Your body's data.
Your call.

Who we are

FORJD is run by Mostafa Ashraf, an individual based in Egypt. Questions about your data, and any request in "Your rights" below, go to[email protected].

What we collect

• Your account: email address, a password (stored only as a one-way hash, never readable), username, and the profile details you add: name, date of birth (you must be at least 16), sex, height, units, goals, city and a profile photo.
• Training: the workouts, sets, runs, programs and templates you log, and the exercises you create or favourite.
• Runs: distance, moving time, elevation gain and kilometre splits. Heart rate and calories for a run are stored only if you gave health-data consent.
• Health readings you connect: sleep, heart rate variability, resting heart rate, steps, active energy, weight and similar, from Apple Health, Health Connect or WHOOP, only after you give permission on your phone and in FORJD.
• Body composition: the InBody results you add, and the scan photo if you add one.
• Nutrition: the foods, meals, saved meals and macro goals you log.
• Location: your city as text. If you turn on "location for leaderboards", the phone reads your approximate position once when a workout starts; we turn it into a city and do not store the position.
• Notifications: if you leave PR or leaderboard notifications on, a push token (a code that identifies FORJD on your phone), your phone's platform (Android or iPhone), and the short text of each notification we queue for you.
• Your settings and consents: privacy choices, notification switches and quiet hours, your time zone, and a record of sign-ins and consent changes.
• Crash reports: if you leave "crash diagnostics" on, our server sends an error report when it fails. It contains technical details of the failure, never your content.
• On the website: if you join the waitlist, your email address.

How we use it

To run the features you see: your history and charts, your readiness score, FORJD Insights, Weekly Forge, the notifications you chose and, if you opt in, your place on your city's leaderboard. Each health reading is stored with the app or device it came from, so you can always see where a number originated. We do not use your data to build profiles for advertising, and we do not sell it.

If you join the waitlist on our website, we use your email address only to tell you when FORJD launches. We do not add it to any other list or sell it.

Location and your run route

• Run route: while a run is open, the app reads your precise position, including with the screen off (Android shows an ongoing notification while it does). The route stays on your phone and is never uploaded. FORJD never reads your location in the background when no run is open.
• Leaderboard city: only the city is kept, as described above.
• Public by design: if you join leaderboards, other athletes in your city can see your rank and score, and your name, username and photo only if you made your profile public.

Who else receives your data

We use a small number of companies to run FORJD. Each gets only what it needs, and acts on our behalf. We name a company only where you or the app stores would expect it; infrastructure providers are described by what they do.

• Our database, sign-in and file hosting provider: your account, the data above and your photos. Always.
• Our server hosting provider: the requests the app makes to our server. Always.
• OpenAI: your InBody scan photo, to read the numbers off it. Only after you give AI consent, which you can withdraw.
• WHOOP: sign-in details for the connection; we read your WHOOP recovery, sleep and workouts. Only if you connect WHOOP.
• Google or Apple sign-in: your Google or Apple account identity. Only if you choose that sign-in; we never receive your password.
• Expo, then Google (Android) or Apple (iPhone): your push token, platform and the notification text. Only if PR or leaderboard notifications are on.
• Our crash-reporting provider: technical failure details, no text. Not sent at all if you turned crash diagnostics off.
• Cloudflare: the bot check on the website waitlist form. Only on the website.

Notifications

Reminders, such as your workout reminder and weekly summary, are made on your phone and never leave it. PR and leaderboard notifications come from our servers; they are on by default and you can switch each off in Profile, then Notifications. A notification names an exercise or a city and never contains a weight, a time or any health reading. It travels through Expo's push service and then Google's or Apple's service to reach your phone.

Finished notifications are deleted from our servers after 30 days. Your push token is removed when you sign out, when you turn both notifications off, and when you delete your account. If your phone is offline when you sign out, the removal can be delayed.

What we never do

Data read from Apple Health and Health Connect is used only to provide FORJD's health and fitness features, as both platforms require.

How long we keep it, and keeping it safe

• We keep your data until you delete your account. Notifications are deleted 30 days after they finish. Your run route is never on our servers.
• After you delete your account, copies in our hosting provider's backups are removed as those backups expire in the ordinary course.
• Waitlist email addresses are deleted once the launch email has been sent. To be removed sooner, email [email protected] and we will delete yours.
• Traffic between the app and our server is encrypted. Passwords are stored as one-way hashes, and sign-in credentials for services you connect are encrypted.
• No system is perfectly secure. If a breach affects you, we will tell you, as the law requires.

Where your data is stored

Our server, database and file storage are located in the European Union. Some companies listed above process data in other countries, including the United States, under their own safeguards.

Our legal basis

Where the law asks for one, for example in the UK and EU: we process your account, training and nutrition data to provide the service you asked for (contract). We process health data, location for leaderboards, AI scan reading and push notifications only with your consent, which you can withdraw in the app at any time. We keep sign-in and consent records to protect the service and meet our obligations (legitimate interest).

Your rights and controls

• Export: download a copy of your account data from the app.
• Delete: delete your account and its data from the app. Deletion is real, not hiding. A few records of sign-ins keep no link to you afterwards.
• Correct: edit your profile and logs in the app.
• Disconnect: revoke Apple Health, Health Connect or WHOOP access at any time.
• Consents and visibility: health data, AI scan reading, location for leaderboards, leaderboards and your public profile each have a switch in privacy settings.
• Notifications: switch PR and leaderboard notifications on or off at any time in Profile, then Notifications.
• Ask us: email [email protected] to access, correct, delete, restrict or move your data, or to object to a use. We answer within 30 days. You can also complain to the data protection authority where you live (in Egypt, the Personal Data Protection Center).

Children

FORJD is for people aged 16 and over. We ask for your date of birth when you sign up and don't create accounts for younger people. If you think a younger person has an account, email us and we will delete it.

The website

This website sets no cookies and uses no analytics or advertising tools. The waitlist form uses a bot check from Cloudflare (Turnstile) so that only people can join. If that ever changes, this page changes first.

Changes to this policy

We will update this page when what we do with data changes, and change the "last updated" date. For a change that matters to you, we will tell you in the app or by email before it starts.

Data sources

City names and locations come from GeoNames (geonames.org), used under the Creative Commons Attribution 4.0 licence.