Privacy Policy

1. Information we collect

Account information

When you create an account, we collect the email address and password you provide. Passwords are handled by our authentication provider, Supabase — we never see or store your password in plain text.

If you sign in with Google instead, Google shares your name, email address, and profile photo with us for your account.

Project content you create

Everything you put into a project: specs, bill-of-materials entries, Builder notes (your private build log), Showcase notes (the public write-up for a project you choose to share), uploaded photos, STL/GLB 3D model files, circuit and architecture diagrams, milestones, and tasks.

Information we receive automatically

Our hosting and infrastructure providers (see Section 3) log standard request information — such as IP address and timestamps — as an ordinary part of serving web requests and enforcing rate limits against abuse. We don't run analytics or advertising trackers of our own.

2. How we use this information

• To operate your account and projects — storing, displaying, and letting you edit your own data.
• To power the AI features — Ember (chat assistant), Cinder (firmware generation), Hearth (roadmap planning), and PDF/text import — all of which send relevant project data to our AI provider to generate a response. See Section 4.
• To send transactional email — collaboration invites, project-copy invites, and account deletion/recovery notices.
• To process Forge Pro subscription payments, if you choose to subscribe.
• To prevent abuse — rate limiting and fraud prevention.

We do not sell your data, and we do not use it for advertising.

3. Third parties that process your data

These are the outside services Forge.AVM actually uses, and what each one sees:

• Supabase — our backend provider. Handles account authentication, the application database (projects, specs, components, notes, and everything else listed in Section 1), and file storage for uploaded photos and 3D model files.
• Google — if you choose "Sign in with Google," Google authenticates you and shares your name, email, and profile photo with us, via Supabase's authentication system. Separately, our pages load typeface files from Google Fonts, which sees the requesting IP address the way any font or image host does.
• Anthropic — the company behind Claude, the AI model used by Ember, Cinder, Hearth, and the PDF/text import feature. When you use any of these, the relevant project data (which may include your BOM, specs, Builder notes, milestones, and your message) is sent to Anthropic's API to generate a response. Anthropic processes this under its own API terms, which govern how long it retains that data and whether it's used to improve Anthropic's models.
• Resend — our transactional email provider. Sends collaboration invites, project-copy invites, and account deletion/recovery emails on our behalf. Resend sees the recipient's email address and the email content (which includes the inviter's name and email, and the project name).
• Our own backend services — PDF text extraction and STL mesh analysis (the "Smith" feature) run on backend services we operate separately from the main app. A file you upload for either feature is sent to that service for processing.
• Stripe — if you subscribe to Forge Pro, Stripe processes the payment directly. We never see or store your full card number; Stripe shares with us only what's needed to manage your subscription (e.g. plan, status, billing dates).
• Vercel — our hosting provider. Serves the application and, like any host, has access to request-level data such as IP address as part of routine operation.

4. Ember and other AI features

Ember, Cinder, and Hearth are built on Anthropic's Claude API. Using them sends project context to Anthropic to generate a response — that's how the feature works; there's no way to use it without that data leaving our servers. Don't put passwords, API keys, private keys, or other credentials in any notes field — see the Terms of Service for more on this. AI-generated content (firmware code, roadmaps, extracted BOM/specs) can be wrong; review it before you rely on it.

5. Sharing is public by design

If you turn on Share for a project, anyone with that project's share link can view its Showcase notes, specs, BOM, photos, and 3D models. Builder notes are never part of the share page — only Showcase notes are public.

If you set a portfolio slug (e.g. forgeavm.com/yourname) and feature projects on it, that page and those projects are likewise visible to anyone who has or guesses the URL. Neither feature requires the viewer to have an account or be logged in. Turning either of these on is your choice, and turning them back off stops new visitors from viewing the page — it does not retroactively un-share copies already made or cached by a visitor's browser.

6. How long we keep your data

We keep your account and project data for as long as your account is active. If you delete your account (Settings → Delete Account), your account enters a 14-day recovery window — during this time you can cancel the deletion via the link emailed to you. After 14 days, your projects and everything in them (specs, components, notes, photos, STL files, milestones, tasks, collaborator records) are permanently deleted, along with your authentication record. This is irreversible once the window passes.

7. Cookies and local storage

We don't use advertising or tracking cookies. Your browser's local storage holds your session (so you stay signed in) and interface preferences — theme, font size, and whether you've seen onboarding prompts. If you subscribe to Forge Pro, Stripe's hosted checkout and billing pages may set their own cookies, governed by Stripe's own privacy practices, not ours.

8. Children

Forge.AVM is not directed at children, and we don't knowingly collect information from anyone under 13. If you believe a child has created an account, contact us at the address below and we'll remove it.

9. Changes to this policy

We may update this policy as the product changes. The effective date at the top will change when we do. Continuing to use Forge.AVM after an update means you accept the revised policy.

10. Contact

Questions about this policy, or requests to access or delete your data outside the normal account-deletion flow, can be sent to avmworks22@gmail.com.