ThriveForge is a fitness and wellbeing app with an AI coach called Amara. This policy says what we collect, why, who else receives it, how long it is kept, and how you delete it.
Who we are. ThriveForge is published by Sahil Sihmar, an individual trading as ThriveForge Labs, of 1330, Second Floor, Investors Forum, Satpaul Mittal Marg, Sector 46, Gurugram, Haryana 122003, India. “We” and “us” mean Sahil Sihmar. Contact: contact@thriveforgefitness.com.
Where your data is. Our server (Render) is in Oregon, USA, and the AI companies named in section 3 process what they receive in the United States. Our database, sign-in and file storage (Supabase) are currently in Mumbai, India, and are moving to Oregon, USA before our public launch; when that move is complete we will update this page.
1. What we collect and why
Your account. Your email address and password (to sign you in), the name you give us (so the app and Amara can address you), and your date of birth (to confirm you are 18 or over, and to set your targets). If you sign in with Apple or Google instead, we never see your Apple or Google password: they confirm it is you and share your name and email address with us. With Sign in with Apple you can choose to hide your email, and we then receive a private relay address from Apple instead.
Your profile, if you add it. Birthday, sex, height, weight, goals, food preferences, allergies and health conditions you tell us about. We use these to set your targets, to plan meals and workouts, and so Amara’s advice fits you. Health conditions you list are used to avoid suggesting a calorie deficit.
What you log. Food, water, sleep, mood, weight, workouts and meditation. This is the core of the app: it is how you and Amara see your days.
Your conversations with Amara. What you write to her, and the photos and voice notes you send her. We keep them so you can read back your conversations.
Photos and voice you use to log. A meal photo you scan, and a voice recording you use to log food, are sent to be read and are not kept by us after that.
Your profile photo, if you add one.
Health Connect (Android), if you turn it on. With your permission the app reads steps, active calories burned, heart rate, resting heart rate, heart rate variability, sleep, distance and exercise sessions. It never writes to Health Connect. See section 5.
Your subscription status, from the App Store or Google Play through RevenueCat.
Usage counts for AI features: how many AI requests you made and their size, so we can keep usage fair. We do not keep the text of your requests in these counts.
What we do not collect: your location, your contacts, your advertising ID. We do not use analytics, advertising or crash-reporting tools, and we do not sell your data or use it for advertising.
Your photo library, camera and microphone are used only when you choose to take or pick a photo or record your voice.
2. Who receives your data
We use these companies to run the app. They receive only what they need for the job below.
| Company | What it receives | Why |
|---|---|---|
| Supabase | Your account and everything you store in the app | Hosts our database, sign-in and file storage |
| Render | Requests from the app to our server, including what you send to Amara | Hosts our server |
| OpenAI | See section 3 | Amara’s replies, voice-to-text, reading food and workouts you describe, AI workouts and meal plans |
| Google (Gemini API) | Meal photos you scan and the names of the foods found | The meal scanner and food estimates |
| Perplexity, fal.ai | Only the name of a food or exercise, nothing that identifies you | Looking up a food; drawing an exercise picture |
| FatSecret, USDA FoodData Central, Open Food Facts | Food search words and barcodes. USDA and Open Food Facts are contacted directly from your phone, so they also see your phone’s internet address | Nutrition information |
| RevenueCat | Your ThriveForge user ID and your purchases | Managing your subscription |
| Apple / Google | Your purchase, and, if you sign in with Apple or Google, the fact that you signed in to ThriveForge | Billing and sign-in, under their own terms |
We may also disclose data if the law requires it.
3. AI features
This is the same as the consent screen in the app. Before any AI feature sends anything, the app asks your permission once. Until you tap Agree, nothing you write, say, photograph or log is sent to an AI company, and the AI features stay off. You can turn this off at any time in Menu → Privacy; the app then asks again the next time you use an AI feature. Our server checks this permission too.
- OpenAI reads your messages to Amara and the photos and voice notes you send her. To answer, Amara also reads your name, profile, goals, what she remembers about you, and your logs: food, water, sleep, mood, weight, workouts, meditation, stress and energy, steps and heart rate. OpenAI also turns your voice into text, reads food and workouts you say or type to log, and receives your details when you ask for an AI workout or meal plan.
- Google Gemini reads the food photos you scan, and the names of the foods it finds.
- Names only: the names of foods, activities and exercises you search or add can also go to OpenAI, Google Gemini, Perplexity or fal.ai to be looked up. Nothing that says who you are goes with them.
- What they keep: OpenAI and Google do not use this data to train their models. They may keep it for up to 30 days (OpenAI) or 55 days (Google) to check for abuse, then it is deleted.
Amara is not a doctor or dietitian; see our Terms of Service.
4. How long we keep your data
- Your account, profile, logs and conversations: until you delete them or your account.
- Meal-scan photos and food-log voice recordings: not kept by us after they are read.
- Server logs at our host (Render): up to 30 days. They record requests, timings and errors, not what you write, say or photograph. Like most servers they also record the internet address each request came from.
- Database backups: up to 7 days, then they are overwritten.
- AI companies: as in section 3.
5. Health Connect
ThriveForge’s use and transfer of information received from Health Connect will adhere to the Health Connect Permissions policy, including the Limited Use requirements.
- We read only: steps, active calories burned, heart rate, resting heart rate, heart rate variability, sleep, distance and exercise sessions. We never write to Health Connect.
- We use this data only to show your activity, sleep and heart readings in the app and so Amara can take it into account.
- When you use Amara and have agreed to AI processing, your steps and heart rate for the day are part of what she reads (section 3).
- We do not use Health Connect data for advertising, do not sell it, and do not use it to build profiles for anyone else. No human at ThriveForge reads it except with your permission, for security, or where the law requires.
- You can stop sharing at any time in Health Connect’s settings.
6. Deleting your data
In the app: Profile → Delete account. This deletes your account (including your sign-in email), your profile, everything you logged, your conversations, and your chat photos, voice notes and profile photos, and signs you out. It does not cancel a subscription: cancel that in the App Store or Google Play first.
What remains afterwards: the store’s and our subscription provider’s (RevenueCat) record of your purchases; an anonymous exit survey if you filled it in; copies the AI companies keep for the periods in section 3; our host’s server logs; and database backups until they expire.
By email: write to contact@thriveforgefitness.com from the email you signed up with, or follow the steps at thriveforgefitness.com/delete-account. We will confirm and complete it within 30 days.
You can also delete a single day’s conversation, or all your conversations, in the Amara tab; their photos and voice notes are deleted with them.
7. Children
ThriveForge is for people 18 and over. We ask for your date of birth when you sign up and do not create an account for anyone younger; an existing account whose birthday is under 18 cannot use the app. If you believe someone under 18 has given us data, write to contact@thriveforgefitness.com and we will delete it.
8. Consumer health data
Some of what you give us (food, weight, sleep, mood, heart rate, steps, workouts, health conditions) can be “consumer health data” under US state laws such as Washington’s My Health My Data Act. Our Consumer Health Data Privacy Policy explains what we collect, who receives it, and your rights. We do not sell consumer health data.
9. Your other rights
Depending on where you live (for example the EU or UK under GDPR, California under CCPA/CPRA, or India under the DPDP Act) you may have rights to access, correct, delete or port your data and to object to its use. Write to contact@thriveforgefitness.com.
10. Security
Data travels encrypted (HTTPS) between the app, our server and the companies above. Your chat photos, voice notes and profile photo are private: only you can open them, through short-lived links. Each account can reach only its own records.
11. Changes
If we change this policy, we will post the new version on this page with a new effective date. If we start sending your data to a new AI company, the app will ask your permission again before it does.
12. Our website
This website, thriveforgefitness.com, uses no advertising or tracking cookies. It is hosted by Cloudflare, which processes your internet address to deliver the pages and protect the site. We use Cloudflare Web Analytics to count visits: it sets no cookies, does not build a profile of you, and gives us only totals such as page views and the countries and browsers visitors use. If you join the waitlist, the form sends your email address to Beehiiv, our newsletter provider, so we can send you updates about ThriveForge. Every email has an unsubscribe link, and Beehiiv’s own privacy policy applies to what it holds.