Privacy Policy
Effective date: January 1, 2025 · Last updated: October 28, 2026
1. Introduction
TRE Forged LLC ("we", "us", "our") operates Forgenta, a personal finance management application accessible at getforgenta.com. This Privacy Policy explains how we collect, use, store, and protect your information when you use our service. By using Forgenta you agree to the practices described in this policy.
2. Information We Collect
Account data: Your email address and a securely hashed password. We never store your password in plaintext.
Financial data: Budget rules, transactions, account balances, savings goals, debt entries, and net worth entries you enter into the app. This data is stored solely in your account and is not shared with any third party.
Connected account data: If you connect a bank account via Plaid, we store the access credentials Plaid issues us (encrypted at rest), institution name, account names, masked account numbers (last 4 digits), balances, and any transaction data the provider returns. Connecting a bank account is entirely optional. See Section 6 for full details.
Usage data: Basic interaction logs (page navigation, feature usage) used to improve the service. We use Google Analytics and Vercel Analytics (including Vercel Speed Insights, which measures page performance) for aggregate usage measurement, and only if you accept analytics cookies — they are never loaded otherwise, and never loaded at all if your browser sends a Global Privacy Control or Do Not Track signal. See Section 8a. Your financial data is never sent to either of them. With the same consent we also use LaunchDarkly to record errors and a masked session replay (all on-screen text and form inputs are hidden) so we can find and fix bugs; it is never loaded without your consent, and never loaded at all if your browser sends a Global Privacy Control or Do Not Track signal. Before you have an account, the sign-in screen counts which of its steps were reached (for example, that a sign-up button was tapped) with no name, email or account attached. If you accept analytics cookies, those counts also carry a random ID created on your device and stored there, so we can tell one install from another; it is not your device's advertising or hardware ID, it is never linked to your account, and it is deleted if you later reject analytics cookies. If you arrived through a tagged link, those counts also carry the short label from that link (for example "instagram"), so we can tell which channel brought people; it is only that label, never your identity. All of this is skipped if you reject analytics cookies or send a Global Privacy Control or Do Not Track signal.
Payment data: On web, billing is processed by Stripe. On iOS, billing is processed by Apple. On Android, billing is processed by Google Play. Subscription state across platforms is managed by RevenueCat. We store only platform-specific customer identifiers (Stripe customer ID, RevenueCat app user ID) and your subscription status — no card numbers, CVVs, or full payment details are ever stored by TRE Forged LLC.
3. How We Use Your Information
- To provide, operate, and maintain the Forgenta service
- To authenticate your identity and protect your account
- To process payments and manage your subscription status
- To sync connected bank accounts and display up-to-date balances and transactions
- To send transactional emails (account confirmation, billing receipts)
- To respond to support requests
- To detect and prevent fraud or abuse
- To improve and develop new features
We do not sell, rent, or trade your personal information to third parties. We do not use your financial data to serve advertisements.
Email and notification delivery: Emails from us (account confirmation, invites, billing notices, and the newsletter if you subscribed) are delivered by Resend, Inc., which receives your email address and the message content. If you turn on push notifications, your device's push token and the notification text pass through Apple Push Notification service (iOS) or Firebase Cloud Messaging by Google (Android) so the notification can reach your device.
4. Data Storage — Supabase
All user data is stored in a PostgreSQL database managed by Supabase, Inc., hosted on Amazon Web Services (AWS) infrastructure. Supabase enforces Row-Level Security (RLS) policies that ensure each user can only read and write their own data — no other user or unauthenticated party can access your records. Data is encrypted at rest using AES-256 and encrypted in transit using TLS 1.2+.
Authentication is handled via Supabase Auth, which issues short-lived JSON Web Tokens (JWTs). Tokens are stored in your browser's local storage and are never sent to any server other than Supabase and our own edge functions. For Supabase's own data practices, see supabase.com/privacy.
5. Payment Processing — Stripe, Apple, Google Play & RevenueCat
Forgenta uses different payment platforms depending on where you subscribe:
Web — Stripe: Subscriptions purchased on the web are processed by Stripe, Inc. via a Stripe-hosted checkout page. TRE Forged LLC never receives, transmits, or stores your payment card details. Stripe is PCI-DSS Level 1 certified. We store only your Stripe customer ID and subscription status. For Stripe's data practices, see stripe.com/privacy.
iOS — Apple In-App Purchase: Subscriptions purchased on iOS are billed directly by Apple, Inc. through the App Store. TRE Forged LLC does not receive your Apple ID, payment method, or card details. Apple's payment and billing terms govern these transactions. For Apple's data practices, see apple.com/legal/privacy.
Android — Google Play Billing: Subscriptions purchased on Android are billed by Google LLC through Google Play. TRE Forged LLC does not receive your Google account payment details. Google's payment and billing terms govern these transactions. For Google's data practices, see policies.google.com/privacy.
RevenueCat — subscription management: We use RevenueCat, Inc. to manage and verify subscription entitlements across web, iOS, and Android. RevenueCat receives your app user ID, platform purchase receipts, and device metadata to track subscription status. We store your RevenueCat app user ID in our database. For RevenueCat's data practices, see revenuecat.com/privacy.
