Last updated: September 10, 2026
Refinery Consulting ("Company," "we," "us," or "our") operates the Reforge Fitness™ platform ("Platform"), accessible at reforgefitness.app and related applications. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Platform.
By creating an account on the Platform, you acknowledge that you have read and understood this Privacy Policy. Where required by applicable law, we will obtain your explicit consent before processing your personal data. You may withdraw consent at any time without affecting the lawfulness of processing performed before withdrawal.
We collect personal information that you voluntarily provide when you:
This information may include:
The Platform collects data that may be considered health-related under applicable laws, including: workout session history and performance metrics, exercise repetitions and weights lifted, body measurements (if provided), nutrition estimates, GPS-tracked running routes and pace data, and movement assessment results. We use this data to provide the fitness tracking and coaching features you select. Authorized staff at your organization can access information needed for their role. Our hosting and storage providers process this information to operate the service. Optional AI sharing is described in Section 8 and requires a separate choice before information is sent to Google Gemini. We do not sell health or fitness data or use it for advertising.
When you use the GPS run tracking feature, we collect precise GPS coordinates (latitude and longitude) at regular intervals throughout your run. This data is used to display your running route, calculate distance and pace, and store your run history. Location is collected only during a run you start and with your device's permission. On supported mobile devices, an active run can continue recording while the screen is locked or the app is in the background; stopping the run stops tracking. You may disable location services at any time through your device settings. Stored GPS data can be deleted by deleting individual run sessions or your account.
The Platform allows you to upload exercise videos, movement review recordings, and automated timelapse recordings during workouts. These recordings capture your physical likeness and body movements. We do not extract biometric identifiers (such as facial geometry, fingerprints, or retinal scans) from these recordings. We do not use facial recognition or body scanning technology. Videos are stored solely for the purposes you provide them (coach review, personal records) and are subject to the data retention periods described in Section 9. We do not sell, lease, trade, or otherwise profit from your video recordings or any biometric-adjacent data.
When you use the Platform, we may automatically collect certain information about your device and usage, including IP address, browser type, operating system, pages viewed, features used, and timestamps. Cloudflare processes network and request information to host, deliver, and protect the service. Our infrastructure providers may retain operational and security logs. We do not use this information for advertising or cross-app tracking.
The Platform uses only strictly necessary cookies that are essential for the functioning of the Platform. Under applicable privacy laws (including the ePrivacy Directive), these cookies do not require your consent because the Platform cannot function without them. These include:
We do not use third-party advertising cookies, cross-site tracking pixels, or analytics cookies. You can configure your browser to block all cookies, but this may prevent you from using the Platform.
We use the information we collect to:
We use Stripe to process payments. When you make a purchase or subscribe, your payment information is transmitted directly to Stripe and is never stored on our servers. Stripe is PCI-DSS Level 1 certified, the highest level of payment security certification.
Organizations that collect payments from members through the Platform use Stripe Connect. Payment information for those transactions is handled entirely by Stripe. Refinery Consulting does not have access to your full payment card details.
For more information, visit Stripe's Privacy Policy.
The Platform operates as a multi-tenant system where each Organization's data is logically isolated. This means:
In most cases, the Organization (gym, studio, or wellness provider) that you are a member of acts as the data controller for your personal information collected through their use of the Platform. Refinery Consulting acts as a data processor, processing your data on behalf of the Organization in accordance with our agreement with them. For data we collect directly (such as account registration, Platform usage data, and payment information for Platform subscriptions), Refinery Consulting acts as the data controller.
If you have questions about how your Organization processes your data, please contact your Organization directly. For questions about data we control directly, contact us at support@refinery.consulting. A Data Processing Agreement is available upon request for Organizations that require one.
We do not sell, trade, or rent your personal information to third parties. We may share your information with the following service providers who assist in operating the Platform:
Providers process information according to the service terms and privacy protections applicable to the services we use. We select services appropriate for the information they process. Links to provider policies and further information are available through support. We share information with law enforcement only when legally required or otherwise permitted to protect people and the service.
