Privacy policy

Who we are

FORMA is made by Forma Tech OÜ, a private limited company registered in Estonia (registry code 17641364), with its registered office at Tartu mnt 67/1-13b, 10115 Tallinn, Estonia. Forma Tech OÜ is the controller of the personal data described on this page.

For anything about your data, write to hello@forma.energy.

This policy covers this website, forma.energy, and the FORMA app: the app athletes and coaches use on their phones, and the web dashboard a box uses to run its classes.

This website

This website sets no cookies, runs no analytics and has no forms. It loads nothing from other companies: the pages, the stylesheet and the fonts all come from forma.energy.

To deliver a page, our hosting provider processes your IP address and the technical details your browser sends with the request. We keep no access logs of this website and do not use that information to identify you.

If you write to us, we receive your email address and whatever you put in the message, and we use them to answer you.

The FORMA app

If you use the app, we process:

• Your account: your name, your email address, your password (stored only as a salted hash), your gender, your language and, if you add one, your profile photo.
• Your boxes: the boxes you belong to, your role in each (athlete, coach, admin or owner), and the invitations and join requests that got you there.
• Your training: the classes you book or join a waitlist for, the attendance your coaches mark, the results you log, the private notes you keep on your results, and your registrations for events.
• What you post: your comments, and, if you work at a box, the programming, news, events and photos you publish for it.
• Notifications: your notification settings, the notifications we have sent you and, if you allow push notifications, a token that identifies your device to Apple's or Google's push service.
• Technical records: server logs that record each request by time, route, result and account identifier, without its contents; error reports when something breaks; and a count of failed sign-in attempts against an email address, which locks the account for a short time.

A box's staff can also keep a short note of when they got in touch with a member who has stopped coming, and can record a guest who comes for a trial or a drop-in class by name, without an account.

FORMA takes no payments and stores no payment details. We do not sell personal data and we show no advertising.

Why we use it

We use your data to run the service for you and for your box: to sign you in, show the timetable and the workout, take your bookings, keep your results and the leaderboards, deliver comments and news, and send the notifications and emails that go with them (an invitation, a password reset, a booking reminder). The leaderboards use your gender to rank men and women separately. The legal basis is the contract between you and us, the terms under which you use FORMA (GDPR Article 6(1)(b)).

We use the technical records to keep the service secure and to find and fix faults. The legal basis is our legitimate interest in running a safe and working service (Article 6(1)(f)).

Push notifications reach your phone only if you allow them there; you can turn them off at any time in the app or in your phone's settings.

We do not use your data for marketing, for advertising, or to make automated decisions about you.

Who helps us

Inside a box, what you do is visible to the people you train with: other members see your name, your photo, your results on the leaderboards and your comments, and the box's owners and coaches also see your bookings and attendance. You can hide your name from the list of people booked into a class.

We use these companies to run FORMA. Each processes personal data only on our instructions:

• Amazon Web Services hosts this website and the app, stores the database and the photos, and sends our emails, from its region in Ireland.
• Cloudflare answers the domain name lookups for forma.energy. It carries none of the pages or the app's traffic.
• Sentry receives the error reports, in the European Union. A report carries an account identifier, but no name, no email address and none of what was sent with the request.
• Google delivers push notifications to phones (Firebase Cloud Messaging) and hosts the mailbox behind hello@forma.energy (Google Workspace).
• Apple delivers push notifications to iPhones.

Sign-in runs on our own servers; no outside identity service is involved. We share personal data with no one else, unless the law requires it.

Outside the EU

The database, the photos and the error reports are stored in the European Union. Amazon, Cloudflare, Google and Apple are companies based in the United States, and delivering a push notification or handling an email can involve their systems there. Those transfers are covered by the EU–US Data Privacy Framework and by the standard contractual clauses in our agreements with them.

How long we keep it

We keep your account and what belongs to it for as long as the account exists. Nothing is deleted on a schedule yet. To have your account and your data deleted, write to hello@forma.energy and we will do it and confirm to you.

Server logs are kept for 30 days. A photo you remove is erased from storage seven days later.

The app will get its own way to export and delete your data; this section will be updated when it does.

Your rights

You can ask us for a copy of your data, have it corrected or deleted, ask us to restrict how we use it, receive it in a form you can take elsewhere, and object to a use that rests on our legitimate interest. Write to hello@forma.energy; we answer within one month.

You can also complain to a supervisory authority: the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee), or the authority of the country where you live.

Cookies and analytics

This website uses no cookies. The web dashboard uses cookies only to keep you signed in, and the phone app keeps the same sign-in on your device. Neither the website nor the app uses analytics or advertising trackers.

Changes

When what we do with personal data changes, this page changes first, and the date at the top with it. If a change matters to people who already use the app, we tell them in the app or by email.