Privacy Policy
Effective 19 August 2026 · Applies to the Forma app for iOS and Android
Forma is a calisthenics training app made by Markuss Rencis and Eriks Kristians Selga, who run it together (“Forma”, “we”, “us”). This policy explains what we collect when you use Forma, why we collect it, who else handles it, and the choices you have. If anything is unclear, write to hello@tryforma.co.
The short version
- You sign in with Apple on iPhone or with Google on Android. We receive your email address (or Apple’s private relay address if you hide it) and your name if you share it. We generate a random account ID for you.
- What you enter in the app is stored in your account so it follows you between devices: your age, your gender if you give it, how often you train, your bodyweight, your equipment, your starting strength, your programs and goal skills, and every workout you log.
- We use PostHog, hosted in the EU, to understand how the app is used. Analytics events carry your account ID and answers such as age and training frequency. The analytics profile is tied to your account and the email address on it, so we treat it as personal data and delete it when you delete your account.
- Exercise demo videos are streamed from YouTube. When a video or its thumbnail loads, your device talks to Google under Google’s privacy policy.
- No ads, no advertising identifiers, no data brokers. We do not sell your data.
- You can delete your account from the Profile tab at any time. Everything in your account is erased at once and the analytics profile within 30 days. The analytics events that remain can no longer be linked to you.
1. Who is responsible for your data
Markuss Rencis and Eriks Kristians Selga, who operate Forma together, are joint controllers for the personal data described here. Between us, Markuss Rencis runs the app’s data operations day to day and is the first point of contact, but you can exercise every right in this policy against either of us. Reach us at hello@tryforma.co for anything in this policy, including requests to exercise your rights.
2. What we collect and why
Forma collects only what the app needs to work and what we need to improve it. The table lists each kind of data, where it comes from, what we use it for, and the legal basis under the GDPR.
| Data | Where it comes from | What we use it for | Legal basis |
|---|---|---|---|
| Account Email address, name (if you share it), the random account ID we generate for you, sign-up date. With Google sign-in, also your Google account ID and, if your account has one, your profile picture. | Sign in with Apple (iPhone) or Sign in with Google (Android) | Creating and securing your account, keeping your data separate from everyone else’s, and contacting you about your account if we ever need to | Performance of our contract with you |
| Profile answers Age, gender (optional, with “prefer not to say"), sessions per week, and the training aim you pick (Forma calls it your archetype). | The onboarding screens after you sign in | Shaping the program Forma builds for you, and understanding who uses Forma | Contract (your program), legitimate interest (understanding our users) |
| Program setup Bodyweight, equipment, training days per week, workout split, your current best on key exercises, long-term goal skills, accessory choices. | The program setup wizard and program settings | Building and adapting your program. Weighted lifts use your bodyweight to set loads. Your starting strength places you at the right step of each skill tree | Performance of our contract with you |
| Training data Workout sessions (start and finish times, exercises, sets, reps, hold times, weights), exercise progress and targets, progression events and personal bests, your schedule and where you are in it, suggestions you approve or dismiss. | Logged as you train and as Forma progresses you | Running progression and showing your history, calendar, progress and skill wheel | Performance of our contract with you |
| Usage analytics App opened and backgrounded. Events such as account created or deleted, onboarding finished, program created, workout started or finished, exercise progressed, skill tree exercise opened, together with related details (session type, duration, exercise count, program settings, your onboarding answers, the bodyweight you entered at setup). Technical details: device model, operating system version, app version, language, time zone, screen size. Your IP address arrives with each event and PostHog may derive an approximate, city-level location from it. | Automatically, through the PostHog SDK inside the app | Seeing which features get used and where people get stuck, finding bugs, and improving the app | Legitimate interest in improving Forma. You can object at any time (section 7) |
| Device-only settings Your kg or lb preference, rest timer preferences, and whether you allowed notifications. | Set by you in the app | Remembering your settings on this device. These stay on your phone and are never sent to us | Not applicable (not transmitted) |
Bodyweight and training logs are things you enter yourself so that Forma can build and adapt your program. Where the law treats them as health data, we process them on the basis of your explicit consent, which you give by entering them, and you can withdraw it at any time by deleting your account.
What we do not collect
Forma does not collect your precise location, contacts, photos, camera or microphone input, or data from Apple Health, HealthKit or Google Fit. It does not use the advertising identifier (IDFA or GAID) and shows no ads. There are no purchases inside the app, so we never see payment card details. If you bought lifetime access on tryforma.co, Stripe processed that payment under its own privacy policy. We receive your email address, what you bought and, if you gave it, your name, and we keep that record to honor your purchase.
