Privacy Policy
Effective date: October 23, 2026 · Last updated: October 23, 2026 · Terms of Service
Before the legal language
Your check-ins and Vault entries are encrypted before they leave your device and are stored in your own private cloud account (iCloud on iPhone, Google Drive on Android), not on our servers. We hold no keys and cannot read them. Your identity statement is never sent to our servers in any form; it lives on your device and, in encrypted form, in your own cloud account. We bundle no analytics or crash-reporting tools, show no ads, and do not track you across other apps. One honest limit: on Android, the key for your encrypted backup lives only on your phone, so a backup cannot be restored after you uninstall FORGE or change phones (see Section 3.7). This policy is the complete, precise version of these statements.
1. Who operates FORGE
FORGE is developed and published by Mahato, an individual based in Jamshedpur, Jharkhand, India, operating under the name HomoLLabs. Throughout this Privacy Policy, “HomoLLabs,” “we,” “us,” and “our” refer to Mahato operating under this name. HomoLLabs is not, at this time, a separately incorporated legal entity.
This Privacy Policy applies to all users of FORGE worldwide, wherever you are located.
Contact: support@homollabs.org
2. What we collect — summary
| Category | What it is | Where it lives | Who can read it |
|---|---|---|---|
| Account identifier | Your Sign in with Apple or Sign in with Google identity | Apple or Google. On Android, also an authentication record in Google Firebase, a service HomoLLabs operates (see 4.3) | Apple or Google; on Android, HomoLLabs can see the account identifier held by Firebase |
| Check-in history | Not Yet / Half Forge / Full Forge entries | Your device, plus an encrypted backup in your private iCloud (iOS) or Google Drive app-data folder (Android) | Not HomoLLabs |
| Identity statement | Your self-written statement | Your device, plus an encrypted backup in your private iCloud (iOS) or Google Drive app-data folder (Android). May sync directly to a watch you own | Not HomoLLabs — never transmitted to our servers |
| Vault entries | Text, voice transcripts, and numeric entries | Your device, plus an encrypted backup in your private iCloud (iOS) or Google Drive app-data folder (Android) | Not HomoLLabs |
| Voice audio | Streamed for on-device transcription only, never saved as a file | Your device only (iPhone; Android 13+ with on-device speech support) | No one — not recorded to disk, not transmitted |
| Subscription status | Active/inactive, tier | RevenueCat | RevenueCat and HomoLLabs (status only) |
| Payment details | Card numbers, billing address | Apple App Store / Google Play | Apple or Google only |
| Partner and Circle status | Your numeric Momentum value, a timestamp, and for Circles, the circle name and member partner codes, filed under a short random code | On Android: Google Firebase (Firestore), operated by HomoLLabs. On iPhone: Apple CloudKit Public Database (see 3.5) | Anyone who has your code; HomoLLabs (see 3.5) |
| Analytics and crash reporting | None | Not applicable — no such tools are bundled | Not applicable |
3. Information you provide directly
3.1 Account information
We receive a unique identifier from Sign in with Apple or Sign in with Google. We never receive your Apple or Google password.
3.2 Your identity statement
The statement you write during onboarding is stored on your device. It is never transmitted to HomoLLabs servers in any form. On iPhone it is also saved to your private iCloud account using Apple’s encrypted CloudKit fields. On Android it is included in the encrypted backup archive described in Section 3.7. If you use FORGE with a paired Apple Watch or Wear OS device, it may sync directly between devices you own over a local device-to-device connection that does not pass through any server we operate.
3.3 Your check-in history
Your behavioral history is append-only: we never modify or delete it on your behalf. It is stored on your device and backed up in encrypted form to your private cloud account (iCloud on iPhone, Google Drive on Android). HomoLLabs cannot read this history, because it never reaches us in a readable form.
3.4 Vault entries and voice input
Vault text and numeric entries are stored on your device and backed up in encrypted form, as above. Voice input is streamed to your device’s own speech recognizer; no audio file is created, saved, or transmitted by FORGE. Only the resulting text, which you can review and discard, is kept. On iPhone, FORGE requires on-device recognition. On Android, voice input is available only on Android 13 or later with on-device speech recognition installed; on other Android devices the microphone option is not shown and you can type instead. FORGE asks for microphone permission only when you choose to dictate.
