Skip to main content

    Privacy Policy

    Your privacy matters. Here is exactly how we handle your data.

    Last updated: 7 July 2026

    TL;DR

    • Most tools run entirely in your browser. Your files and data stay on your device.
    • We collect minimal data: contact form submissions and analytics if you consent.
    • CalmBack is designed to be local-first. We do not operate a separate iForge Apps user database for CalmBack accounts.
    • If CalmBack uses Sign in with Apple, Apple handles the sign-in flow. We do not require a separate iForge username or password.
    • We never sell your data for money.
    • Analytics cookies are only loaded after you give explicit consent.
    • Advertising cookies are only used if advertising is enabled and consent rules are met.
    • You can reach us via the contact form to exercise your data rights.

    Data Controller

    For the purposes of GDPR, UK GDPR, and other applicable data protection laws, the data controller is:

    IFORGEAPPS LTD

    (trading as iForge Apps)

    Company number: 17160532 (England and Wales)

    Contact: contact form

    Information We Collect

    We collect very little. Here is what we may receive:

    • Contact and feedback form submissions, name (if provided), email (if provided), and your message
    • Feature suggestions, title, category, description, and email (if provided)
    • Apple app information, limited TestFlight, App Store, crash, diagnostic, and support information that Apple makes available to developers for testing and support
    • Analytics data, page views, referrers, and general usage patterns, only if you consent via our cookie banner
    • Advertising data, limited ad request and cookie information if Google AdSense is enabled and consent rules are met

    Most tools run entirely in your browser. Files you process (PDFs, images, etc.) are not uploaded to our servers.

    Mobile Apps and CalmBack

    CalmBack is planned as an iOS app distributed through Apple TestFlight and, if approved, the App Store.

    No separate iForge user database: We do not currently operate a separate server-side user database for CalmBack accounts. CalmBack is designed around data minimisation and local-first use.

    Sign in with Apple: If CalmBack uses Sign in with Apple, Apple handles the sign-in flow. We do not ask you to create a separate iForge username or password. Apple may provide limited sign-in information, such as an Apple-provided user identifier or relay email address, where needed for authentication or support.

    On-device app content: Heart Check-In entries, reflections, favourites, app settings, calm preferences, and similar personal app activity are intended to stay on your device unless a future feature clearly asks you to enable sync, backup, sharing, or support export.

    TestFlight and App Store: Apple may make beta tester information, crash reports, diagnostics, screenshots, written feedback, install metrics, and support-related information available to us through App Store Connect. We use that information to test, debug, support, and improve the app.

    No tracking ads in CalmBack: CalmBack is not designed around third-party advertising profiles or cross-app tracking.

    Legal Basis for Processing (GDPR)

    • Consent (Article 6(1)(a)): For analytics cookies, advertising cookies, personalised advertising, and storing or accessing non-essential cookies where consent is required. You can withdraw consent at any time via the cookie banner or consent controls.
    • Legitimate interests (Article 6(1)(f)): For essential site functionality, security, fraud prevention, and processing feedback you choose to submit.
    • Legal obligation (Article 6(1)(c)): Where we must keep or disclose information to comply with applicable law, regulator requests, or court orders.

    Cookies and Tracking

    Analytics and advertising cookies are only loaded after the relevant consent rules are met via our cookie banner or consent management controls.

    CookieTypePurposeDuration
    iforge-cookie-consentEssentialStores your cookie consent preference1 year
    _gaAnalyticsGoogle Analytics, distinguishes users2 years
    _gidAnalyticsGoogle Analytics, distinguishes users24 hours
    __gadsAdvertisingGoogle AdSense, ad delivery, frequency capping, and reportingUp to 13 months, subject to Google settings
    __gpiAdvertisingGoogle AdSense, ad delivery, frequency capping, and reportingUp to 13 months, subject to Google settings
    IDEAdvertisingGoogle advertising, ad selection, measurement, and fraud preventionUp to 13 months, subject to Google settings

    Advertising

    We may use Google AdSense to show advertising if the site is approved and advertising is enabled. Google AdSense can set or read cookies such as __gads, __gpi, and IDE for ad delivery, frequency capping, measurement, fraud prevention, and reporting.

