Privacy Policy

1. Who We Are

Forzara ("we," "us," or "our") operates the service available at forzara.ai. Forzara is a privacy first reentry support platform that provides clear tools, ordered milestones, and two kinds of AI assistance for people navigating life after a criminal conviction: (1) AI assisted generation of draft documents such as resumes, cover letters, landlord letters, and other correspondence; and (2) AI assisted identification of the correct official government or court form for processes such as expungement, record sealing, early termination, and appeals, together with step by step guidance on completing those forms. Forzara does not draft, generate, or file court or government forms on a user's behalf.

We built Forzara around a deliberate privacy principle: hold as little of your information as possible so there is almost nothing that can be lost, sold, subpoenaed, or held over you.

2. Information We Collect

We collect only what is necessary to operate the service:

Account Information

• Full name
• Email address
• Hashed and salted password
• Account creation date
• Phone number, encrypted at rest, only if you choose to enable two factor login by SMS
• Two factor recovery codes, stored as one time use hashes, if you enable two factor login
• Screen lock PIN, hashed the same way your password is, if you set one

Milestone and Progress Data

• Status of each milestone you choose to track (not started, pending coach review, or approved)
• Short optional notes you attach when submitting a milestone for review
• If you're enrolled through an organization, a short note your coach records during a milestone review or follow-up check-in meeting (whether you attended and, if the meeting covers it, whether you're currently employed or housed)
• A point-in-time snapshot of the above, saved automatically each time you complete a milestone review or follow-up check-in meeting with your coach (see Section 6)
• Basic records of which tools you open (used only in aggregate for service reliability)

Messages (optional)

If you're enrolled through an organization that uses Forzara's messaging feature, the text of messages you exchange with your coach through it, tied to your account and encrypted at rest. This is a direct conversation feature, not a monitored inbox: only you and the staff you're messaging with can read it.

Support Requests

If you contact us through the Support form, the message and contact information you submit, encrypted at rest, along with any internal note our team adds while handling it.

Wellness Check-Ins (optional)

If you use the Recovery Finder tool's check-in log, we store one of three fixed status values you choose ("Attended a session," "Just checking in," or "Having a hard week") with the date, tied to your account. There is no free text field, entirely optional, never scheduled or required, and not part of the milestone program described above. See Section 5 for who can see it, and our separate Consumer Health Data Privacy Policy for full detail on this and the other health-related data described there.

Organization Membership (if you are enrolled through a partner program)

• Organization name and your role
• Milestone progress only (as described above)
• If your organization uses our CSBG grant-reporting worksheets, certain federally required intake fields its staff record about you — see our Consumer Health Data Privacy Policy for exactly what and why.

Payment Information

Processed entirely by our third party payment processor. We receive only confirmation of successful payment, plan type, billing email, and subscription status. We never receive or store full payment card numbers, CVV codes, or bank account details.

Technical and Security Data

IP address, browser type, device type, and server logs required for security, fraud prevention, and reliable operation of the service.

We never collect or store:

• The content of any document you generate
• The personal details, conviction history, or narrative you enter into any tool
• A permanent case file or detailed personal history
• Precise geolocation
• Biometric data
• Detailed medical records, diagnoses, prescriptions, or insurance ID numbers, whether you voluntarily type them into a form that is immediately discarded after generation, or otherwise. There are two exceptions: the optional wellness check-in status described above, a fixed self-reported status you choose to log, not a medical record; and, if you're enrolled through an organization that uses our CSBG grant-reporting worksheets, certain federally required intake fields (health insurance status/source, veteran status, disability-linked income) described in our separate Consumer Health Data Privacy Policy.

3. How Document Generation Works

When you use any AI powered tool:

• You enter the information required for that specific document.
• The information is transmitted securely over HTTPS to our AI provider (currently Google Gemini via the paid API tier) solely to generate the document in that moment.
• The finished document is returned to your browser.
• Neither the input you provided nor the generated output is written to our servers, databases, or any persistent storage.
• You are solely responsible for downloading, copying, or printing the result if you wish to keep it. Closing the browser tab discards it permanently from our systems.

Under Google's paid Gemini API terms:

• Prompts and responses are not used to train, fine tune, or improve Google's models.
• Temporary logs may be retained by Google solely for abuse monitoring and legal compliance, then deleted.
• We do not retain copies of prompts or outputs ourselves.