3.5 Forge Partner and Forge Circles
If you connect with a Forge Partner or join a Forge Circle, FORGE publishes your numeric Momentum value and a timestamp. For Forge Circles, the circle name and member partner codes are also stored. On Android, these records are stored in Google Firebase (Firestore) under a short random code, not under your name or account. On iPhone, they are stored in Apple CloudKit’s public database. Anyone who has your code can read that record. Share it only with people you choose. HomoLLabs can also see these records on Firebase. They contain no name, email, identity statement, check-in answers, or Vault content, and none of those things are ever sent to a partner or Circle member. We use these records only to relay the value between devices. To have yours deleted, email us at the address above.
3.6 Android Accessibility Service (the Gatekeeper)
The Gatekeeper is optional and Android only. If you turn it on in Android Settings, FORGE uses Android’s Accessibility Service API for one purpose: to notice when an app you have chosen is opened, so FORGE can place a pause in front of it. To do this it receives the name of the app (its package name) that has just come to the foreground. This happens on your device. FORGE does not read the content of your screen, what you type, or your passwords; the service is configured so that it cannot retrieve window content. App names are used immediately and are not stored beyond the list of apps you selected, and are not sent to us or anyone else. You can turn the Gatekeeper off at any time in Android Settings → Accessibility.
3.7 Backups and changing devices
iPhone: check-ins, Vault entries, and your identity statement are saved to your private iCloud account using Apple’s encrypted CloudKit fields, and can be restored when you sign in to the same iCloud account on a new iPhone.
Android: FORGE can back up your check-ins, Vault entries, and identity statement to the private app-data folder of your Google Drive. The archive is encrypted on your phone before it is uploaded, with a key stored in Android’s hardware-backed key store. That key never leaves your phone and we do not have it. Because the key is deleted when you uninstall FORGE, a backup cannot be restored after you uninstall the app or move to a new phone. If you need to carry your record to a new phone, use the in-app export feature before you switch.
4. Information collected automatically and service providers
4.1 No analytics or crash-reporting tools. FORGE does not bundle or use third-party analytics, behavioral tracking, advertising, or crash-reporting tools. No usage events, session recordings, or crash reports are sent to us or to any third party. Any diagnostic logs stay on your device.
4.2 Subscriptions (RevenueCat). RevenueCat, a subscription-management service, receives an app user identifier (which may be linked to your sign-in) and your purchase and subscription status from Apple or Google so that your access can be unlocked. RevenueCat never receives your payment card details, which Apple or Google handle.
4.3 Google Firebase. HomoLLabs uses Google Firebase for two things: (a) on Android, authentication, which holds the account identifier and email address that Google shares when you sign in; and (b) the Partner and Circle status records described in Section 3.5. Firebase is operated by Google and the project is controlled by HomoLLabs. Firebase is not used to store your check-ins, identity statement, or Vault entries.
4.4 Apple and Google. Apple (iCloud, App Store) and Google (Drive, Play) process your data under their own terms when you use their services through FORGE.
5. What we do not do
- Sell, rent, or license your data to anyone, for any purpose
- Show you advertisements or allow advertisers to target you
- Track your activity across other apps or websites
- Use your behavioral data, identity statement, or Vault content to train any machine learning model
- Share your check-in history or Vault content with anyone, or your Momentum value beyond what Section 3.5 describes
- Read your check-in history or Vault entries — they are encrypted before they leave your device and we do not hold the keys
- Read your identity statement — because it is never sent to us
6. How long we keep information
| Data type | Retention |
|---|---|
| Check-in history, Vault entries, identity statement | On your device while FORGE is installed; in your iCloud or Google Drive backup until you delete your data or that backup |
| Voice audio | Never stored; exists only momentarily during transcription |
| Partner and Circle status records | Until you ask us to delete them, or until we remove inactive records |
| Firebase authentication record (Android) | Until you delete your account or ask us to |
| Analytics and crash data | None collected |
| Subscription records (RevenueCat) | Per RevenueCat’s own retention policy |
7. International data transfers
FORGE is used worldwide. Your backups are stored in Apple’s iCloud or Google’s cloud, which may hold data in regions outside your country. Because your check-ins and Vault entries are encrypted before leaving your device, the storage provider cannot read them either. Partner and Circle status records and Android authentication records are stored in Google Firebase, which may process data in the United States and other regions.
