Privacy Policy

Data Controller

The data controller responsible for the personal data processed through Forge is:

Jason Stoudt, operating as Stoudt Labs. For all privacy, data subject access, or data protection inquiries, contact jason@stoudtlabs.io.

Children Under 13

Forge is not directed at, and we do not knowingly collect personal information from, children under the age of 13. Users aged 13 or older may use Forge only with the consent and supervision of a parent or legal guardian where required by local law, and in any case must be at least 18 years old to create an account without supervision. If we become aware that a child under 13 has provided personal information, we will delete that information immediately. Parents or guardians who believe their child has provided data to Forge may request deletion by emailing jason@stoudtlabs.io.

Information We Collect

Forge collects the data necessary to operate your paper portfolio simulation. This includes portfolio data (assets, positions, and allocation decisions), agent decisions made by AI agents on your behalf, and simulation results including Monte Carlo analysis outputs and scenario projections.

We do not collect personal financial account information, brokerage credentials, or any data related to real-money investments.

Waitlist. If you join the Forge waitlist, we collect only your name and email address. This information is used solely to notify you about early access to Forge and is retained until you request deletion or the waitlist closes. Waitlist data is not sold or shared with third parties, and is kept separate from any portfolio or simulation data described above.

How We Store Data

All portfolio and simulation data is stored in Supabase (PostgreSQL), scoped by your session ID. Each session is isolated — your data is not shared with or visible to other users.

No data collected by Forge is sold, rented, or shared with third parties for advertising or marketing purposes.

Third-Party Data Sources

Forge retrieves market and news data from third-party providers, and sends data to other third-party services in the course of operating the application — for AI agent reasoning, brokerage order execution, error tracking, and alert delivery. By using Forge you also agree to the terms of these providers.

• Yahoo Finance — accessed via the yahoo-finance2 npm package, for both market quotes and news headline/sentiment data. See the Yahoo Terms of Service. Quotes may be delayed by 15+ minutes and are provided for informational purposes only.
• Anthropic (Claude) — Forge's AI trading agents send portfolio state, market data, and news context to Anthropic's Claude models to generate trade reasoning and decisions. See the Anthropic Privacy Policy. Claude's output only ever drives Forge's simulated trades, never real financial transactions.
• Alpaca — Forge places and manages orders through a real Alpaca brokerage paper-trading account. Order instructions, symbols, and quantities are sent to Alpaca's API to execute simulated trades; no real money moves and the account is paper-trading only. See the Alpaca Disclosures.
• Sentry — Forge uses Sentry (sentry.io) for error tracking and crash reporting. Error events, stack traces, and limited request metadata are sent to Sentry to help diagnose issues. See the Sentry Privacy Policy.
• Slack — Forge delivers operational and safety alerts (for example, trading-halt notifications) to a Slack channel via the Slack API. Alert content, which may include portfolio and trading-halt details, is sent to Slack for delivery. See the Slack Privacy Policy.
• Twilio — if you enable the optional SMS program described below, Forge sends your mobile number and alert content to Twilio, acting solely as a processor on our behalf, to deliver text messages. See the Twilio Privacy Policy.

Market data is delayed and may be incomplete. It must not be relied upon for real-money trading decisions. Forge is a simulation platform only.

Authentication

Forge uses NextAuth.js with a credentials-based login. Access credentials are managed as server-side environment variables — no user accounts or password databases are maintained. Sessions are issued as signed JWTs and stored in encrypted HTTP-only cookies managed by NextAuth.js. These session cookies are required for the application to function and expire after 24 hours of inactivity.

SMS / Text Message Notifications

Forge offers an optional SMS program, Forge Operational Alerts, that sends the account operator text-message notifications about the autonomous trading simulation — specifically incident and safety alerts such as a circuit-breaker trip, a trading halt, or a cost-cap breach. This program is operational and transactional; it is not marketing.

What we collect. To operate the program we store the mobile phone number you provide and message send- and delivery-status metadata (timestamps and delivery receipts). We do not collect message content beyond the alerts we send.

