Privacy Policy
Your privacy matters. Here is exactly how we handle your data.
Last updated: 9 August 2026
TL;DR
- Most tools run entirely in your browser. Your files and data stay on your device.
- We collect minimal data: messages you email us, limited cookieless site analytics, and data needed for advertising where applicable.
- CalmBack is designed to be local-first. We do not operate a separate iForge Apps user database for CalmBack accounts.
- If CalmBack uses Sign in with Apple, Apple handles the sign-in flow. We do not require a separate iForge username or password.
- We never sell your data for money.
- Cloudflare Web Analytics measures aggregate site use without setting analytics cookies.
- Advertising cookies or related technologies are used only where legally permitted and any required consent has been obtained.
- You can contact us at [email protected] to exercise your data rights.
Data Controller
For the purposes of GDPR, UK GDPR, and other applicable data protection laws, the data controller is:
IFORGEAPPS LTD
(trading as iForge Apps)
Company number: 17160532 (England and Wales)
Contact: Contact page or [email protected]
Information We Collect
We collect very little. Here is what we may receive:
- Email messages, your email address, message, and any name or other information you choose to include
- Earlier suggestion submissions, earlier versions of our suggestion feature could collect suggestion content, an optional email address, and a browser or device-derived identifier
- Apple app information, limited TestFlight, App Store, crash, diagnostic, and support information that Apple makes available to developers for testing and support
- Cloudflare Web Analytics data, limited aggregate information about site use through the current cookieless analytics implementation
- Advertising data, limited ad request, cookie, identifier, and consent information where Google AdSense is active and applicable rules permit it
Most tools run entirely in your browser. Files you process (PDFs, images, etc.) are not uploaded to our servers.
Mobile Apps and CalmBack
CalmBack is planned as an iOS app distributed through Apple TestFlight and, if approved, the App Store.
No separate iForge user database: We do not currently operate a separate server-side user database for CalmBack accounts. CalmBack is designed around data minimisation and local-first use.
Sign in with Apple: If CalmBack uses Sign in with Apple, Apple handles the sign-in flow. We do not ask you to create a separate iForge username or password. Apple may provide limited sign-in information, such as an Apple-provided user identifier or relay email address, where needed for authentication or support.
On-device app content: Heart Check-In entries, reflections, favourites, app settings, calm preferences, and similar personal app activity are intended to stay on your device unless a future feature clearly asks you to enable sync, backup, sharing, or support export.
TestFlight and App Store: Apple may make beta tester information, crash reports, diagnostics, screenshots, written feedback, install metrics, and support-related information available to us through App Store Connect. We use that information to test, debug, support, and improve the app.
No tracking ads in CalmBack: CalmBack is not designed around third-party advertising profiles or cross-app tracking.
Legal Basis for Processing (GDPR)
- Consent (Article 6(1)(a)): For advertising cookies, personalised advertising, and storing or accessing non-essential technologies where consent is required. You can withdraw consent through the available consent controls.
- Legitimate interests (Article 6(1)(f)): For essential site functionality, security, fraud prevention, aggregate cookieless site measurement, and processing feedback you choose to email.
- Legal obligation (Article 6(1)(c)): Where we must keep or disclose information to comply with applicable law, regulator requests, or court orders.
Browser Storage, Cookies and Related Technologies
Cloudflare Web Analytics is implemented as a cookieless service and does not set analytics cookies. Google and advertising partners may use cookies or related technologies only where legally permitted and where any required consent has been obtained.
The site's custom consent notice stores your Accept or Decline choice and a timestamp in localStorage under iforge-cookie-consent. It is not a cookie, and the current code does not apply an automatic expiry period.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| iforge-cookie-consent | Local storage | Stores your Accept or Decline choice and the time it was saved | No automatic expiry in current code; remains until site data is cleared or the value is replaced |
| Google advertising cookies and identifiers | Advertising | Ad delivery, frequency management, measurement, fraud prevention, reporting, and personalisation where permitted | Varies according to the technology, Google settings, and region |
Advertising
Google AdSense integration is present on iForgeApps.com. Advertising may be served if Google approves the site and ad serving is enabled.
Google Privacy & messaging has been configured, and a European regulations message has been published. We have not yet verified that the published European message is visibly displaying on production, so this describes its configuration status only.
A Google US state regulations message is also published for iForgeApps.com and configured for "All current and future supported US States". Where Google shows it, the "Do Not Sell or Share My Personal Information" mechanism lets affected visitors submit an opt-out choice. This configuration does not mean that every US state privacy law necessarily applies to IFORGEAPPS LTD.