If you are in the European Economic Area, United Kingdom, or Switzerland, transfers of personal data outside those regions rely on mechanisms recognised by applicable law, such as Standard Contractual Clauses, where required. Contact us for more detail.
8. Your rights — wherever you are
Regardless of your location, you have the right to:
- Access a copy of your data, exportable as a document from within the app
- Correct your identity statement, your Full Forge and Half Forge definitions, and your account settings at any time
- Delete your data at any time, from within the app, and ask us to delete any record we hold (Partner and Circle status, Android authentication record)
- Withdraw consent for any optional feature (such as voice input or the Gatekeeper) at any time, without affecting the rest of the service
About your check-in history: while your account is active, individual check-in entries cannot be edited or deleted. This is intentional; it is what makes your record honest. You can delete your whole account and history at once.
To make a request, email support-forge@homollabs.org. We will respond within 30 days.
9. Region-specific rights
9.1 European Economic Area, United Kingdom, and Switzerland (GDPR / UK GDPR)
Legal basis. We process account and subscription data because it is necessary to provide the service you asked for (contract). We process optional features, such as voice input and the Gatekeeper, on the basis of your consent, which you can withdraw at any time. We process Partner and Circle status records to provide the feature you chose to use.
Your rights include access, rectification, erasure, restriction of processing, data portability, and the right to object. You may lodge a complaint with your local data protection authority.
Representative. HomoLLabs does not currently have an appointed representative in the EEA or UK. If our user base there reaches a scale that requires one, we will appoint one and update this policy. Until then, contact us directly.
9.2 California and the United States (CCPA / CPRA)
If you are a California resident, you have the right to know what personal information is collected, to request its deletion, and to opt out of the sale or sharing of personal information. We do not sell or share your personal information as those terms are defined under the CCPA/CPRA. You may still contact us at any time to confirm this or exercise any other right.
9.3 India (Digital Personal Data Protection Act, 2023)
For users in India, HomoLLabs acts as a Data Fiduciary under the DPDP Act, 2023, and commits to:
- Processing your personal data only for the purpose you consented to
- Letting you access, correct, and erase your personal data
- Letting you withdraw consent at any time, as easily as you gave it
- Notifying you and the Data Protection Board of India of a personal data breach, as the Act requires
- Keeping reasonable security safeguards against a personal data breach
Grievance Officer: Mahato, support-forge@homollabs.org.
9.4 All other jurisdictions
The rights in Section 8 apply to you in full. If your local law gives you additional rights, we will honor them on request.
10. Children’s privacy
FORGE is for adults. You must be at least 18 to use it. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it.
11. Security
Check-ins, Vault entries, and the identity statement’s backup are encrypted on your device before upload (Apple’s encrypted CloudKit fields on iPhone; AES-256-GCM with a hardware-backed key on Android). HomoLLabs does not hold the keys and cannot read this content, including in response to a request directed at us, a court order, or a breach of our own systems, because it never exists on our systems in readable form.
On your device, this content is protected by your device’s own security (such as iOS Data Protection or Android file-based encryption and your screen lock). If someone unlocks or compromises your device, they may be able to see what the app shows on it.
Partner and Circle status records are not encrypted against us and are readable by anyone with your code. We limit what they contain to a number and a timestamp for this reason.
Data in transit to our services uses TLS. No system is perfectly secure. If we become aware of a security incident affecting your data, we will notify you and the relevant authorities as the law requires.
12. If HomoLLabs ceases operations
If HomoLLabs discontinues FORGE, we commit to notify users in advance, give you a window to export your complete data, and not sell or transfer user data to any third party as part of discontinuation.
This is a personal commitment by Mahato. It is not currently backed by an escrow arrangement, a third-party enforcement mechanism, or a corporate governance structure, because none exists at this time. If one is established, this policy will be updated.
13. Changes to this policy
We will notify you in the app before any material change to this policy takes effect. If you keep using FORGE after that notice, the updated policy applies to you.
14. Contact
Mahato, operating as HomoLLabs
Jamshedpur, Jharkhand, India
support@homollabs.org