You control what you put into any form. We recommend never pasting highly sensitive identifiers (full Social Security numbers, exact case numbers, etc.) unless necessary for the specific document you are generating.

4. How We Use the Information We Collect

We use the limited information we hold only to:

• Create, secure, and manage your account
• Provide the tools and milestone tracking features
• Process and manage subscriptions
• Communicate with you about your account, service updates, or support requests
• Detect, prevent, and investigate fraud, abuse, and security incidents
• Maintain and improve the reliability of the service (using only aggregated, non identifying statistics)
• Comply with applicable law

We do not use your data for advertising. We do not build behavioral profiles. We do not sell, rent, or trade personal information.

5. When We Share Information

We share information only in these narrowly defined cases:

With your support coach or partner organization (if you are enrolled)

Authorized staff can see only:

• The status of your milestones (not started / pending / approved)
• Any short note you voluntarily attach when submitting a milestone
• Notes your coach records during a review or follow-up meeting, and the messages you send each other through the messaging feature, if either is used
• If you use the optional wellness check-in log: your last several check-ins, each with its status and date. Nobody is alerted the moment you log one, a coach only sees it if and when they view your profile.

They cannot view, download, open, or access the content of any document you generate, and never see your optional personal focus notes described below. This separation is enforced at the product level.

Organization outcome, funder, and Second Chance Act reports

If your organization generates a program outcome report, a Second Chance Act compliance packet, or another funder facing export, that report is assembled at the moment it's requested from the same aggregate milestone and service data your organization's staff already have access to. It is branded with your organization's own logo and is not separately stored by us afterward. We do not send these reports to any funder, grantor, or third party ourselves, your organization controls if, when, and to whom a report is shared.

CSBG grant-reporting worksheets work differently, because the underlying data does. If your organization uses our CSBG worksheets, staff enter federally required intake data about you (see our Consumer Health Data Privacy Policy for the specific fields) directly into a worksheet. It's encrypted and stored individually, in a database physically separate from the rest of Forzara, as a new record created at intake rather than assembled from data staff already had access to elsewhere. It's retained afterward as a permanent, dated record for the organization's own grant-audit purposes. Your organization's own authorized staff can view individual worksheet answers. When your organization's admin certifies a report to send to a funder, only the certified aggregate totals across all its worksheets are included, never any individual's answers, and that send still only happens at your organization's own direction, the same as any other funder report.

Organization API access

An organization's admin can generate a read-only API key so their own external tools (their HMIS, a reporting dashboard, an internal system) can pull that organization's roster and milestone status automatically, the same aggregate data their own staff can already see, not case notes, document content, or anything beyond what's described above. This isn't a connection Forzara initiates or controls the far end of: it's your organization's own admin choosing to enable it, choosing what data it can reach, and choosing where that data goes from there. Once your organization's data leaves through a key it created, what happens to it in that outside system, including how long it's kept there, is that system's responsibility, not Forzara's. Every key is scoped to a single organization and can be revoked by that organization's own admin at any time from Admin Panel → API Access.

With service providers

Providers who perform necessary functions on our behalf (hosting, payment processing, email delivery, AI generation) are contractually obligated to protect the data and may use it only to provide services to us.

When required by law

If we receive a valid subpoena, court order, or other legal process, we will disclose only the account and program data described in this policy that we actually hold for that person: account basics, organization membership, and milestone status at minimum, plus any notes, messages, or support requests tied to their account if they used those features. It never includes document content, because we never store any to begin with. See our Security page for the specific, standing list.

In a business transfer

If Forzara is acquired, merged, or sold, your account data would transfer under the same privacy commitments. We will notify you in advance of any material change.

We never sell personal information.

