Privacy Policy

Last updated: 21 October 2026

Who we are

FORMA is operated by Morten Aavad, an independent developer based in Denmark, who is the data controller for the personal data described below. For any question about this policy, or to exercise any of the rights listed further down, contact [email protected].

What we collect, and why

Your email address. Used to sign you in — either by sending you a login link, or, if you choose to sign in with Google or Apple, by receiving your email address from them once they've confirmed you own it. If you use Apple's "Hide My Email", the address we receive is a private relay address from Apple, and that is the one we use. If you connect more than one sign-in method to your account, we keep each of those addresses so that any of them signs you in to the same account. We do not store anything else from your Google or Apple account. Nothing else. We do not send marketing.

Your training and health data, retrieved from intervals.icu when you connect your account:

• Activities: duration, distance, power, heart rate, heart-rate streams, and the effort rating you gave the activity there (RPE and feel), if you gave one
• Wellness: resting heart rate, heart rate variability (HRV), sleep duration and quality, and your daily step count, used only to tell when you are awake before a morning notification
• Athlete settings: FTP, lactate threshold heart rate, maximum heart rate

Apple Health, only if you connect it in the FORMA app on iPhone. You choose which types to allow in Apple's own permission screen, and FORMA reads only those:

• Workouts: type, start and end time, duration and distance
• Heart rate, cycling and running power, cadence and speed during a workout. These are used to work out how hard the workout was, and are then discarded — they are not stored
• Sleep, resting heart rate and heart rate variability (HRV)

FORMA reads the last 140 days when you connect, and new data after that, also in the background. FORMA never writes anything to Apple Health. Data from Apple Health is used only to plan your training, is never used for advertising, and is never shared with or sold to anyone. When you disconnect Apple Health in FORMA, the workouts, sleep and heart data that came from it are deleted from our server; you can also withdraw access at any time in iPhone's Settings → Health → Data Access & Devices.

FORMA on Garmin (Connect IQ). When you use the FORMA data screen, your device sends the activity to FORMA after you save it: start time, duration, distance, sport, and second-by-second power, heart rate, cadence and speed, together with a device identifier and the pairing code. Data from a device that is not paired with a FORMA account is not added to any account. You can remove the data screen at any time; deleting your FORMA account deletes this data too.

Data you enter yourself: your goal and goal date, weekly availability, training preferences, weight, sex (used to correctly assess your power-to-weight level — optional, "prefer not to say" is always available), optionally how hard a session felt (RPE 1–10), the weights you log for a strength session, and roughly how many hours a week you trained lately, and how hard (an optional question on Today).

Why we need it: to calculate your training load, recovery and form, and to generate your training plan. That is the entire purpose. We do not profile you for advertising, we do not sell data, and we do not share it with anyone except as described under "Who else sees your data" below.

A name and a birthday, if you give them. Both are optional and entered by you, once, when you join. The name — a nickname is perfectly fine — is shown back to you at the top of the You tab, and you can change or clear it there at any time. The birthday is stored as day and month only, for greetings; the year, if you give it, is a separate field. I use the day and month so I can mark the day — for example a birthday note, or an occasional birthday offer. The year you were born, if you give it, is shown as your age on You and kept so the coach can take your age into account. Neither is health data, neither goes into your training plan, and neither is sold or shared beyond what is described here. Email support if you would like either removed.

Bug reports and ideas. If you send feedback from the app, we store your message together with your account. A bug report can, if you leave the box ticked, include a technical snapshot taken at that moment: which screen you were on and its visible text, your browser and screen size, and the last few errors, requests and taps in the app. It never includes your login. It is used only to reproduce and fix what you reported, and it is deleted with your account.

Your time zone. The app tells me your device's time zone, so that "today" in FORMA is your today, not the server's.

Login links. When you ask for a login link, I store a one-way scrambled version (a hash) of your IP address with it, only to stop anyone from flooding an inbox with links. It is deleted along with the expired link.

Legal basis

Training, heart rate, HRV and sleep data are health data — a special category under GDPR Article 9. We process it on the basis of your explicit consent (Article 9(2)(a)), which you give when you create your account and connect a data source.

You can withdraw consent at any time by deleting your account. Withdrawal does not affect processing that already took place.

Who else sees your data

Your training data goes nowhere. Your training plan is generated by FORMA's own software, running on our own server in Denmark. We do not send your training or health data to any other company — not to an outside AI service, and not to anyone else, except back to your own intervals.icu account as described below. The services below receive only what each line says.

intervals.icu — you connect your own account; we read your activities and wellness from it, and write your planned sessions and threshold numbers back to it when you send a session or turn on the calendar. Their handling of your data is governed by their own privacy policy.

