Privacy Policy

Short answer: The health data behind your cards stays on your iPhone. We do collect anonymous usage analytics, and your email address if you send us feedback. From version 2.1.0, Forta starts with Sign in with Apple, and your account adds the profile and competition data described under Your Account and Compete below. If you started Forta before 2.1.0, you can keep making cards without an account.

Forta reads workout data from Apple Health on your device to create workout cards and animations. The workout samples themselves - heart rate, calories, routes, distance - are processed entirely on your iPhone and are never uploaded to our servers. If you join a competition, Forta uploads only the daily totals it scores and which app or watch they came from (in Rings, also your ring goals), never these samples.

What we collect:

• Anonymous usage analytics - which screens and features you use
• From version 2.1.0, no Health data is part of those analytics. Earlier versions also recorded the type of workout you opened or filtered by (run, walk, swim and so on), workout counts, the opened workout's age in days and whether it had a route - never its measurements
• Crash and performance reports
• A random device identifier generated on your phone, used to count installs
• Your email address and message, only if you choose to send feedback or a feature request from inside the app
• If you have an account: your account, profile and follows, and, for the competitions you join, the daily totals they score and which app or watch they came from (in Rings, also your ring goals), as described under Your Account and Compete below

What we never collect:

• Your address, phone number or payment details
• Your raw Health samples - heart-rate readings, calories, routes and the like never leave your device
• Your photos or videos - cards are rendered on your iPhone and we have no upload path for them
• Your precise location
• Cookies or tracking pixels

When you make a card, your workout data flows like this:

1. Apple Health stores your workout data on your iPhone
2. Forta requests read access to this data (with your permission)
3. The data is processed locally to create your card or animation
4. The final image/video is saved to your device or shared directly

Your workout data itself never leaves your device through our app, with one exception, stated plainly: if you join a competition, the daily totals it scores and which app or watch they came from (in Rings, also your ring goals) are uploaded for the days of that competition, only to work out the scores, as described under Your Account and Compete below. Versions before 2.1.0 had a second exception: our anonymous usage analytics included the type of workout you opened and workout counts. When you share to Instagram or other platforms, you are sharing the final created image or video - not your raw health data.

Forta integrates with Apple Health using Apple's official HealthKit framework. This integration:

• Requires your explicit permission before accessing any data
• Only requests read access to your Health data (we can't write or modify it, and Compete doesn't either)
• Respects Apple's strict privacy guidelines for health data
• Can be revoked at any time

Forta never uses Health data for advertising or marketing, and never sells it. From version 2.1.0, no Health data is part of our analytics. What Compete uploads is used only to work out competition scores, and no player can read it. Other players see your points, and their cards can show them, as described below.

To manage Forta's access to your health data, open the Health app, tap your profile picture, then, under Privacy:
Apps → Forta

Who has an account: everyone who starts Forta with version 2.1.0 or later, where a new install starts with Sign in with Apple and that is the only way in, and anyone who started Forta earlier and signs in later from the Compete, Feed or You tab. If you started Forta before 2.1.0, you can keep making cards without signing in.

Your account lets you use Compete: follow friends and hold competitions with them, scored from your Apple Health daily totals. Creating your profile means accepting our Terms of Use.

What Apple gives us: a stable user identifier and, if you choose to share it, your name. Forta doesn't ask Apple for your email address. Your name only pre-fills your display name on your phone, and you can change it or leave it empty. The sign-in provider, Firebase Authentication, doesn't store the name Apple shares.

What other people can see:

• Anyone signed in to Forta: your handle (@name), display name, avatar (an emoji or two letters), number of wins, follower and following counts, and whether your profile is private
• If your profile is private: only followers you approve see your competitions. People can send you follow requests
• The other players of a competition you join: your points and tie-break totals; how many days have synced and when your phone last synced; your time zone; and when you joined. They can post a card to their followers or share it outside Forta (for example to Instagram); it shows your name, avatar and points, or “Private player” if your profile is private
• Your followers: when you start or win a competition, and the cards you choose to post. A card shows the competition's title, places, points and names; players with private profiles appear as “Private player”

Kept private to you:

• Your age band (13–15, 16–17 or 18+), and how it was set: by Apple's Declared Age Range, or from a birth year you enter in the app. The birth year itself is not stored
• Your ring goals in Rings competitions: only you can read them
• Your country, used for the digital-consent age in the EU and EEA
• The version of the terms you accepted, and when you accepted them
• Your alert switches
• Your phone's push-notification token, with its time zone and language

