Privacy policy

Draft, not yet in force. This page is still being reviewed and has parts left to fill in. Forward's Free and Premium editions are not released yet; nothing here applies to anyone until they are.

Effective [EFFECTIVE DATE].

This policy covers the Free and Premium editions of Forward: the ready-made app, the Forward account, and Forward’s server.

The Community edition is different. It is open source software that you build and run yourself. It has no account, uses no Forward server, and sends nothing to us. This policy does not apply to it. Its own page at the Community edition page says what it does.

Free and Premium are not released yet. This policy describes how they work when they are.

The short version

• One computer of yours holds your data and runs the Coach. The Coach never runs on our server.
• Our server holds your account. In Premium it also holds a copy of your data for sync and backup, encrypted on your devices with keys we never have. We cannot read it.
• We cannot recover your data. You keep a recovery key.
• Requests to Claude go from your computer, either with your own Anthropic key or through Forward’s Relay. The Relay stores nothing. It does see a request in memory while passing it on.
• Google tokens and calendar data stay on your computer. If you connect Google Contacts, your contacts are kept on your computer too, and are part of your own backups.
• No advertising, no analytics, and nothing sold.

1. What Forward is, and who is responsible for it

Forward is an app for looking after the parts of your life: Areas, Goals, Projects, Tasks and Pages, with an AI Coach that files things for you and proposes a short list for each day.

Forward is published by [RESPONSIBLE PARTY], called “we” on this page. We make the app, run Forward’s server, and publish this policy. For the little we hold about you, described in section 3, we are responsible.

2. What Forward holds, and where

On your own computer

One computer of yours, your home computer, holds everything:

• your Areas, Goals, Projects, Tasks, Milestones and Deadlines;
• your Pages, and the pictures in them;
• what you tell Forward about yourself: your name, pronouns, date of birth if you give it, your working rhythm, and what helps you and what gets in your way. All of it is optional;
• the Activity Log: a record of what you, the Coach and any Claude session you directed have done, including what you told the Coach about your day;
• your settings;
• keys and tokens for the services you connect, in a file only your user account on that computer can read. They are never shown again after you save them, and never put in a backup, an export or the copy held by our server;
• from GitHub, if you connect it: the open issues of repositories you link, as Tasks;
• from Google Calendar, if you connect it: the list of your calendars and the events on the ones you select;
• from Google Contacts, if you connect them: each contact’s name, email addresses, phone numbers, birthday and anniversary.

The Coach runs on this computer and nowhere else.

On your other devices (Premium)

Your other devices keep an encrypted copy of your data so you can use Forward on them. When you ask the Coach something from a device that is not your home computer, the question travels to your home computer as a sealed message, and the answer comes back the same way. Our server passes these messages along and cannot open them.

3. What our server holds

Your account

Your account holds:

• your name, email address and postal address;
• your sign-in details;
• whether you have a subscription;
• the public keys of your devices.

We use your name and address to check who you are, to decide whether Forward can be offered where you live, and to know which rules apply to how we handle your account. We use your email address to sign you in and to tell you about your account and about changes to this policy. We do not use any of it for advertising, and we do not sell it.

In the Free edition this is all our server holds about you. None of what you put into Forward is sent to it.

Where Forward is offered

At launch, the Free and Premium editions are not offered to people who live in the European Union or the United Kingdom. If your address is there, you will not be able to create an account. This does not affect the Community edition, which has no account.

A copy of your data that we cannot read (Premium)

For sync and backup, our server holds a copy of your data. It is encrypted on your own devices before it leaves them, with keys that our server never has. We see that an encrypted store exists, how large it is, and when it changes. We cannot read it, search it, or hand over a readable copy to anyone, because we do not have one.

Sealed messages between your devices (Premium)

Our server passes sealed messages between your own devices. It holds each one only until it is delivered and cannot open it.

Usage of the Relay (Premium)

When your Coach uses Forward’s Relay, we record how much was used and when, to count it against your subscription. We do not record what was asked or answered.

What a server unavoidably sees

Like any server, ours sees the internet address your device connects from, and when. [SERVER LOG DETAILS AND RETENTION]. The app also checks our server for updates, which sends the app’s version and nothing about your data.

Our server is hosted by [HOSTING PROVIDER AND REGION].

What we do not collect

The app contains no advertising and no analytics. It does not report how you use it, and it does not send crash reports.

4. Device keys, the recovery key, and what we cannot do

Each of your devices has a key of its own. A new device is approved from one you already trust, directly between the two, not through our server.

When you set Forward up you are given a recovery key. Keep it somewhere safe.

• We cannot recover your data. If you lose every device and the recovery key, the encrypted copy on our server cannot be opened by anyone, including us.
• We cannot reset your way back in to your data. Resetting a forgotten account password does not unlock the encrypted copy.
• Support cannot look at your data, even if you ask us to.
• There is no web version of Forward and no search on our server, for the same reason.

