Privacy policy
What data Forma collects (email, name, training data), why, where it is stored and how to change or delete it.
1. General
This is the policy on the processing of personal data required by 152-ФЗ art. 18.1. It describes what the operator — Forma ("we") — collects on the Forma site and in the Forma app, on what legal basis, why, where the data is kept, for how long, and what rights you have.
The service is intended for people aged 18 and over. We do not knowingly collect children's data; if you are a parent and believe your child left data with us, write to hello@forma-app.co and we will delete it.
2. What data we collect
- Email — when you order a course and when you sign in to the app with a code.
- Name (display name) and avatar — you set them yourself in your profile; other participants see them on the leaderboard.
- Invitations: whose link you came through and whether the club was paid for afterwards — so that club days can be credited to both (section 5a of the terms). On the invitation screen the inviter sees only numbers — how many people came and paid — never an email.
- Training data: your onboarding answers (age band, sex, equipment), test results, completed workouts, effort and feeling ratings and points.
- Health data — only what you tick yourself in the "what should we go easy on" question: knees, lower back, shoulders, wrists, high blood pressure, pregnancy. This is a special category under 152-ФЗ art. 10, and it is taken on a separate consent that the app asks for directly under that question. Without it nothing is stored and workouts come without exercise substitutions.
- Photos and videos you attach yourself as proof of a club task. Only the coach sees them.
- Your Telegram account number — if you open the app inside Telegram. It is linked to the account you are signed in to, including one you created on the website. It exists only so the bot can write to you: about a payment and a workout the coach assigned, club messages, and confirmations, reminders and moves of coaching sessions. We receive no phone number and no conversations with other people from Telegram; your name and @username only if you write to the bot yourself (next item).
- Coaching bookings: the time and length of the session, the coach, the booking’s status (awaiting payment, confirmed, cancelled or not paid in time) and the video room link you receive after payment.
- Messages to the coach — what you write through “Message the coach” in the app or to the bot in Telegram: the text (up to 1,000 characters) or a note that a file was sent, the time, the language, the app screen it was written from, and for messages to the bot your Telegram account number, name and @username. We keep them together with the coach’s reply, so the coach can answer and see the conversation, and to limit how often messages can be sent.
- Technical data: timestamps of actions and the session data needed for sign-in to work.
We collect no passport data, postal addresses, card numbers or precise location. Payment happens on the payment service’s side — card details never reach us at all.
2a. Legal basis
- Your consent (152-ФЗ art. 6 § 1 cl. 1) — email, name, onboarding answers. Consent is given by a deliberate act: the checkbox on the order form and the button on the sign-in screen, next to a link to this policy.
- A separate consent for the special category (art. 10) — the health notes.
- Performance of our contract with you (art. 6 § 1 cl. 5) — everything needed to open a course you paid for and keep your progress.
- Legal obligations (art. 6 § 1 cl. 2) — the records of payments and refunds a seller must keep.
Every consent is logged: which address, to which text, which version of it, and when. That is art. 9 § 3 — proving consent is the operator’s duty, not yours.
3. Why we need it
- To open access to a course and link it to your email.
- Passwordless sign-in with a one-time code sent to your email.
- Load adaptation: test results and effort ratings set your level and adjust the next workout.
- Progress, statistics and the leaderboard (which shows only name, avatar and points — never your email).
- Telegram messages: about payments and assigned workouts, club messages (the task of the day, a streak reminder, the week’s results), a warning before club access ends, confirmations, reminders, moves and cancellations of coaching sessions, and the coach’s replies to your messages. The daily club messages can be switched off in your profile.
- Coaching bookings: to hold the chosen time, confirm it on payment, move it and send the room link.
- Support, answers to messages to the coach, refunds and compliance with legal requirements.
- To understand how the app works: how many people reach each step and who has stopped training. Only the coach sees this summary, inside the app, and it exists so that the courses and the service can be improved. We use no third-party analytics.
We do not sell data and do not use it for advertising.
4. Where data is stored
Data is stored in Supabase (a Postgres database, an authentication service and file storage) in the European Union region. Supabase acts as a processor and does not use the data for its own purposes. Sign-in code emails are sent through the email service configured in Supabase.
The site itself is static and hosted on GitHub Pages; when you open it, the host sees the standard technical data of a request (IP address, browser), as with any website.
This means data leaves Russia — a cross-border transfer under 152-ФЗ art. 12. Supabase servers are in the European Union and GitHub’s are in the United States. We say so plainly so that you know it before you leave an address rather than after.
Access to data is protected by row-level rules: you see only your own records. The coach sees the list of orders (email and course) in order to confirm access, the bookings made with them and the messages written to them.
4a. What is kept in the browser
Besides the login session and settings, the site and the app write a few functional values to the browser’s storage (localStorage or sessionStorage). They stay on your device; you can remove them by clearing the site’s data in your browser.
- «forma.referral» (localStorage) — the invitation code from the link you came through, so that after sign-in it can be applied and the club days credited. The app sends the code to the server on its first attempt to attach it to your account and removes it from the browser right after.
- «forma.myRef» and «forma.myName» (localStorage) — your own invitation code and the first word of your profile name, so the site can build your personal link and sign it. They are written when you open the invitation screen or share the club in the app and removed when you sign out. The name goes only into the link you choose to send.
- «forma.src» (localStorage) — one short label of where the first visit came from: a campaign tag of the link or the page of the site. It is written once and never overwritten; it is sent to the server with an order, so that we know which links work. It stays until you clear the site’s data.
- «forma.next» (sessionStorage) — where a link was going while you sign in or answer the first questions, so that exactly that screen opens afterwards. It is removed once used, and in any case when the tab is closed.
- «forma.authEmail» (sessionStorage) — the address you typed on the homepage, so the app can send the code without asking again. It is removed as soon as the app has read it, and in any case when the tab is closed; it never goes into a page address.
5. Retention
Data is kept while you have an account and course access (a purchased course stays open with no time limit for as long as the App exists) or until you ask us to delete it. Records of orders and refunds are kept as long as accounting and tax law requires.
When the basis for processing falls away — you withdraw consent, ask for the account to be deleted, or the purpose is met — we delete the data within 30 days (152-ФЗ art. 21). Deletion means deletion: rows go from the database and files from storage. One exception: the payment records a seller is required to keep under tax law.
6. Your rights
- Know which data about you is stored.
- Correct your name and profile settings — in the app itself, under "Data and consents" and the "Name" row. Anything else, by letter.
- Withdraw the consent to process health data — with a button in the app, in the same place. From that moment the notes stop affecting your training.
- Delete your account and training data. Note that this also removes the email–course link, i.e. access to the courses you bought.
- Withdraw consent altogether — which is the same as asking for the account to be deleted: we stop processing and delete the data, save what the law requires us to keep.
- Complain to Роскомнадзор or go to court if you believe we process data improperly (152-ФЗ art. 17).
To exercise these rights, write to hello@forma-app.co from the email linked to your account — that is what confirms the account is yours. We answer within 30 days, usually sooner.
7. Changes to this policy
We may update this policy. The date of the latest update is shown at the top of the page; the current version is always available at this address.
8. The operator
Forma, email: hello@forma-app.co. Write to this address about anything to do with data — it is also the address for withdrawing consent and for deletion requests.