Privacy Policy

ForgeCore is an online and in-person bodybuilding, strength and hypertrophy coaching service operated from the United Kingdom. When we say "we", "us" or "our" in this policy, we mean J.D.P.T.

• Account details: name, email address and password (hashed) when you sign up.
• Coaching intake: training history, current programme, session frequency, equipment access and goals submitted through the programme quiz or coaching application.
• Health and body data: bodyweight, measurements, progress photos, lifts, injuries, sleep, steps, water and nutrition entries you choose to log. This is treated as special category data under UK GDPR and we only process it with your explicit consent so your coach can plan training and nutrition.
• Check-ins and messages: weekly check-in answers, biofeedback ratings, form-check videos and any messages you send us.
• Billing data: subscription status and the last four digits / brand of your payment method. Full card details are handled directly by our payments provider (Paddle) and never touch our servers.
• Testimonials: the name, rating, photo and review text you submit through the review form, once approved.
• Technical data: IP address, device and browser information, and basic analytics about how the site is used.

• Deliver your training programme, nutrition guidance and check-ins.
• Track progress (lifts, photos, biofeedback) so we can adjust your plan.
• Run your account, take payment and send service emails (password resets, receipts, check-in reminders).
• Display approved testimonials on the site.
• Keep the platform secure and diagnose technical issues.
• Meet our legal and tax record-keeping obligations.

• Contract: to provide the coaching plan you have purchased.
• Explicit consent: for health, body and progress-photo data, and for marketing emails. You can withdraw consent at any time.
• Legitimate interests: securing the site, preventing fraud and improving the service.
• Legal obligation: keeping financial records.

We do not sell your data. We share the minimum needed with trusted processors who help us run the service:

• Supabase – database, authentication and file storage.
• Cloudflare – website hosting and security.
• Paddle – subscription billing and tax handling (Merchant of Record).
• Formspree / email provider – delivery of coaching applications and transactional email.

Some providers are based outside the UK. Where data leaves the UK we rely on adequacy decisions or the UK International Data Transfer Addendum to keep it protected.

• Active coaching data: for as long as you have an account with us.
• After cancellation: deleted within 12 months on request, otherwise kept for up to 3 years so we can re-onboard you and answer support questions.
• Invoices and tax records: 6 years, as required by HMRC.
• Testimonials: until you ask us to remove them.

You can ask us to:

• Access a copy of the data we hold on you.
• Correct anything that is wrong.
• Delete your account and associated coaching data.
• Export your tracker / check-in history.
• Withdraw consent for marketing or progress photos at any time.

Email hello@jdptandstrength.com and we will respond within 30 days. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk).

Data is stored on encrypted, access-controlled infrastructure. Access to coaching records is limited to your coach. Payments are processed by Paddle on PCI-DSS compliant systems – we never see your full card number.

We use a small number of essential cookies to keep you signed in and to remember your preferences. We do not use third-party advertising cookies.

ForgeCore is intended for adults aged 18 and over. We do not knowingly collect data from children. If you believe a child has signed up, please contact us and we will remove the account.

If we make material changes we will update the "Last updated" date above and, where appropriate, notify you by email.