Privacy.

How Forma handles your information.

Effective September 14, 2026

Your account and Google sign-in

When you create an account, Forma stores your email address, account identifier and profile information. If you sign in with Google, Google provides your basic profile information, such as your name, email address, profile picture when available, and a Google account identifier. We use this information to authenticate you, associate you with your Forma account and support account features. Forma does not request access to your Gmail messages, contacts, calendar or Google Drive.

Account authentication and cloud features use Supabase. Google account information is not sold, used for targeted advertising, or used to train generalized AI models. It is shared with service providers only as needed to operate these account features, or when legally required. You can revoke Forma’s access through your Google Account’s third-party connections settings.

Your records

Entries, schedules, notes and other tracking records are stored on your device. Optional cloud backup uploads your selected app backup to your Forma account through Supabase. Your tracking history is not automatically published to Community. If you enable Apple Health access, Forma reads or writes the categories you authorize; you can change those permissions in Apple Health or Settings.

Community

Community is public. Posts, replies, your chosen display identity and profile image may be visible to other people. Choose what you share carefully. Account email addresses are not displayed as your public Community identity. Content and account information may be processed to handle reports, prevent abuse and enforce Community rules.

AI and label scanning

When you use Ask Forma, your messages and recent replies are sent through Forma’s assistant service to OpenRouter and its selected AI provider. Web searches may send terms from your question to a search provider. Optional reports explain which summaries or notes are shared before you generate them. Label scanning processes the image on your device; if you request AI assistance, extracted label text is sent to the AI service. The scanner photo is not uploaded by that feature. These services process submitted content under their own policies, including OpenRouter’s privacy policy.

Website questions

If you use the website’s Forma AI question box, your question and up to three recent question-and-answer pairs are sent through Cloudflare to OpenRouter and its selected AI provider. No app records or account details are attached. Avoid entering personal health information. This conversation stays in page memory until you clear it or leave the page. Forma does not save FAQ questions or replies in a database. A keyed hash of your network address is used for short-lived request limits; provider and hosting security logs follow their own retention policies.

Early access and website operation

If you join the early-access list, we store your email address, signup time and consent to receive beta invitations and launch news. We do not collect health records through the signup form. Contact us to leave the list; any marketing email we send will include an opt-out method.

Cloudflare hosts this website, and Google Fonts serves its web fonts. Hosting and backend providers process technical information such as network addresses, request times and security logs to deliver the service and prevent abuse. Forma’s signup rate limiter stores a keyed hash of the network address instead of the raw address, and clears expired rate-limit records during subsequent signup processing.

Retention and your choices

We retain account information and cloud content while needed to provide your account and related services. You can delete your account and cloud data in Forma’s account settings. This removes the account, cloud backup, posts and replies; records saved on your device remain until you remove them separately. You can export your local records in the app. Service-provider backups and security logs may persist for their normal retention periods or where retention is legally required.

For access, correction, deletion or early-access removal requests, email [email protected]. We may need to verify ownership before acting on account requests.

Changes

We update this page when our practices change and revise the effective date above. Material changes will be communicated through the app or other appropriate channels.