Optional AI features use Google Gemini. Before sharing, the app identifies Google as the recipient, describes the information involved, and asks you to allow that feature for your current signed-in session. You can decline and continue using non-AI features, including manual nutrition entry and ordinary workout tracking.
We use the paid Gemini API service. Under Google's paid-service terms, prompts and responses are not used to improve Google's products or train its general-purpose models. Google may retain prompts and responses for a limited period for safety, abuse prevention, and legal compliance. Processing may occur outside your country. Reforge stores saved AI results with the related feature data; using AI does not mean that Google keeps no copy.
See Google's paid Gemini API terms and data processing terms. Resetting permission prevents future sharing until you allow it again; it cannot recall content already processed.
The Platform uses AI to generate exercise images, suggest workout programming, and estimate nutritional content. These AI features are assistive tools and are not used to make decisions that produce legal or similarly significant effects on you. All AI-generated workout plans and nutritional estimates are suggestions only and should be reviewed by your coach or a qualified professional before relying on them. You have the right to request human review of any AI-generated recommendation or estimate. Coaches and organization administrators can modify or override all AI-generated content.
We retain account and activity information while needed to provide your account and the services you request. You can delete your account in Account settings. This cancels supported active subscriptions and removes your account, personal activity records, and associated personal uploads from our active systems. Organization-owned content may remain when it belongs to the organization rather than to your personal account.
Some records may be retained where necessary for tax, accounting, fraud prevention, dispute resolution, or other legal obligations. Service-provider logs and backup copies follow the retention schedules of those services and are not necessarily erased immediately when active records are deleted. Retention depends on the type of record, the service involved, and applicable requirements. Contact support for information about your records or a deletion request that cannot be completed in the app.
Resetting AI sharing permission does not delete saved activity or recall information already processed by Google. Google's retention of AI requests is described in Section 8.
We implement industry-standard security measures to protect your data, including:
However, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security, and you use the Platform at your own risk.
In the event of a data breach that compromises the security, confidentiality, or integrity of your personal information, we will notify affected users and applicable regulatory authorities in accordance with applicable law, within the timeframes required by those laws. Notification may be provided via email, in-Platform notice, or other reasonable means.
Depending on your jurisdiction, you may have the right to:
To exercise any of these rights, contact us at support@refinery.consulting.
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).
We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising purposes.
You have the right to limit our use of your sensitive personal information (including precise geolocation and health-related fitness data) to uses necessary to provide the services you requested. To exercise this right, contact us at support@refinery.consulting.
To exercise these rights, submit a verifiable consumer request by emailing support@refinery.consulting. We will verify your identity before fulfilling your request. You may designate an authorized agent to make requests on your behalf. We will respond within 45 days.
If you are located in the European Economic Area, United Kingdom, or Switzerland, the following additional terms apply.
We process your personal data on the following legal bases:
Your personal data may be transferred to and processed in the United States and other countries outside the EEA/UK. We rely on the following transfer mechanisms:
Our service providers (Supabase, Stripe, Cloudflare, Google) maintain appropriate data transfer mechanisms.
In addition to the rights listed in Section 11, you have the right to:
For GDPR-related inquiries, contact us at support@refinery.consulting. We will respond within 30 days.
The Platform is intended for adults aged 18 and over, consistent with our Terms of Service. We do not knowingly permit children to create accounts or provide their personal information through the Platform.
Organizations must not use the Platform to create accounts for minors or upload their personal information. Parental supervision does not override the minimum account age.
If you believe a person under 18 has provided personal information, please contact us so we can investigate and remove the account and associated information as appropriate at support@refinery.consulting.
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. We will make reasonable efforts to notify you of material changes via the Platform or email. Your continued use of the Platform after changes are posted constitutes your acceptance of the updated policy.
If you have questions or concerns about this Privacy Policy or our data practices, please contact us: