Privacy Policy

1. Information We Collect

Account Information

When you create an account, we collect:

• Email address - Used for authentication, email verification, and account recovery
• Display name - Optional, shown in the app
• Profile picture - Optional, stored by our authentication provider

This information is collected and managed through our authentication provider, Hexclave. If you sign in with Google, we receive your Google account email and basic profile information.

Data You Create

When you use Follow Forward, we store the content you create, which may include:

• Goals & sub-goals - Titles, categories, deadlines, your personal "why" statements, and completion status
• Journal entries - Titles, dates, and the text you write
• Notes - Titles, content, and tags
• Calendar events - Titles, descriptions, locations, dates, and recurrence rules
• Vision-board photos - Images you upload and their captions
• Timestamps - When items are created, updated, or completed

Payment Information

If you subscribe to Follow Forward Pro, payments are processed by Stripe. We do not collect, see, or store your full card number or other sensitive payment details — those are handled directly by Stripe. We store only a Stripe customer/subscription identifier and your current plan status so we can provide the paid features.

Automatically Collected Information

• Analytics data - We use Vercel Analytics to understand how the app is used (page views, general usage patterns). This data is aggregated and does not personally identify you.
• Server logs - Standard web server logs for security and debugging purposes

2. How We Use Your Information

We use your information to:

• Provide and maintain the Follow Forward service
• Authenticate your account and keep it secure
• Display your goals, sub-goals, journal, notes, calendar, and vision board
• Provide the optional AI features (see Section 3)
• Process subscription payments and manage your plan
• Improve the app based on aggregated usage patterns
• Send account-related communications (e.g., email verification, security alerts)

3. AI Features

Follow Forward Pro includes optional AI features (such as suggested sub-goals, a daily focus, a weekly reflection, and gentle nudges). When you use one of these features, we send the relevant content you created to our AI provider, Anthropic (the makers of Claude), so it can generate a response for you. Depending on the feature, this may include:

• Goal titles, categories, and your "why" statements
• Sub-goal titles and deadlines
• Short excerpts of recent journal entries

We send only what a given feature needs, and we never send your email, password, payment details, or other users' data. Anthropic processes this content solely to generate your response and, under its commercial API terms, does notuse it to train its models. AI features are available on the Pro plan; if you use the free plan or simply don't use these features, none of your content is sent to Anthropic.

4. Third-Party Services

We use the following third-party services (sub-processors) to operate Follow Forward:

Each of these providers has its own privacy policy and security practices. We select providers with strong security and privacy standards.

International Data Transfers

Follow Forward is operated from the United States, and our providers store and process data primarily on servers in the United States. If you access the service from outside the U.S. (including the EU, UK, or elsewhere), your information will be transferred to and processed in the United States, which may have different data-protection laws than your country. Where required for transfers of personal data out of the EU/UK, we rely on appropriate safeguards such as the providers' Standard Contractual Clauses. By using the service, you understand that your information is processed in the United States as described here.

5. Data Security

We implement security measures to protect your data:

• All data transmitted over HTTPS (encrypted in transit)
• Database connections are encrypted
• Authentication handled by Hexclave with industry-standard security
• Vision-board photos are stored privately and served only to you via short-lived, signed links
• Payment card data never touches our servers (handled by Stripe)
• Server-side validation and per-user access controls, so each user can only access their own data

6. Data Retention

• Active accounts: We retain your data as long as your account is active
• Deleted accounts: When you delete your account, all your content (goals, sub-goals, journal entries, notes, calendar events, vision-board photos) and your user record are permanently deleted from our database and photo storage, and any active subscription is canceled
• Backups: Database backups may retain data for up to 30 days after deletion

7. Your Rights

You have the right to:

• Access your data - View all your content and account information within the app
• Correct your data - Edit your goals, sub-goals, journal, notes, calendar, and profile
• Delete your data - Delete your account at any time from your account settings
• Export your data - Download a copy of your data as a JSON file from Settings

For EU/UK Users (GDPR)

If you are located in the European Union or United Kingdom, you have additional rights under GDPR, including:

• Right to data portability
• Right to restrict processing
• Right to object to processing
• Right to withdraw consent where processing is based on consent
• Right to lodge a complaint with a supervisory authority

Legal bases for processing. We process your data to perform our contract with you (providing the service and any subscription you purchase), based on your consent (e.g., optional features you choose to use), and based on our legitimate interests in operating, securing, and improving the service. Where we rely on consent, you may withdraw it at any time.

For California Residents (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect and how we use it (described in this policy), to request access to or deletion of your information, to data portability, and to not be discriminated against for exercising your rights. We do not sell or share your personal information as those terms are defined under California law, and we do not use it for cross-context behavioral advertising.

To exercise any of these rights, contact us at privacy@followforward.dev.

8. Cookies

Follow Forward uses minimal cookies:

• Authentication cookies - Required to keep you logged in

We use Vercel Analytics, which is privacy-friendly and does not use tracking cookies to identify you. We do not use advertising or cross-site tracking cookies.

9. Children's Privacy

Follow Forward is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• Posting the new policy on this page
• Updating the "Last Updated" date
• Sending an email notification for material changes