Your Health data and Compete: Forta reads Apple Health on your iPhone. For Compete, it uploads only each day's totals for the metrics a competition scores (Rings: Move, Exercise and Stand; Exercise minutes: exercise minutes; Workout minutes or Workouts: workout minutes and workout count; Steps: steps), with the names of the apps or watches they came from (for example “Apple Watch” or “Garmin”) and, in Rings, your ring goals, and only for days of competitions you joined: never individual workouts or samples. Compete's server receives and stores these totals only to work out the scores, and no player can read them; other players see your points and tie-break totals, as described above. Raw Health samples never leave your iPhone. Forta never uses what Compete uploads for advertising or marketing, and never sells it. Forta doesn't write to Apple Health for Compete.

Compete can send you push alerts when someone passes you, on a competition's final day, with results, and for invitations and follows. You can switch each kind off in the app. Forta sends no marketing pushes. Signing out removes your phone's push token.

If you have an account, go to You → Delete account in Forta. This removes your account and your personal data: your profile, handle, follows, feed, posts, reactions, invitations and device tokens. Most of it goes at once, and the rest usually within a day. You leave the competitions that are still running, and your scores in them are deleted. In finished competitions your totals stay, so the other players' results don't change, but your name, handle and avatar are removed. Forta revokes its Sign in with Apple tokens; if that fails, the app tells you how to finish in Settings. We keep a record that the account was deleted (its internal ID and the dates) so it can't be used again.

Forta uses these third-party services:

• Google Firebase Analytics: Anonymous usage analytics - which features are used. Versions before 2.1.0 also sent the workout details listed under Information We Collect
• Google Firebase Crashlytics: Crash and performance reports, so we can fix crashes we would otherwise never see
• Google Cloud Firestore: Stores the feedback and feature requests you choose to send us, including the email address you enter
• Google Firebase Authentication and Cloud Firestore, for accounts and Compete: Your sign-in, account and competition data, in a separate “Forta Compete” project, stored in the United States
• Cloudflare: Runs Compete's server at api.getforta.com
• Apple Push Notification service: Delivers Compete alerts
• AppsFlyer: Removed in version 2.0.4 (September 2026). Versions 2.0.3 and earlier counted installs using a random identifier generated on your device. Forta does not run ads, and this was not used to build an advertising profile or to target you
• Apple Intelligence: For AI-generated captions, processed on-device using Apple's private AI framework
• Instagram API: Only when you choose to share directly to Instagram Stories - this shares the created image, not health data

None of these receive your raw Health samples, such as heart-rate readings or routes, and none of them receive your photos or videos. For Compete, Firebase and Cloudflare handle only the daily totals, their sources and the ring goals described above. Each service provider above (Google, Cloudflare and Apple, and AppsFlyer for versions 2.0.3 and earlier) handles data only to provide its service to Forta and must protect it at least as well as this policy does.

This website: getforta.com counts visits with Cloudflare Web Analytics, which uses no cookies or local storage and does not fingerprint visitors. The free workout card maker draws your card in your browser and sends nothing you type.

Your raw Health samples never reach our servers, so there is nothing of them to secure on our end. The feedback you choose to send us is stored in Google Cloud Firestore, where the app can create it but cannot read, edit or delete it. Account and competition data is stored in Google Cloud Firestore in the United States. The health data on your iPhone is protected by:

• Apple's device encryption
• Your iPhone passcode/Face ID/Touch ID
• Apple Health's built-in security measures
• iOS app sandboxing (apps can't access each other's data)

We keep event-level analytics for at most 14 months, crash reports for 90 days, and feedback until we've answered it. To delete feedback you sent, email [email protected]. Your account and competition data stay until you delete your account; what remains after that is described under Deleting Your Account.

Without an account, Forta doesn't ask your age, name or identity, and the only personal information we receive is an email address you type into the feedback form.

Signing in is for people 13 and older. It asks for your age band (13–15, 16–17 or 18+), set by Apple's Declared Age Range or from a birth year you enter; the birth year itself is not stored. In EU and EEA countries whose digital-consent age is above 13, you must be 16 or older to sign in: there is no parental-consent flow. Forta does not knowingly collect personal information from children under 13.

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.