Privacy Policy

ForgeStudio FX Team ("we", "us", the "Company") operates the ForgeSignal mobile application ("App") and the website at signal.forgestudiofx.com. This Privacy Policy explains what personal information we collect, how we use it, with whom we share it, and the rights you have over your data.

1. Data Controller

2. Information We Collect

2.1 Information you provide

• Account data — email address, display name, password hash (never the plaintext password), preferred language
• Strategy data — the rules, indicators, parameters, and notes that make up the trading strategies you create
• Backtest and signal history — results of strategies you run, including timestamps, entry/exit prices, P&L
• AI Coach messages — the questions and replies in your Coach conversation
• Support correspondence — emails you send us, including any attachments

2.2 Information collected automatically

• Device and diagnostics — device model, operating system version, app version, crash logs, performance metrics
• App interactions — anonymous events (screen views, button taps) used to understand which features need improvement
• Push notification tokens — anonymous device identifiers from Firebase Cloud Messaging to deliver signal alerts
• Purchase tokens — Google Play subscription receipts (handled by RevenueCat) to validate Pro entitlement
• Anonymous advertising ID — used only when you choose to watch a rewarded ad to unlock a feature

2.3 What we do NOT collect

3. How We Use Your Information

• Provide the service — run your strategies, deliver signals, store your data so it's available when you log in from another device
• Improve the product — analyze aggregated, anonymized usage data to fix bugs and prioritize features
• Communicate — send transactional emails (password reset, payment receipts) and, only if you opt in, occasional product updates
• AI Coach replies — pass your question and relevant strategy context to Anthropic Claude to generate an answer
• Security and abuse prevention — detect fraud, account takeover, and policy violations
• Legal compliance — respond to lawful requests from authorities

4. Legal Basis for Processing (EU/UK users — GDPR)

• Contract — to provide the service you signed up for
• Legitimate interest — to secure the platform, prevent fraud, and improve features
• Consent — for optional marketing emails, ad personalization, or AI Coach feature
• Legal obligation — to retain financial records for the duration required by applicable tax law

5. Who We Share Data With

We do not sell your personal data. We share it only with the service providers below, under data-processing agreements that limit their use to providing the service to us:

6. International Data Transfers

Your data is processed in the United States and Singapore (depending on the service provider). For EU/UK users, transfers rely on the EU Commission Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum. You may request a copy of our SCCs by writing to privacy@forgestudiofx.com.

7. Data Retention

• Account and strategy data — kept as long as your account is active. Deleted within 30 days of account deletion.
• Backtest results — same as account data.
• AI Coach conversations — kept 90 days, then deleted.
• Diagnostic logs — kept 30 days, then anonymized or deleted.
• Tax/billing records — kept up to 10 years as required by Vietnamese tax law, even after account deletion.

8. Your Rights

You have the following rights regardless of where you live. EU/UK users have these rights under the GDPR; California users under the CCPA; Singapore users under the PDPA.

• Access — request a copy of all data we hold about you
• Rectification — fix inaccurate data
• Deletion — delete your account and personal data (Settings → Account → Delete Account in the app, or email us)
• Portability — receive your data in a machine-readable JSON export
• Restriction — restrict processing while we resolve a dispute
• Objection — object to legitimate-interest processing
• Opt-out — opt out of ad personalization and marketing emails
• Withdraw consent — withdraw any consent you previously gave
• Lodge complaint — file a complaint with your local data protection authority (EU/UK)

We respond to verified requests within 30 days. There is no fee for a reasonable request.

9. Children

ForgeSignal is intended for users aged 18 and over. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, contact privacy@forgestudiofx.com and we will delete it.

10. Security

All traffic between the app and our servers is encrypted with TLS 1.3. Data at rest in Supabase is encrypted with AES-256. Authentication is handled by Supabase Auth with industry-standard practices (password hashing, session expiry). We never log passwords, payment data, or one-time codes.

No system is 100% secure. If you discover a vulnerability, please email security@forgestudiofx.com.

11. Cookies and Tracking

The mobile app does not use cookies. The website (signal.forgestudiofx.com) uses only essential cookies for security (CSRF token) and does not run analytics or advertising trackers.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified to active users by email and via an in-app notice at least 14 days before they take effect.

13. Contact