Privacy Policy

Who we are

Forge180 is an LSAT preparation service operated by Forge180, LLC, a Virginia limited liability company ("Forge180," "we," "us," or "our"). This policy explains what personal information we collect through forge180.com and the Forge180 application (the "Service"), why we collect it, who we share it with, and the choices you have.

The Service is offered to users in the United States. We operate in the United States and store your information there. We do not offer the Service to individuals in the European Economic Area, the United Kingdom, or Switzerland.

What we collect

• Account information. Your email address and a password, stored only as a salted one-way hash so we cannot read it. If you use Google sign-in, Google sends us a signed token with your Google account identifier, email address, whether Google has verified it, and your name; we keep the identifier and the email address, not the name, and never your Google password.
• Study data. Answers, questions completed, timing, evaluation and practice-exam results, drill history, notes you write, and questions you flag. This is the data the product exists to analyze.
• AI tutor messages. What you send the tutor and the question you were working on. How long these are kept is described under "AI features" below.
• Support email. Your messages to us and our replies.
• Skill analytics we compute from your study data, which drive your recommendations and adaptive drills.
• Usage counts for the AI features, which meter any limits described on our pricing page, together with the operational measurements we need to keep the Service running and improve it. We do not use advertising or cross-site tracking analytics, and nothing we measure is used to profile you or follow you across other sites.
• Server logs. IP address, the request made, and a timestamp, recorded by us and our hosting provider and rotating on their schedule.
• Authentication events. Sign-ins, failed sign-ins, account creation, password resets, and verification sends, with the associated IP address, kept to detect abuse and investigate account-security reports.

We never see or store your full payment card number. If you subscribe, our payment processor (currently Stripe) collects your card details directly and we receive only a customer identifier, your subscription status, and limited billing metadata. We do not collect biometric data, precise geolocation, or special categories of personal data, and we ask that you keep those out of your notes and tutor messages.

How we use it

To run the Service and keep you signed in; to personalize your drills, analytics, and recommendations; to run the AI tutor; to handle trials, subscriptions, and billing; to send verification, password-reset, support, and service messages; to keep the Service safe through rate limits, fraud and abuse prevention, and checking new passwords against public breach corpora; to improve the product in aggregate; and to meet our legal obligations.

We do not sell your personal information, and we do not share it for cross-context behavioral or targeted advertising. Marketing email, if we ever send it, is separately opt-out and never mixed into the email your account requires.

Who we share it with

Only with providers who process it on our behalf, under contract. These are the providers we use as of the "Last updated" date above. We may add or replace a provider with another of the same kind, such as a different email service or AI provider, and will update this list when we do. A genuinely new class of recipient gets the advance notice described at the end of this policy.

We may also disclose personal information where the law reasonably requires it or to protect the rights, property, or safety of Forge180, our users, or the public; in a merger, acquisition, or sale of assets, in which case we will tell you before your information becomes subject to a materially different policy; and when you ask us to. We may publish aggregated or de-identified statistics, which cannot reasonably be used to identify you.

AI features

The AI tutor and guided walkthroughs run on large language models operated by the AI provider named in the table above. Your message and the question you are working on are sent to that provider so it can generate a reply; your name, email address, and account identifier are not. Under our commercial agreement, your inputs and the outputs generated for you are not used to train the provider's models, though it may retain content briefly for abuse monitoring under its own enterprise policies. We hold any AI provider we use to those same two conditions.

Your conversation is held in your browser while you work, and each message is sent with enough of the recent exchange for the tutor to follow the thread. We keep tutor conversations only for as long as the feature you are using requires. Today that means no message text is retained on our side at all. We store only a per-day count of how many messages you sent, and closing or reloading the page ends the conversation.

Cookies and local storage

We use only what the Service needs: authentication tokens that keep you signed in, small preference values that remember interface state, and your in-progress tutor conversation. All of it lives in your browser, and clearing your browser storage removes it.

We load third-party code only where a specific feature needs it, and only on the pages that offer that feature: Google's sign-in button on the sign-in and signup pages, served by Google, which means Google can see that you visited one of those pages; and Stripe's code where you subscribe or manage billing. Both are listed in the table above. We run no advertising networks, social media pixels, or cross-site tracking cookies, so we have nothing to disclose in response to a Global Privacy Control or "Do Not Track" signal beyond what is already stated here: we do not sell or share your personal information.

Retention and security

We keep your account and study data while your account is open, and delete or de-identify your personal information within 30 days of your asking us to close it. There are two exceptions: where we must keep records, such as for tax and accounting; and where copies remain in encrypted backups that expire on their own schedule. Authentication logs are deleted automatically after 30 days. Tutor conversations are covered under "AI features" above.

Passwords are stored as salted one-way hashes, traffic is encrypted in transit, sessions can be revoked individually or all at once, sign-in and account creation are rate limited, and new passwords are checked against public breach corpora so you are warned before reusing a compromised one. No service can promise perfect security; if a breach affects your personal information we will notify you and any required regulator as the law requires. If you believe your account has been compromised, email [email protected] and change your password.

Your rights and choices

Wherever you live, you can ask us to access, correct, delete, or export your personal information, and you can opt out of marketing email. You can set a new password yourself from the "Forgot password?" link, or add one to a Google account from your settings; email us to change your account's email address.

To exercise any of these, email [email protected] from the address on your account. We respond within any deadline the law sets, and otherwise as promptly as we reasonably can. We may verify your identity first, we never charge you or degrade your service for asking, and you may use an authorized agent.

If we ever refuse a request, we will tell you why, and you can ask us to reconsider by replying to our response. We have never sold personal information or shared it for cross-context behavioral advertising. We make no decisions about you with legal or similarly significant effects by automated means. Adaptive drills only decide which practice question you see next.

Children

The Service is built for people preparing for law school admission and is not directed to children. You must be 18 or older to create an account, and we do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has given us personal information, email [email protected] and we will delete it.

Changes, and how to reach us

We may update this policy and will revise the "Last updated" date when we do. A material change means a new category of data, a new purpose, or a new class of recipient. For those, we will give you notice by email or in the Service before they take effect. Continuing to use the Service after that means you accept the update.