Forge
Forgeby PLAYAMIGOS
Log In

Privacy Policy

Last updated: May 17, 2026

Forge by PlayAmigos ("we," "us," or "our") operates the Forge learning platform at forge.playamigos.in. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our Service. It applies to all users worldwide and addresses your rights under applicable data protection laws including the GDPR (EU), CCPA/CPRA (California), LGPD (Brazil), DPDP Act (India), PIPEDA (Canada), and POPIA (South Africa).

1. Data Controller

Forge by PlayAmigos acts as the data controller (or equivalent under your local law) for the personal data described in this policy. For privacy-related inquiries, data access requests, or complaints, contact:

Privacy Contact / Data Protection Officer:
Email: vivekananda.work@gmail.com
Product: Forge by PlayAmigos
Website: forge.playamigos.in

2. Information We Collect

a) Account Information

When you create an account, we collect:

  • Email address — used for authentication, password resets, and account identification
  • Password — stored securely using Supabase Auth (bcrypt hashed, never stored in plaintext)

b) Learning Data

As you use Forge, we collect and store:

  • Chat conversations — your interview with the AI to profile your learning goals
  • Topic preferences — extracted learning style, goals, and knowledge level
  • Curricula — AI-generated learning plans tailored to you
  • Lessons & quizzes — AI-generated content and your quiz answers
  • Quiz scores & feedback — performance tracking across lessons
  • Strengths & weaknesses — AI-tracked concept proficiency from quiz results

c) Technical Data

  • Timezone — automatically detected from your browser to schedule lesson delivery
  • Push notification endpoint — your browser's push subscription for lesson notifications
  • Theme preference — stored as a browser cookie (e.g., "theme-midnight")

3. Legal Basis for Processing

We process your personal data based on the following legal grounds (as required by GDPR Article 6 and equivalent provisions):

  • Consent — You provide explicit consent when you create an account and accept our Terms & Conditions. You may withdraw consent at any time by deleting your account.
  • Performance of a Contract — Processing your data is necessary to deliver the learning service you signed up for (generating curricula, lessons, quizzes, and tracking progress).
  • Legitimate Interest — We process aggregate, anonymized usage patterns to improve the quality and performance of the Service. This processing does not override your privacy rights.

4. How We Use Your Information

We use your information to:

  • Authenticate you and manage your account
  • Generate personalized curricula, lessons, and quizzes using AI
  • Grade your quiz answers and track learning progress
  • Adapt future lessons based on your performance and feedback
  • Send push notifications when your daily lesson is ready (only if you opt in)
  • Display your published learning paths in the community catalog (only if you choose to publish)
  • Improve the Service based on aggregate, anonymized usage patterns

5. AI Processing & Automated Decision-Making

Your learning data (chat conversations, topic preferences, quiz answers, and feedback) is processed by third-party AI models through OpenRouter to generate educational content. This data is sent to AI providers including:

  • Anthropic (Claude)
  • Google (Gemini)
  • Meta (Llama)

AI providers process your data according to their own privacy policies. We use OpenRouter's API, which acts as an intermediary. Your data is used only for generating your educational content and is not used to train AI models, per OpenRouter's data handling policies.

Automated Decision-Making (GDPR Art. 22): Forge uses AI to automatically adapt your curriculum based on quiz performance and feedback. This automated processing is educational in nature and does not produce legal effects or significantly affect you. You retain full control over your learning path and can delete topics or your account at any time. The AI does not make consequential decisions about you — it only adjusts lesson content and difficulty.

6. Data Storage & International Transfers

Your data is stored in:

  • Supabase Postgres — account information, topic metadata, lesson progress, and push subscriptions
  • Supabase Storage — lesson content, quiz data, curriculum files, and chat history as markdown/JSON artifacts

Supabase infrastructure is hosted on AWS and implements Row Level Security (RLS) to ensure users can only access their own data. Published community content is stored in a separate public storage folder.

International Data Transfers: Your data may be processed and stored in data centers outside your country of residence, including the United States and European Union. When data is transferred internationally:

  • Supabase operates under Standard Contractual Clauses (SCCs) for EU-to-US transfers
  • OpenRouter and AI providers process data in accordance with their respective data processing agreements
  • We ensure that all international transfers maintain an adequate level of data protection as required by GDPR Chapter V, LGPD, and other applicable laws

7. Push Notifications

If you opt in to push notifications, we store your browser's push subscription endpoint. This is used exclusively to notify you when your daily lesson is ready or when you have a pending quiz. You can disable notifications at any time through your browser settings or the Forge settings page. Expired subscriptions are automatically cleaned up.

8. Cookies

Forge uses only strictly essential cookies:

  • Authentication cookies — Supabase session tokens for keeping you logged in (essential for service functionality)
  • Theme cookie — stores your visual theme preference (e.g., "theme-dawn"). Contains no personal information

We do not use advertising cookies, tracking pixels, analytics cookies, or third-party cookies. Since all our cookies are strictly essential for the operation of the service, they are exempt from consent requirements under the ePrivacy Directive. We still inform you about them for transparency.

