Privacy Policy

This Privacy Policy describes the information handling practices of FiveForge for the Service. It applies to everyone who visits the website or uses the Service, whether or not they register an account.

By using the Service, you agree to the practices described in this Policy and to the use of your information as described here. If you do not agree, you should not use the Service. This Policy is part of the agreement between you and FiveForge and should be read together with our Terms of Use and the other documents on our legal index.

We collect information in the following categories, and we only collect what is needed to operate the Service. We do not collect information for its own sake, and we do not sell personal information.

Account & profile information. You sign in to the Service with Discord. As part of sign-in, we receive and store: your Discord user ID, your email address (from the email scope), your Discord username/display name, and your Discord avatar URL when Discord provides one. See Section 4 for details.

Content you submit. The Service processes content you submit, including chat prompts, project files, code, uploaded images and attachments, and the AI output we generate in response. Your projects and session content are stored on your account.

Payment information. Payments are processed by PayPal, which hosts the checkout. FiveForge receives from PayPal the information needed to grant and manage your subscription: your PayPal payer (customer) ID, subscription ID, subscription status, next billing time, and the plan entitlement derived from the subscription. FiveForge never receives or stores full card numbers, expiration dates, or card security codes (CVV) — those remain with PayPal.

Support communications. When you contact us through the contact page, support chat, or email, we collect the information you provide — such as your name, email address, Discord handle, the category and subject of your request, and the message itself — so we can respond and keep a record of the resolution.

Usage & technical information. We use essential session cookies to keep you signed in, and we apply reasonable rate limits to protect the Service. We maintain internal, aggregate statistics (for example, counts of active users and usage) to operate and improve the Service. Two small items are stored only in your browser: your recent documentation searches and a random support session identifier — both are described in our Cookie & Local Storage Policy.

What we do NOT collect. To be explicit: the Service has no analytics cookies, no advertising cookies, and no advertising identifiers. The website does not collect hardware identifiers, and the desktop application does not send telemetry, crash reports, or usage analytics. We also do not collect precise device fingerprints for advertising purposes.

• to provide, maintain, secure, and improve the Service — including authentication, plan enforcement, and usage limits;
• to generate AI output from your prompts and content, using third-party AI model providers as described in Section 5;
• to process subscription payments through PayPal, including entitlements, renewals, cancellations, and refunds;
• to provide support and respond to your requests and questions;
• to send service-related communications, including security alerts and, where you have an account, occasional announcements;
• to detect, prevent, and respond to abuse, fraud, unauthorized access, and violations of our Acceptable Use Policy;
• to operate our Discord community — adding you to the FiveForge Discord server and synchronizing roles as described in Section 4;
• to comply with legal obligations and to protect our rights and the rights of others.

A Discord account is required to use the Service. When you sign in, you authorize FiveForge through Discord's OAuth flow to access the following scopes: identify, email, and guilds.join.

From those scopes we receive and store: your Discord user ID (stored on your profile), your email address (used as the account email), your Discord username/display name (used as the account display name), and your Discord avatar URL when Discord provides one.

As part of registration, the Service uses the guilds.join scope to add you to the FiveForge Discord server automatically. FiveForge may also synchronize status information — such as your subscription level or achievements — to Discord roles through its role-sync bot.

You can leave or mute the FiveForge Discord server at any time; leaving the server does not delete your FiveForge account. Discord's own privacy policy and terms of service apply to your use of Discord.

We do not sell your personal information. We share information only to operate the Service, with the following categories of recipients:

• Supabase — Authentication, database, and Row-Level-Security infrastructure for the website..
• PayPal — Subscription payments; PayPal hosts the checkout and holds payment details..
• Discord — Account sign-in (OAuth), server membership, and role synchronization..
• OpenRouter — AI model routing for chat and image-analysis features (server-side API calls)..
• Resend — Transactional email for support-ticket notifications..
• Hostinger Mail (SMTP) — Outbound mail server used for admin announcements (sender: FiveForge AI <[email protected]>)..

Each provider processes data under its own terms and privacy policy, which apply when you use that service. FiveForge is not responsible for the practices of these providers beyond the purposes described here.