Retention. We retain your mobile number and SMS opt-in status for as long as SMS alerts remain enabled on your account. If you disable SMS alerts or delete your account, we delete the stored mobile number.

Opt-in and consent. SMS alerts are strictly opt-in. The account operator enables them and confirms their own mobile number in Forge's account settings. Consent to receive SMS messages is not a condition of using Forge or of any purchase. No text messages are sent unless SMS alerts have been explicitly enabled.

Frequency, rates, and opt-out. Message frequency varies and depends on system events. Message and data rates may apply. Reply STOP to any message to unsubscribe at any time, or HELP for help. You may also disable SMS alerts in account settings.

Sharing. We do not sell or share your mobile number or SMS opt-in (consent) data with any third parties, and we do not share this information with third parties for their marketing or promotional purposes. Messages are delivered through our messaging provider, Twilio, acting solely as a processor on our behalf; no mobile information is shared for any purpose other than delivering the alerts you requested.

Analytics

Forge uses PostHog (posthog.com) to collect product analytics. PostHog is disabled by default and is only enabled after you explicitly accept analytics cookies via the consent banner. Events tracked include portfolio loads, scenario views, and navigation interactions within the app. PostHog receives your anonymised session identifier and event metadata.

This consent gate covers browser-side analytics only. Forge's server also emits a small number of operational and safety events directly to PostHog — for example, when the trading-halt system fires an alert or an operator acknowledges one — independent of your cookie choice. These events are system-operations telemetry needed to run a live autonomous-trading safety system safely, not personal browsing data, and are not used for product analytics or advertising.

No analytics data is used for advertising or sold to third parties. Data is retained subject to PostHog's data processing agreement. You can withdraw analytics consent at any time:

Cookies We Use

In production, NextAuth.js automatically applies the browser-standard __Secure- and __Host- cookie-name prefixes shown above — this is a platform security convention (stricter same-site/HTTPS-only enforcement), not a different cookie or an additional one.

Your Rights (GDPR & CCPA)

Depending on your jurisdiction, you may exercise the following rights regarding your personal data:

• Access (GDPR Art. 15): Request a copy of the personal data we hold about you.
• Rectification (GDPR Art. 16): Ask us to correct inaccurate or incomplete data.
• Erasure / "Right to be Forgotten" (GDPR Art. 17): Request deletion of your data. Note: our database is protected by daily backups rather than continuous point-in-time backups, so a copy of erased data may persist in a backup for a limited period after your request is processed, until that backup rotates out.
• Data Portability (GDPR Art. 20): Receive your data in a structured, machine-readable format.
• Opt-out of Sale (CCPA §1798.120): We do not sell personal data, but you have the right to direct us not to.
• Withdraw consent: Use the Opt out of analytics button above at any time.

To exercise any of these rights, email privacy@stoudtlabs.io. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

Because Forge is a single-user application with credentials managed as server-side environment variables, there are no user account records to export beyond your portfolio simulation data stored in Supabase. If you signed up for early access via our waitlist, your name and email are stored separately and can be exported or erased on request via the same email address above.

Do Not Sell or Share My Personal Information (CCPA)

California residents have the right under the California Consumer Privacy Act (as amended by the CPRA) to direct a business not to sell or share their personal information.

Forge does not sell personal information. Forge does not share personal information for cross-context behavioral advertising. We do not exchange any user data for monetary or other valuable consideration, and we do not participate in targeted advertising networks.

If you still wish to formally exercise your right to opt out of the sale or sharing of your personal information, or submit a verifiable consumer request to know, delete, or correct your data, email jason@stoudtlabs.io with the subject line "CCPA Do Not Sell or Share". We will confirm receipt within 10 business days and respond substantively within 45 days, as required by California law. You may also designate an authorized agent to submit a request on your behalf.

Financial Disclaimer

Forge is a paper trading simulator. No real financial transactions are made through this application. All portfolio values, trades, and performance figures are entirely simulated and do not reflect actual market investments.

Nothing in this application constitutes financial advice. AI agent recommendations are generated for simulation and educational purposes only.

Contact

For privacy-related inquiries, contact privacy@stoudtlabs.io. For general questions, contact jason@stoudtlabs.io.