3. Signing in
Apple or Google handles authentication. We never see or store a password.
On iPhone you sign in with Apple. Apple gives us a signed token, your email address, and your name if you choose to share it (Apple sends the name only the first time). If you use Apple’s Hide My Email, we receive a private relay address that forwards to your real inbox, and your real address stays with Apple. You can revoke Forma’s access to your Apple ID at any time in your Apple ID settings under Sign in with Apple. If you sign in again later, Apple treats it as a fresh sign-up.
On Android you sign in with Google. Google gives us a signed token, your email address, your name, your Google account ID and, if your account has one, your profile picture. You can remove Forma from the apps connected to your Google account at any time in your Google account settings.
Revoking access does not delete your Forma data. That happens only when you delete your account.
4. Who we share data with
We use a small number of service providers to run Forma. Each one processes data only on our instructions and only for the purpose listed. We do not sell personal data and we do not share it with advertisers or data brokers.
| Provider | What they do for Forma | What they receive |
|---|---|---|
| Apple Inc. | Sign in with Apple on iPhone. Notifications and the lock-screen Live Activity run on your device only | Your Apple ID sign-in, under Apple’s own privacy policy |
| Google LLC (sign-in) | Sign in with Google on Android | Your Google account sign-in, under Google’s Privacy Policy |
| Supabase, Inc. | Hosts our database and authentication service on Amazon Web Services in the European Union | Everything in the Account, Profile, Program and Training rows above. Data is encrypted at rest and in transit, and row-level security limits each account to its own rows |
| PostHog, Inc. | Product analytics, on PostHog’s EU cloud (Frankfurt, Germany) | The Usage analytics row above, keyed to your account ID, which is tied to the email address on your account |
| Google LLC and YouTube (videos, font) | Exercise demo videos play in YouTube’s embedded player, and video thumbnails load from YouTube’s image servers. One display font (Roboto Mono) loads from Google Fonts the first time it is needed | Your IP address and standard request details when a thumbnail, video or font loads. The YouTube player may set its own cookies or local storage inside the player, as described in Google’s Privacy Policy. We never send Google your account information |
We may also disclose data if the law requires it, for example in response to a valid legal order, or to protect the rights and safety of our users.
5. Where your data lives
Your account and training data are stored in the European Union, and analytics data stays on PostHog’s EU servers. Apple, Supabase, PostHog and Google are United States companies, and some processing (Apple and Google sign-in, YouTube video delivery, support tooling) can involve servers outside the EU. Where that happens, transfers rely on the EU-US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.
6. How long we keep data
Account, profile, program and training data stay for as long as your account exists. When you delete your account, every row belonging to it is deleted immediately by a database cascade. Routine encrypted backups may hold a copy for up to 30 days before they roll off.
Analytics events reference your account ID. When you delete your account we also delete the analytics profile tied to that ID, including the email address on it, within 30 days. The events themselves remain but can no longer be linked to you.
Support emails are kept for as long as needed to resolve your request and for a reasonable period afterwards in case it comes up again.
7. Your rights and choices
Under the GDPR and similar laws you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or hand it over in a portable format. You can also complain to your local data protection authority (for Latvia, the Data State Inspectorate, Datu valsts inspekcija). Much of this you can do yourself:
- Correct your bodyweight, program, goal skills and units in the app.
- Delete everything with Profile → Delete account. It cannot be undone.
- Notifications can be switched off for Forma in your phone’s notification settings. The app only ever schedules a local “rest is over” alert during a workout.
- Object to analytics by emailing us. We will delete your PostHog profile and stop associating events with your account.
For anything else, email hello@tryforma.co from the address on your account. We answer within 30 days. If you live somewhere with its own privacy law, such as California, you have comparable rights and the same email works.
8. Children
Forma is not directed at children under 13 and we do not knowingly collect personal data from anyone younger. If you are a minor where you live, use Forma with a parent or guardian’s permission. If you believe a child under 13 has created an account, email us and we will delete it.
9. Security
All traffic between the app and our servers is encrypted with TLS. Data is encrypted at rest. There are no passwords to leak because Apple or Google performs sign-in. Each account can only ever read and write its own rows, enforced in the database itself. Account deletion runs as a server-side function that removes everything at once. During a workout, the Live Activity shows the name of your current exercise and your set count on the lock screen, so anyone holding your phone can see them until the workout ends.
10. Changes to this policy
When we change this policy we post the new version at tryforma.co/privacy and update the date at the top. If a change is material, we tell you in the app or by email before it takes effect.