9. Data Sharing

We do not sell, rent, or trade your personal information. This applies to all users including California residents (see CCPA section below). Your data is shared only with:

  • AI providers (via OpenRouter) — to generate educational content, as described above
  • Supabase — our infrastructure provider for database and file storage
  • Other users — only if you voluntarily publish a learning path to the community catalog (published content is permanent)

10. Data Retention

Your data is retained for as long as your account is active. If you delete a topic, all associated data (lessons, quizzes, chat history, artifacts) is permanently deleted from both the database and storage. If you delete your account, all your data will be removed, except for any Community Content you have published, which remains in the public catalog as stated in our Terms & Conditions.

11. Your Rights

Regardless of where you are located, you have the right to:

  • Access your data through the Forge dashboard, lesson reader, and data export feature
  • Export your data in a structured, machine-readable format (JSON) via Settings → Export Your Data
  • Delete your account and all associated data via Settings → Delete Account
  • Update your email, password, and timezone in the settings page
  • Opt out of push notifications at any time
  • Withdraw consent by deleting your account, which removes all personal data

12. Region-Specific Rights

European Economic Area (GDPR)

If you are in the EU/EEA, you additionally have the right to:

  • Rectification — request correction of inaccurate personal data
  • Restriction — request restriction of processing in certain circumstances
  • Object — object to processing based on legitimate interests
  • Data portability — receive your data in a structured, machine-readable format (available via the Export feature in Settings)
  • Lodge a complaint — with your local supervisory authority (Data Protection Authority)
  • Not be subject to automated decisions — our AI-based curriculum adaptation is educational only and does not produce legal effects

California (CCPA/CPRA)

If you are a California resident, you have the right to:

  • Know what personal information we collect, use, and disclose (described in this policy)
  • Delete your personal information (available via Settings → Delete Account)
  • Opt-out of sale — We do not sell your personal information. We do not share personal information for cross-context behavioral advertising
  • Non-discrimination — We will not discriminate against you for exercising your privacy rights

To exercise your CCPA rights, use the self-service features in your Settings page or contact us at vivekananda.work@gmail.com.

Brazil (LGPD)

If you are in Brazil, under the Lei Geral de Proteção de Dados (LGPD), you have the right to:

  • Confirmation of the existence of processing
  • Access to your data
  • Correction of incomplete or inaccurate data
  • Anonymization, blocking, or deletion of unnecessary data
  • Data portability (available via Export feature)
  • Deletion of personal data processed with consent
  • Information about public and private entities with which your data is shared
  • Revocation of consent

India (DPDP Act, 2023)

If you are in India, under the Digital Personal Data Protection Act, 2023:

  • Forge by PlayAmigos acts as a Data Fiduciary
  • You are a Data Principal with the right to access, correct, and erase your personal data
  • We process your data based on your consent given at account creation
  • You may file a grievance with us at vivekananda.work@gmail.com — we will respond within 30 days
  • If unsatisfied, you may approach the Data Protection Board of India

Canada (PIPEDA)

If you are in Canada, we comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) principles:

  • Accountability — We are responsible for personal data in our possession
  • Consent — We obtain meaningful consent for collection and use
  • Limiting collection — We collect only what is necessary for the service
  • Accuracy — You can update your information at any time via Settings
  • Access — You can access and export your data at any time

South Africa (POPIA)

If you are in South Africa, under the Protection of Personal Information Act (POPIA):

  • We process your data lawfully, with your consent, for a specific purpose
  • You have the right to access, correct, and delete your personal information
  • You may object to the processing of your personal information
  • You may lodge a complaint with the Information Regulator

13. Children's Privacy

Forge is not intended for children under 13 years of age (or 16 in jurisdictions where GDPR applies with a higher age of consent). We do not knowingly collect personal information from children under these ages. If you are a parent or guardian and believe your child has provided us with personal information, please contact us so we can take appropriate action, including deletion of the data.

14. Data Breach Notification

In the event of a data breach that affects your personal data, we will:

  • Notify affected users via email within 72 hours of discovering the breach (as required by GDPR Article 33)
  • Notify the relevant supervisory authority where required by law
  • Provide details of the breach, its likely consequences, and the measures we are taking to address it
  • Document all breaches and our response, regardless of whether notification is required

15. Security

We implement industry-standard security measures including:

  • Bcrypt password hashing (via Supabase Auth)
  • Row Level Security (RLS) on all database tables
  • HTTPS encryption for all data in transit
  • JWT-based authentication with secure cookie storage
  • Server-side API route protection with token validation

While we strive to protect your data, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes by updating the "Last updated" date at the top of this page and, for significant changes, by sending an email notification. We encourage you to review this page periodically for any changes.

17. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have a privacy-related complaint, please contact us at:

Privacy Contact / Data Protection Officer:
Email: vivekananda.work@gmail.com
Product: Forge by PlayAmigos
Website: forge.playamigos.in

We aim to respond to all privacy-related inquiries within 30 days. For GDPR requests, we will respond within one month as required by Article 12.