6. Bank Account Connections — Plaid
Forgenta optionally integrates with Plaid, an account aggregation provider, to let you connect bank accounts and automatically import balances and transactions. Connecting an account is entirely optional — you can use Forgenta without linking any external accounts.
Which provider is used: Plaid, Inc. is the only provider we use to connect bank accounts.
What the provider accesses: When you connect an account, the provider authenticates with your financial institution on your behalf and retrieves account names, masked account numbers (last 4 digits), current balances, and — where you have permitted it — transaction history. Plaid does not share your full account number, routing number, or bank login credentials with TRE Forged LLC.
What we store: We store the access credentials the provider issues us (encrypted at rest), institution name, account names, masked account numbers, balances, and any transaction data returned (merchant name, amount, date, category). We do not store your bank login credentials.
How the data is used: Connected account data is used solely to display your balances and transactions within Forgenta. It is not sold, shared, or used for advertising, and it is not used to train any machine learning model.
Revoking access: You can disconnect any linked account at any time from the Accounts page. Disconnecting revokes our access with Plaid and stops future syncs. You can also revoke access directly through your bank's linked-apps or connected accounts settings.
For Plaid's data practices, see plaid.com/legal.
7. Data Retention
Your account data is retained for as long as your account is active. If you delete your account, we will purge your personal data and financial records within 30 days. Anonymized or aggregated data that cannot be linked to you may be retained for service improvement purposes.
8. Your Rights
Access: You can view all data you have entered in the app at any time.
Correction: You can update your account information and financial data directly within the app via Settings.
Deletion: You can delete your account at any time from the Settings page. This permanently removes all your data. See our Right to Delete Notice for the full process, timelines, and what we are required to retain.
Portability: Premium subscribers can export their financial data to CSV. Contact support to request a full data export in JSON format.
Objection: You may contact us to object to specific processing of your data. We will respond within 30 days.
8a. Do Not Track & Global Privacy Control
Forgenta honors browser-level opt-out signals. If your browser or extension sends a Global Privacy Control (GPC) signal or a Do Not Track (DNT) header, we do not load Google Analytics, Vercel Analytics or LaunchDarkly, and no analytics events are sent, even if you previously accepted analytics cookies. The signal takes precedence over your stored cookie preference. Essential functionality (authentication, security, and your saved financial data) is unaffected, as it is required to operate the service and is not tracking.
9. Security
All connections to Forgenta are encrypted via HTTPS. Authentication uses industry-standard JWT tokens with expiration. We apply Row-Level Security at the database layer so each user's data is isolated. Sensitive operations (payments, subscription management) are handled by edge functions that validate authentication before processing any request. We do not log sensitive financial data or authentication tokens.
If we learn that personal data we hold was accessed or disclosed without authorization, we will investigate promptly, contain the problem, and notify affected users, in accordance with applicable law, by email and in the app. We will also notify regulators and other parties where the law requires it. To report a suspected security problem, write to support@getforgenta.com.
10. Children's Privacy
Forgenta is not intended for users under the age of 13. We do not knowingly collect personal information from children. If we become aware that a child under 13 has provided personal data, we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by a notice within the app. Continued use of the service after changes take effect constitutes acceptance of the updated policy.
12. Contact Us
For privacy-related questions, data requests, or to exercise your rights, contact TRE Forged LLC at:
support@getforgenta.com
13. AI Advisor & AI Processing
Forgenta's AI Advisor feature is powered by Gemini 2.5 Flash, a large language model provided by Google LLC. When you use AI Advisor, the following data may be transmitted to Google's Gemini API to generate a response:
- Your typed prompts and follow-up questions
- Relevant financial context derived from your account (monthly income, expenses, debt balances, savings goals, spending categories)
- Prior chat messages within the same session
AI responses are generated by a third-party provider. TRE Forged LLC does not control the underlying model and cannot guarantee the accuracy, completeness, or timeliness of AI-generated content. AI output is not financial, investment, legal, or tax advice.
AI chat history may be stored in your account to provide continuity across sessions. You may delete your AI chat history from your account at any time. TRE Forged LLC does not sell personal data, including AI chat content, to third parties.
AI Advisor is a premium-only feature. Usage is subject to daily and weekly limits enforced server-side to manage costs and prevent abuse.
Before using AI Advisor, you will be asked to review and accept these disclosures. Your acceptance is recorded with a version identifier. If the AI processing terms materially change, you will be prompted to re-accept before AI Advisor becomes available again.
For Google's data practices regarding the Gemini API, see policies.google.com/privacy.
13a. On-Device Features: Voice Entry, Receipt Scan and Assistant
Voice entry, receipt scanning and the Apple on-device assistant run on your phone. When you tap the microphone button, Forgenta records only until you tap the stop square (at most 15 seconds) and turns the audio into text on your device. The audio is never saved and never sent to us or to anyone else. When you tap Scan receipt, the photo is read on your device and is not uploaded. The speech and text-reading models are downloaded from our own servers. On iPhones that support Apple Intelligence, the optional assistant uses Apple's on-device model, and your question and the figures shown to it stay on the device. Your phone shows its own indicator while the microphone or camera is in use, and you can turn either off in your device settings at any time.
14. Cookie Preferences
You can review and change your cookie consent at any time below.