    Google and third-party advertising technology vendors may use cookies or similar technologies to serve adverts, measure performance, prevent invalid traffic, and enforce advertising policies. These vendors are controlled through Google AdSense settings and the consent management tools shown to users where required.

    Personalised adverts may use information such as previous visits, broad interests, or demographic signals to make adverts more relevant. Non-personalised adverts do not use past behaviour for ad targeting, but may still use cookies or identifiers for frequency capping, aggregated reporting, and fraud prevention.

    For users in the UK, EEA, and other regions where consent is required, personalised advertising and non-essential advertising cookies will be controlled through a Google-certified Consent Management Platform once AdSense is enabled.

    You can manage advertising preferences through Google Ad Settings , Your Online Choices , and AboutAds.info .

    Third-Party Services

    • Google Analytics 4, For website usage analytics, loaded only with your consent
    • Google AdSense, For advertising if the site is approved and advertising is enabled
    • Google advertising technology providers, For ad delivery, measurement, fraud prevention, and policy enforcement where applicable
    • Apple, For App Store distribution, TestFlight beta testing, Sign in with Apple, crash diagnostics, app analytics, and app support workflows where applicable

    Data Retention

    • •Analytics data: 26 months (Google Analytics default)
    • •Advertising cookies: Up to 13 months, subject to Google settings and regional requirements
    • •Contact messages: Up to 2 years after resolution
    • •Feature suggestions: Retained while the suggestion is active on the platform
    • •CalmBack on-device data: Intended to remain on your device until you delete it in the app or remove the app, unless you clearly choose a future sync, backup, sharing, or support export feature
    • •TestFlight and App Store diagnostics: Retained according to Apple App Store Connect controls and any copies we need for testing or support

    International Data Transfers

    Some third-party service providers may transfer data outside the UK and European Economic Area:

    • Google LLC (USA), Protected by Standard Contractual Clauses and the EU-US Data Privacy Framework

    We ensure appropriate safeguards are in place for any international transfers in accordance with GDPR Article 46.

    Data Sharing

    We do not sell your personal information for money.

    We may share limited information with the service providers listed in this policy so they can provide analytics, advertising, security, hosting, or support services. We may also share information to comply with legal obligations such as court orders or law enforcement requests.

    For mobile apps, Apple provides platform services such as App Store distribution, TestFlight, Sign in with Apple, diagnostics, and app support tooling. Apple processes information according to its own terms and privacy notices.

    Data Security

    We implement reasonable security measures including HTTPS encryption, secure infrastructure, and access controls to protect any information transmitted to us (such as contact form submissions and feedback). However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

    Your Rights Under GDPR & UK GDPR

    Under the General Data Protection Regulation and UK GDPR, you have the following rights:

    • Right of Access: Request a copy of your personal data
    • Right to Rectification: Correct inaccurate personal data
    • Right to Erasure: Request deletion of your personal data
    • Right to Restrict Processing: Limit how we use your data
    • Right to Data Portability: Receive your data in a structured, machine-readable format
    • Right to Object: Object to processing based on legitimate interests
    • Right to Withdraw Consent: Withdraw consent at any time (e.g. via cookie settings)

    To exercise any of these rights, please use our contact form. We will respond within 30 days.

    Right to Lodge a Complaint

    If you believe we have not handled your personal data properly, you have the right to lodge a complaint with a supervisory authority. In the UK, this is:

    Information Commissioner's Office (ICO)

    Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

    Website: ico.org.uk/make-a-complaint

    California Residents (CCPA)

    If you are a California resident, you have additional rights under the California Consumer Privacy Act:

    • Right to Know: Request information about the personal data we collect and how it is used
    • Right to Delete: Request deletion of your personal data
    • Right to Non-Discrimination: We will not discriminate against you for exercising your rights

    We do not sell personal information for money.

    We have not sold personal information for money in the preceding 12 months. If advertising cookies are enabled, some advertising activity may be considered sharing under California privacy law. You can decline non-essential cookies or use the advertising opt-outs above.

    Changes to This Policy

    We may update this Privacy Policy from time to time. Changes will be posted on this page with the "Last updated" date revised accordingly. We encourage you to review this page periodically.

    Contact

    If you have questions about this Privacy Policy or wish to exercise your data protection rights, please use our contact form.