5. What leaves your computer

5.1 Claude, by Anthropic

The Coach thinks with Claude, a model made by Anthropic. A request goes from your home computer to Claude in one of two ways.

With your own Anthropic API key (Free, and Premium if you choose). The request goes straight from your computer to Anthropic, under your own agreement with Anthropic. It does not touch our server. Anthropic charges you, and Forward stops asking Claude when the monthly Budget you set is used up.

Through Forward’s Relay (Premium, when you use no key of your own). The request goes from your computer to our Relay, which adds Forward’s key, counts the usage, and passes it to Anthropic under our agreement with Anthropic. The answer returns the same way. To be exact about this:

• The Relay stores nothing of a request or an answer. Neither is written to disk or to a log, and neither is readable at rest on our server.
• The Relay does see the text of a request and its answer in memory for the moment it takes to pass them on. It has to, in order to forward them.

What a request contains:

• When you ask the Coach to file something: the line you typed, and the names of your Areas, Goals and Projects with the short description of what each covers.
• When the Coach proposes your Today: the date and time, your open Tasks (title, where each belongs, any Deadline and Difficulty), what you have told Forward about yourself except your date of birth, recent lines from your Activity Log, and anything you say to the Coach about the day.

Either way, Anthropic receives the request and handles it as described in Anthropic’s privacy policy.

5.2 Deciding what may leave: Sync and Coach Access

Two settings let you tighten this for any part of your life: an Area, a Goal, a Project, or a single Task or Page. A setting applies to everything beneath it, and can only be made tighter further down, never looser.

Sync: Sync to the cloud, or Keep on this device only. Something kept on one device only is never sent to our server and is left out of automatic backups. It is included when you export to a file yourself. Forward tells you this when you choose the setting. If you change something from synced to one device only, it is deleted from our server, and from the server’s own backups within [BACKUP RETENTION PERIOD].

Coach Access: through Forward, with your own key only, or cannot read. Something the Coach cannot read is never included in a request to Claude, and is hidden from Claude sessions you direct as well. Note that with your own key only still sends the text to Anthropic, straight from your computer. It keeps it away from our Relay, not on your device.

The Coach tells you when there were things it could not see. Each request to Claude is noted in your Activity Log with what it included, so you can check.

5.3 GitHub

Only if you connect GitHub and link a repository to a Project. Forward reads the open issues of the repositories you linked and shows them as Tasks. When you finish or reopen one of those Tasks, Forward closes or reopens the matching issue. The requests go from your computer to GitHub, as you. Our server is not involved. GitHub’s handling is described in GitHub’s privacy statement.

5.4 Backups

To a git repository of your own (Free, and Premium if you choose). Forward sends a readable copy of your data from your computer to a repository you name: your Pages and their pictures, and your Areas, Goals, Projects, Tasks, Activity Log and what you have told Forward about yourself. It never includes keys or tokens, anything you keep on one device only, or calendar data read from Google. Whoever hosts that repository receives it. Use a private repository.

Held by Forward (Premium). Backups are part of the encrypted copy described in section 3. We cannot read them.

5.5 Google Calendar

Only if you press “Sign in with Google” in Settings → Integrations. Section 6 covers it in full.

5.6 Claude sessions you direct

If you register Forward’s connector with a Claude session of your own, that session can read and change your Tasks and Pages when you ask it to, subject to Coach Access. What it reads becomes part of that session, under the terms of the Claude product you are using.

5.7 Talking with the Pet

Voice runs on your own computer. A helper that Forward starts there listens through your microphone, turns what you say into text, and speaks the Pet’s replies. Sound never leaves your computer and is not kept. What you said goes to the coach as text, exactly as if you had typed it, and is covered by section 5.1.

Voice is off until you turn it on. Turning it on downloads the listening and speaking software to your computer, after Forward has told you how large it is. If you choose the Chatterbox voice, each thing it says carries an inaudible watermark put there by its maker, Resemble AI.

5.8 Job Avanti

Only if you connect it, by giving Forward the address of your Job Avanti and an access token you make there. Forward reads your work, volunteer and education history and your job search from it every fifteen minutes, keeps what it reads on your computer, and tells you what is new. The coach is shown it unless you switch that off, in which case it is not included in requests to Claude. The coach may propose a change to Job Avanti; nothing is changed there until you approve it, and each change can be undone. What is read from Job Avanti is not included in backups, and Claude sessions you direct are told nothing of it.

6. Google user data

This section applies if you connect Google Calendar or Google Contacts in the Free or Premium edition.

What Forward asks Google for, and why

If, and only if, you press “Connect Google Contacts”, Forward also asks for:

Forward asks for nothing else from Google: not your email or files.

Google Contacts and the Coach

Unless you switch it off on the Contacts screen, the Coach is told each contact’s name, how you have said they are related to you, their birthday and anniversary, and when you were last in touch, when you talk to it. Email addresses and phone numbers are never sent to Claude. The Coach may suggest a change to a contact; nothing is changed, in Forward or in Google, until you approve it, and each change can be undone. Those requests go to Anthropic in the same way as the calendar times described below.

