Privacy Policy

Forge Stack is a digital product (a boilerplate codebase). This privacy policy explains what data we collect when you interact with forgestack.dev, purchase Forge Stack via Gumroad, or use the boilerplate code in your own projects.

Short version: we collect the minimum data needed to deliver the product and support you. We don't sell your data. We don't track you across the web.

When you visit forgestack.dev

• Standard server logs (IP address, user agent, request URL) — retained for 30 days for security and debugging
• Aggregate analytics (page views, referrers) — via a privacy-respecting analytics tool, no personally identifiable tracking

When you purchase Forge Stack via Gumroad

• Your email address (for delivery + license verification)
• Your name (if provided at checkout)
• Payment information (handled entirely by Gumroad; we never see your card details)
• Purchase date and tier

When you use Forge Stack code in your own project

We collect nothing. The boilerplate runs on your infrastructure, your Supabase project, your Stripe account. Any data collected by your deployed application belongs to you and is governed by your own privacy policy.

• To deliver Forge Stack (GitHub repo access, update notifications)
• To provide customer support (responding to your emails)
• To send product updates (max 1 email/month; unsubscribe anytime)
• To detect and prevent abuse (e.g., chargebacks, license violations)

We do NOT use your data for:

• Advertising or remarketing
• Selling to third parties
• Building user profiles for marketing purposes

We use the following third-party services:

• Gumroad: Payment processing and product delivery. See gumroad.com/privacy.
• GitHub: Private repository hosting. See GitHub's privacy policy.
• Vercel: Hosting plus aggregate analytics for the Forge Stack site. See Vercel's privacy policy.
• Sentry: Optional error monitoring when enabled. The starter disables default PII collection. See Sentry's privacy policy.
• Resend: Transactional email delivery. See Resend's privacy policy.

forgestack.dev uses minimal cookies:

• Essential cookies for session management in the starter auth flow
• Aggregate site analytics via Vercel Analytics; no advertising or cross-site tracking pixels

We do not use advertising cookies. We do not use third-party tracking pixels.

You have the right to:

• Request a copy of all data we hold about you
• Request deletion of your data
• Opt out of marketing emails (unsubscribe link in every email)
• Request a refund within 14 days of purchase

To exercise any of these rights, email hello@forgestack.dev.

• Purchase records: retained for 7 years (tax/legal requirement)
• Support emails: retained for 2 years
• Server logs: retained for 30 days, then deleted
• Marketing email list: retained until you unsubscribe

We take reasonable precautions to protect your data:

• HTTPS encryption in transit
• Access controls on internal systems
• Payment data never touches our servers (handled by Gumroad)
• GitHub access granted via private invite, revocable

No system is 100% secure. If we discover a breach affecting your data, we'll notify you within 72 hours.

Forge Stack is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has purchased Forge Stack, contact us for a refund and data deletion.

We may transfer your data to countries other than your own for processing (e.g., Gumroad is US-based). By using Forge Stack, you consent to these transfers. We rely on standard contractual clauses and the GDPR's adequacy decisions where applicable.

If you're in the EU/EEA, you have additional rights under GDPR:

• Right to access your data
• Right to rectification
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to lodge a complaint with your local data protection authority

Our legal basis for processing: contract performance (delivering the product you purchased) and legitimate interest (customer support, fraud prevention).

If you're a California resident, you have the right to:

• Know what personal information we collect and how it's used
• Request deletion of your personal information
• Opt out of the sale of personal information (we don't sell your data)

We may update this privacy policy occasionally. Material changes will be announced via email at least 30 days before they take effect.

Questions about this privacy policy? Email hello@forgestack.dev.