forum posts; chat history and trainer links; access for connected services (Strava) and your account.

It does not remove shop orders, which are kept as financial records. Deleting your account does not cancel an Apple subscription: cancel it first in your Apple settings.

If you can no longer sign in to the app, write to privacy@forafitness.app.

9. Your rights

You have the right to:

find out what data we process and get a copy (you can download your workout history as a CSV file from Settings);
ask us to correct or complete your data (you change your profile and measurements yourself in the app);
ask us to delete your data or stop processing it;
restrict processing or object to processing based on legitimate interest;
withdraw consent at any time;
ask for your data to be moved to another service where that is technically possible.

To use a right, write to privacy@forafitness.app. We answer without undue delay and within the time set by law. We may ask for extra information to confirm your identity.

10. Complaints

If you think we process your data in breach of the law, you have the right to complain to the Personal Data Protection Service of Georgia (pdps.ge) or to a court. We would be glad if you wrote to us first so we can solve it quickly.

11. Children

Fora is not intended for people under 16. If you learn that a child has created an account with us, write to us and we will delete it.

12. Changes

We may change this policy over time. We will tell you about material changes in the app or by email. The date of the current version is shown at the top of this page.

13. Contact

Fora Holding LLC (Georgian: შპს ფორა ჰოლდინგი), Tskaltubo, Georgia. Privacy: privacy@forafitness.app. Help: support@forafitness.app.