SECURITY
What FORMD does to protect your account, your training data and your payments — and how to reach us if you find a problem.
Practices
Your data is isolated per account
Every database table is protected by row-level security: a request can only read or change rows that belong to the signed-in account (or, for coaches, athletes who have accepted that coach). Default deny, explicit allow.
We never store card numbers
Payments are handled by Apple (App Store), Google Play and Stripe. FORMD receives subscription status through signed webhooks whose signatures are verified before anything is recorded.
Encrypted in transit and at rest
tryformd.com and the app talk to our backend only over HTTPS with HSTS enforced. Data is hosted on Supabase (AWS) and encrypted at rest.
Health data is treated as sensitive
Apple Health and workout data sync only with your permission and is used for your own predictions and plan. It is never sold.
Sign-in you control
Accounts use Supabase Auth with email + password or Sign in with Apple. You can delete your account and its data from inside the app or by writing to privacy@tryformd.com.
Secrets stay server-side
API keys and service credentials live in the backend and are rotated on a schedule; the public web and mobile bundles carry only publishable keys.
Who processes your data
Every third party with access to personal data is listed, with what it does and where it runs, on the sub-processor list. How we use data is in the privacy policy.
Report a vulnerability
If you believe you have found a security issue, email support@tryformd.com with the steps to reproduce it. Please give us a reasonable window to fix it before publishing. Our machine-readable disclosure details are at /.well-known/security.txt.