Google and advertising partners may use cookies or related technologies to deliver adverts, manage frequency, measure performance, prevent fraud, and enforce advertising policies where legally permitted and consented to where required. Their practices and available controls can vary by region and service.
Personalised adverts may use information such as previous visits, broad interests, or demographic signals to make adverts more relevant. Non-personalised adverts do not use past behaviour to select adverts, but may still use contextual information and limited technologies for frequency management, aggregated reporting, security, and fraud prevention.
You can learn more and manage available choices through Google Ad Settings , Google's advertising information , Google's Privacy Policy , Your Online Choices , and AboutAds.info .
Third-Party Services
- Cloudflare Web Analytics, For cookieless aggregate website usage measurement
- Google AdSense, For advertising, ad measurement, fraud prevention, and related services where active
- Google Privacy & messaging, For regional consent and privacy-choice messages
- Google advertising technology providers, For ad delivery, measurement, fraud prevention, and policy enforcement where applicable
- Apple, For App Store distribution, TestFlight beta testing, Sign in with Apple, crash diagnostics, app analytics, and app support workflows where applicable
Data Retention
- •Cloudflare Web Analytics: Aggregate analytics are retained according to the current Cloudflare service and account settings
- •Consent preference: The iforge-cookie-consent localStorage value has no automatic expiry in current code
- •Advertising cookies and identifiers: Retention varies according to the technology, Google settings, and regional requirements
- •Contact messages: Up to 2 years after resolution
- •Earlier suggestion submissions: Earlier versions could store suggestion content, an optional email address, and a browser or device-derived identifier. This policy update does not claim that historical records currently exist or that they have been deleted
- •CalmBack on-device data: Intended to remain on your device until you delete it in the app or remove the app, unless you clearly choose a future sync, backup, sharing, or support export feature
- •TestFlight and App Store diagnostics: Retained according to Apple App Store Connect controls and any copies we need for testing or support
International Data Transfers
Some third-party service providers may transfer data outside the UK and European Economic Area:
- Google and Cloudflare group companies, which may process information in the USA or other countries where they operate
Where international transfer rules apply, transfers are handled using applicable legal safeguards described in provider terms or required by law.
Data Sharing
We do not sell your personal information for money.
We may share limited information with the service providers listed in this policy so they can provide analytics, advertising, security, hosting, or support services. We may also share information to comply with legal obligations such as court orders or law enforcement requests.
For mobile apps, Apple provides platform services such as App Store distribution, TestFlight, Sign in with Apple, diagnostics, and app support tooling. Apple processes information according to its own terms and privacy notices.
Data Security
We implement reasonable security measures including HTTPS encryption, secure infrastructure, and access controls to protect information transmitted to us, such as email messages and feedback. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.
Your Rights Under GDPR & UK GDPR
Under the General Data Protection Regulation and UK GDPR, you have the following rights:
- Right of Access: Request a copy of your personal data
- Right to Rectification: Correct inaccurate personal data
- Right to Erasure: Request deletion of your personal data
- Right to Restrict Processing: Limit how we use your data
- Right to Data Portability: Receive your data in a structured, machine-readable format
- Right to Object: Object to processing based on legitimate interests
- Right to Withdraw Consent: Withdraw consent at any time (e.g. via cookie settings)
To exercise any of these rights, use our Contact page or email [email protected]. We will respond within the applicable legal timeframe.
Right to Lodge a Complaint
If you believe we have not handled your personal data properly, you have the right to lodge a complaint with a supervisory authority. In the UK, this is:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Website: ico.org.uk/make-a-complaint
US State Privacy Choices
Depending on where you live and whether an applicable US state privacy law covers our processing, you may have rights that include:
- Right to Know: Request information about the personal data we collect and how it is used
- Right to Delete: Request deletion of your personal data
- Right to Correct: Request correction of inaccurate personal data
- Right to Opt Out: Opt out of sale, sharing, or targeted advertising where the applicable law provides that right
- Right to Non-Discrimination: We will not discriminate against you for exercising your rights
We do not sell personal information for money.
Some advertising activity may be treated as a sale, sharing, or targeted advertising under certain state laws. The Google US state regulations message is published for iForgeApps.com and configured for all current and future supported US States. Where Google displays it, the "Do Not Sell or Share My Personal Information" mechanism provides the relevant opt-out route. This configuration does not mean every listed state law applies to IFORGEAPPS LTD.
Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with the "Last updated" date revised accordingly. We encourage you to review this page periodically.
Contact
If you have questions about this Privacy Policy or wish to exercise your data protection rights, use our Contact page or email [email protected].