How Forward uses it

Only to provide features you can see in the app: your next meeting in the menu bar, events on a Project’s calendar tab, planning your day around your commitments, and the Forward Calendar itself.

How it is stored and protected

• The sign-in happens between your computer and Google. Our server takes no part in it.
• The token Google issues is kept on your home computer, in a file only your user account can read. It is never shown in the app, never put in a backup or an export, never placed in the copy held by our server, and never sent anywhere except to Google.
• Calendar data read from Google is kept on your home computer. It is not placed in the copy held by our server, and it is not included in backups.
• Contacts read from Google are kept on your home computer, together with what you add about each person in Forward. Unlike calendar data they are part of your Forward data: they are included in your own backups and exports.
• Requests to Google travel over an encrypted connection (HTTPS).
• When another of your devices shows calendar information, it reaches that device from your home computer as a sealed message that our server cannot open.

Calendar events and the Coach

Your calendar is not sent to Claude unless you turn on a separate setting that lets the Coach plan around it. The setting is off until you turn it on.

With it on, when the Coach proposes your Today, Forward includes the start and end times of that day’s events from your selected calendars in the request to Claude, so that your day can be fitted around them. Titles, people, places, descriptions and links are not sent.

That request goes to Anthropic. If your Coach uses your own key, it goes straight from your computer. If your Coach uses Forward’s Relay, it passes through the Relay, which sees it in memory while forwarding it and does not store it, as section 5.1 describes. Turn the setting off and the Coach plans without your calendar.

What Forward does not do with it

• It is not sold.
• It is not used for advertising, including personalised or interest-based advertising.
• It is not transferred to anyone else, except as needed to provide a feature you asked for. The only such case is the one above: with the setting on, the start and end times of the day’s events are sent to Anthropic to propose your Today, through the Relay if your Coach uses it.
• It is not used to train AI models. Forward does not use data from Google Workspace APIs to develop, improve or train generalised or non-personalised AI or machine learning models.
• It is not read by humans. Nobody at Forward can see it. It is on your computer, and the only copy that crosses our server is the event times above, in memory, which no person reads.
• It is not used to judge creditworthiness or for lending.

Limited Use

Forward’s use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Keeping and deleting it

When you disconnect Google, your contacts stay in Forward as your own records and are no longer kept in step with Google; you can delete everything Forward holds from Settings. Forward keeps calendar data on your computer for as long as Google Calendar is connected. When you disconnect, Forward removes the Google token and the calendar data it had read. The Forward Calendar and its events are in your Google account and stay there until you delete that calendar in Google Calendar. You can also remove Forward’s access at any time at myaccount.google.com/permissions.

7. Disconnecting a service

Each service has a Disconnect control in Settings → Integrations.

8. Payments

Forward’s Free edition costs nothing. Premium is a subscription.

Payment is taken by [PAYMENT PROCESSOR]. They receive your payment details and handle them under their own privacy policy. We do not receive or keep your card number. We keep a record that you have a subscription, its dates, and what we need for tax and accounting, which includes your name and address.

If a subscription ends, nothing is unlocked or loosened. Your data stays on your home computer. The Coach stops using the Relay, and you can go on with a key of your own.

9. Exporting, deleting, and closing your account

In Settings → Your data:

• Export everything saves one file holding your Areas, Goals, Projects, Tasks, Pages and what Forward knows about you, including anything kept on one device only. It holds no keys or tokens. You keep the file.
• Import from a file replaces what Forward holds with the contents of such a file.
• Delete everything removes your data from your computer, disconnects every service you connected, removing their keys and tokens, and in Premium deletes the encrypted copy on our server. Copies in the server’s own backups are gone within [BACKUP RETENTION PERIOD].

Closing your account removes your account details and any encrypted copy from our server within [ACCOUNT DELETION PERIOD], apart from payment records we must keep by law.

Deleting in Forward cannot reach copies held elsewhere: your own backup repository, issues on GitHub, the Forward Calendar in Google, or anything Anthropic holds. Remove those with each service.

You can ask us for a copy of what we hold about you, which is your account details (your name, email address and postal address) and payment records, and you can correct them in your account. We cannot give you a readable copy of your Forward data, because we do not have one. Export it from the app.

10. Children

Forward is for people aged 13 and over. It is not directed to children under 13, and we do not knowingly create accounts for them. If we learn that an account belongs to a child under 13, we will close it and delete what our server holds for it. Signing in with Google is optional, and Forward works in full without it.

11. Changes to this policy

When this policy changes, we will publish the new version here with a new date and tell you by email or in the app. If a change affects how Forward uses information from Google, Forward will tell you in the app and ask for your agreement before using it in the new way.

12. Getting in touch

Questions about this policy or about how Forward handles information: hello@movemeforward.com.