Legal and safety disclosures. We may disclose information where required by law, legal process, or a valid government request; to enforce our Terms of Use and this Policy; to protect the security and integrity of the Service; to detect and prevent fraud or abuse; or to protect the rights, property, or safety of FiveForge, our users, or the public.

The AI features of the Service work by sending your prompts and relevant context to third-party AI model providers through an intermediate routing gateway (OpenRouter). This processing happens server-side; your request content is transmitted to the provider only for the purpose of generating the response.

AI output is generated algorithmically and is probabilistic — it can be incomplete or inaccurate, and you are responsible for reviewing anything you use. See our AI Usage & Responsible Use Rules for more.

The website uses a small number of storage items, and every one of them is listed in our Cookie & Local Storage Policy.

• Essential Supabase session cookies (sb-<project-ref>-auth-token*) issued on sign-in to keep you authenticated;
• browser localStorage for your recent documentation searches (fiveforge-recent-searches);
• browser localStorage for a random support-session identifier used to rate-limit the support chat widget (ff_support_session).

There are no analytics cookies and no advertising cookies. You can clear or block all of these items through your browser's settings at any time; blocking the authentication cookie will simply sign you out.

We retain personal information only as long as reasonably necessary for the purposes described in this Policy — to provide the Service, to meet legitimate operational needs (such as billing records and abuse prevention), and to comply with legal obligations.

When you request account deletion, we will delete or de-identify your account data. We may retain: (a) data we are legally required to keep; (b) records reasonably needed to prevent fraud, abuse, or security incidents; and (c) aggregated, de-identified data.

You may place an account deletion request at any time (Section 10); cancellation of a paid subscription stops future billing but does not by itself delete your account data.

We take reasonable and appropriate measures — technical, administrative, and organizational — to protect your information against loss, misuse, unauthorized access, alteration, and disclosure. These include transport-level encryption (HTTPS/TLS) for traffic to and from the Service, access controls on our infrastructure, Row-Level Security on account data in our database, and review of access to administrative functions.

Depending on where you live, you may have rights regarding your personal information. We describe the main ones here and honor them for all users:

• Access. You can request a copy of the personal information we hold about you.
• Correction. You can ask us to correct inaccurate information, and you can update your profile yourself where the Service allows it.
• Deletion. You can request deletion of your account and associated data by using the account deletion option in your account settings or by contacting us (contact page).
• Objection / restriction. You can ask us to stop or restrict certain processing where we rely on our legitimate operational interests.

These rights are subject to applicable law and to the records we are legally required or operationally justified to keep. We respond to privacy requests promptly; if you contact us, we may need to verify your identity first.

The Service is not directed to children. You must be at least 13 years of age to use the Service (mirroring the minimum age required by our sign-in provider, Discord), and if you are between 13 and the age of majority in your country, a parent or legal guardian must have reviewed and agreed to our Terms of Use on your behalf.

We do not knowingly collect personal information from children under 13. If we learn that we have collected such information, we will take steps to delete it promptly.

FiveForge operates online infrastructure, and the third-party providers named in Section 5 may process data in regions where they operate. Personal information may therefore be transferred to, and processed in, countries other than the one you live in, including countries that may have different data-protection rules. When we transfer data, we rely on the provider's applicable safeguards and terms. We will not describe specific hosting regions in this Policy until the business confirms its operations and any legal review identifies the applicable safeguards.

The FiveForge Desktop application (Windows 10 / 11 (64-bit)) connects to your FiveForge account using a short-lived one-time handoff code; no login credentials are entered in or exchanged through the desktop application itself.

Distributable installers are SHA256-verified, and version compatibility is managed server-side. The website code does not collect telemetry, crash reports, hardware identifiers, or usage analytics from the desktop application.

We may update this Policy from time to time to reflect changes in the Service, the law, or our practices. When we do, we will update the “Last updated” date at the top of this page and, for material changes, make a reasonable effort to notify you (for example, by email or an in-product notice). Continued use of the Service after a change takes effect means you accept the updated Policy.

For any privacy-related question, request, or complaint, contact us at [email protected] or through the contact page. Please include enough detail for us to identify your account (without sending sensitive information unnecessarily) so we can resolve your request quickly.