Google (Sign-in) — if you choose to sign in with Google instead of the email link, Google confirms your email address to us as part of that login. We receive nothing else from your Google account.

Apple (Sign in with Apple) — if you choose to sign in with Apple, Apple confirms your email address (or a private relay address) to us as part of that login. We receive nothing else from your Apple account.

Apple (push notifications) — if you use the FORMA app on iPhone and allow notifications, I store your phone's push token and time zone, so I can send you two kinds of notification: a reminder to rate a ride, run or strength session after you have done it, and a morning note when last night's sleep has come in. Both are delivered by Apple's push service, which means their text passes through Apple: for the reminder, a short line asking you to rate the session and, if the activity has one, its name; for the morning note, "Last night's sleep is in" and "Your recovery for today has been updated". Nothing else is sent. You can turn each of them off in the app or in your phone's settings, and the token is deleted with your account.

Brevo (email delivery) — your login links, and a few personal emails from FORMA's founder about your account (a welcome the day after you join, and a short note if you cancel), are sent by email, which means your email address passes through Brevo, the service we use to send them. Brevo is an EU-based provider acting as our processor. Nothing else about you is included: a login email contains only the link, and a personal email only your first name and, after a cancellation, the date your Pro ends. Every personal email has an unsubscribe link, so you can opt out at any time. We never send Brevo your training or health data.

Stripe — if you subscribe, your payment is handled by Stripe. We never see or store your card details; they go directly to Stripe. We store only the identifiers Stripe gives us to recognise your subscription, and your email address is shared with Stripe so it can issue receipts. Stripe acts as our processor for handling the payment, and as an independent controller for its own fraud prevention and legal obligations — its handling is governed by Stripe's privacy policy. We never send Stripe your training or health data.

Apple (in-app purchases) — if you subscribe in the iPhone app, Apple handles the payment. I receive only what I need to recognise your subscription: the purchase ID, the plan, the price, and when it renews or ends. I never see your card or Apple ID details. Apple's handling is governed by Apple's privacy policy.

Our server — the application runs on a server operated by us in Denmark. Your training and health data stays in the EU/EEA. Stripe, Google and Apple are US-based companies and may process what is described above — your email address, payment identifiers and, in the iPhone app, a reminder's text — outside the EU/EEA, under the safeguards their own agreements provide.

We use no advertising networks, no analytics trackers and no third-party cookies.

How your data is protected

• Access requires either a one-time login link sent to your email, or signing in with a Google or Apple account that has confirmed the same address. We store no passwords — we have none to lose, with any of these methods.
• Login links and session tokens are stored only as cryptographic hashes.
• Your intervals.icu API key is encrypted at rest.
• All traffic runs over HTTPS.

Note honestly: no system is perfectly secure, and anyone with access to our running server could in principle read stored data. We limit that access to the operator alone.

How long we keep it

We keep your data for as long as you have an account. When you delete your account, all of it — training data, plans, settings and account — is permanently deleted. There is no archive copy.

Expired login links and sessions are deleted automatically.

Your rights

Under GDPR you have the right to:

• Access the data we hold about you
• Rectify anything inaccurate
• Erasure — delete your account from within the app (under Connections), and everything in it goes within 7 days. Signing in again within those 7 days cancels the deletion.
• Portability — receive your data in a machine-readable format
• Object to or restrict processing
• Withdraw consent at any time

Write to [email protected] to exercise any of these. We respond within 30 days.

You also have the right to complain to Datatilsynet (the Danish Data Protection Agency), Carl Jacobsens Vej 35, 2500 Valby, [email protected].

Cookies

We set a session cookie that keeps you signed in — technically necessary, contains no tracking, deleted when you log out. If you sign in with Google or Apple, a second, short-lived (10-minute) technical cookie is also set during that one login step, to confirm the login came from you and not a forged link; it is not used for anything else and expires automatically. If you arrive through a referral link, a cookie remembers that code for 30 days, so the person who referred you can be credited when you create an account; it holds only the code. Two more short-lived technical cookies are used only during setup: one (30 minutes) holds a pending sign-in while you confirm which account it belongs to, and one (10 minutes) confirms that a device connection you start came from you. Neither is used for anything else.

This is not medical advice

FORMA generates training suggestions from your data. It is a training tool, not a medical device, and it does not diagnose, treat or prevent illness. Do not use it as a substitute for medical advice. If you feel unwell, consult a doctor rather than a training plan.

Changes

If we change this policy in a way that affects how we handle your data, we will notify you by email and ask for renewed consent where the law requires it.