Privacy

Who is responsible

forgestead
privacy@forgestead.tech

What we store

• Your account: your name, email address, profile picture link and Google account id, which Google gives us when you sign in. Forgestead has no password for you and doesn't keep Google's sign-in tokens.
• Your profile and preferences: display name, a short bio if you write one, where you're starting from, your time zone, theme, editor settings and whether you prefer reduced motion.
• Your learning: the projects you start, which lessons you've opened and finished, the code you save in the website's editor, your test runs and their results, your answers to decision exercises and module checks, milestone snapshots of your code, and the skills those show.
• Desktop sign-ins: each device's name, when it was connected and last used. Its key is stored only as a hash.
• Your Anthropic API key, if you add one for the mentor: stored encrypted, used only to send your own questions, and never shown again. Removing it, or deleting your account, deletes it.
• Mentor use: for each question, the lesson, the kind of help asked for, the model that answered, and what it cost. Not your question, and not the answer.
• Abuse limits: counters of attempts, keyed by your account or your IP address. They're deleted within three days.

We don't use analytics, advertising or tracking of any kind, and we don't sell or share your data for marketing.

The desktop app also keeps a copy of your lessons and progress on your computer so it works offline, and its key in your system's keychain. Signing out removes them.

Why

To provide the service you signed up for: your account, your progress and your code (the contract between us). To keep it safe: limits on attempts, and hashed keys (our legitimate interest in security). We don't send you email: there is no newsletter and no marketing.

Who else sees it

• Vercel Inc. (United States) runs the website. The server code runs in Frankfurt, and pages reach you through Vercel's worldwide network. It handles what passes through, including your IP address, and keeps technical logs for a short time.
• Supabase Pte. Ltd. (Singapore) holds the database and stored files, in Frankfurt, under a data processing agreement.
• Anthropic, only when you ask the mentor something: the lesson, your files for that lesson, your last test run and your question are sent to Anthropic's API to answer it, with your own API key, so Anthropic bills your account. The panel says what's sent before you ask. Anthropic is in the United States.
• Google, when you sign in: it tells us your name and email address, and that it has verified that address.

Fonts are served by Forgestead itself; your browser doesn't contact Google or any other third party to load a page.

When data leaves Europe

Some of these companies, or the companies working for them, are outside the European Economic Area. Vercel lists itself as certified under the EU-US Data Privacy Framework. Supabase's agreement uses the European Commission's standard contractual clauses. Google receives your details when you choose to sign in, and Anthropic only when you ask the mentor something, because the service you asked for needs it.

How long

Until you delete your account, then it's gone at once, with one exception: if a mentor answer was saved because another learner might ask the identical question, it stays for up to 30 days. Those saved answers aren't linked to you. Desktop keys stop working after 90 days without use. Accounts aren't removed for being inactive.

Your rights

You can see and correct your profile on your profile page. From the same page you can download everything we store about you as one file, or delete your account and all of it, without asking anyone. You can also ask us to limit how your data is used, or object to it, by writing to the contact address above. Nothing here is decided about you automatically in a way that has legal or similar effects. If you think we've got it wrong, you can complain to your data protection authority.

Age

Forgestead is for people aged 16 and over. If you're younger, please don't make an account.

Cookies

A cookie keeps you signed in, and a second remembers where to take you after signing in. Signing in with Google adds two short-lived ones. There are no others, and none before you sign in. The cookie page lists them.