6. Data Retention and Deletion

• Account information (name, email, join date, milestone statuses): retained while your account is active.
• Generated documents and form inputs: never stored.
• Optional wellness check-ins: retained while your account is active, visible only to you and your support coach as described in Section 5, and permanently deleted if you delete your account.
• Optional personal focus notes (private "this week" reminders you write for yourself, staff never see them): encrypted at rest, expire 7 days after you submit them by default, and are automatically and permanently purged within 30 days at the latest, no exceptions.
• Messages with your coach, and notes recorded during a review or follow-up meeting: encrypted at rest, retained while your account and organization enrollment are active, and permanently deleted if you delete your account.
• Support requests: encrypted at rest, retained as long as needed to resolve the request and for a reasonable period afterward for our own support-quality records.
• Review meeting snapshots: each time you complete a milestone review or follow-up check-in meeting with your coach, we save an encrypted, point-in-time copy of your milestone status and any notes attached at that moment, so your organization has a dated record of what was reviewed. Visible only to your organization's authorized staff, the same people who can already see that information live. Retained while your account and organization enrollment are active, and permanently deleted if you delete your account.
• Organization outcome, funder, and Second Chance Act reports: generated on demand from the aggregate data described above; not separately stored once generated.
• CSBG grant-reporting worksheets: retained as a permanent, dated record for your organization's grant-audit purposes once submitted; not deleted or altered afterward by design, even by us. See our Consumer Health Data Privacy Policy for the deletion-request process specific to this data.
• Payment and subscription records: retained only as long as required for tax, accounting, and legal obligations.
• Technical logs: retained for a short period for security and then automatically deleted or anonymized.

You may delete your account at any time through Account Settings or by contacting us. Upon deletion we will delete or irreversibly anonymize your personal information within a reasonable time, except for information we are legally required to retain.

7. Your Rights

You have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Delete your account and associated data
• Cancel your subscription at any time
• Export a copy of your milestone progress
• Object to or restrict certain processing

To exercise any of these rights, use the Account Settings page or email us at the address below. We will respond within a reasonable time and in accordance with applicable law.

If you are enrolled through a partner organization, certain milestone status information may also be visible to that organization's authorized staff under the limited rules described in Section 5.

8. Security

We protect the limited data we hold with industry standard measures, including encryption of data in transit (HTTPS/TLS), hashed and salted passwords, access controls, and secure hosting practices. Because we deliberately store almost no sensitive content, the potential impact of any security incident is minimized. No method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

Any account can optionally enable two factor login (a one time code sent by SMS) for extra protection, including staff and admin accounts. Recovery codes are stored as one time use hashes we cannot reverse. Anyone can also set a short PIN to quickly re lock their own session on a shared device, that PIN is hashed the same way a password is and is never visible to anyone, including us.

9. Cookies, Opt-Out Rights, and Global Privacy Control

Forzara uses cookies only to make the service work, never for advertising, analytics, or tracking. We do not use any third party ad, analytics, or tracking cookies, and there is nothing on this site to opt out of on that front.

Several state privacy laws require honoring an opt-out preference signal, such as Global Privacy Control, sent automatically by your browser, for the right to opt out of the sale of personal information, targeted advertising, or profiling. We honor that signal by definition: we do not sell personal information, run targeted or cross-context behavioral advertising, or use automated profiling for any purpose, for anyone, regardless of any signal your browser sends. There is no opt-out action for us to take because there is nothing running that this signal would turn off.

• Session cookie — keeps you logged in as you move between pages. Deleted automatically when you log out or close your browser.
• Correspondence tool cookie — a short lived, randomly generated token the probation/parole correspondence tool uses to hold your in progress draft in temporary storage on our server while you work. Deleted automatically once you're done or shortly after, and never used to identify or track you across the site.

Both are strictly necessary to operate the service, marked Secure and HttpOnly so they're never sent unencrypted or readable by page scripts, and neither requires or triggers a cookie consent banner under applicable law, since that requirement applies to non essential cookies like advertising or analytics, which Forzara does not use. See our Security page for more detail on how these cookies are hardened.

10. Third Party Services

We use a small number of carefully selected third party services:

• Google Gemini (paid API) for real time document generation
• Payment processor for subscriptions
• Email delivery and hosting infrastructure
• SMS provider, only if you or your organization chooses to enable two factor login

These providers process data only as necessary to provide their services to us and are bound by contractual data protection obligations. We do not allow them to use your data for their own marketing or unrelated purposes.

11. International Users

The service is operated from the United States. If you access Forzara from outside the United States, you understand that your information will be processed in the United States, which may have data protection laws that differ from those in your country of residence.

12. Children's Privacy

Forzara is intended solely for adults 18 years of age and older. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected such information, we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will post the revised version on this page, update the "Last Updated" date, and, for material changes, provide notice by email or through a prominent notice on the service. Continued use of the service after the effective date of any update constitutes acceptance of the revised policy.

14. Contact Us

If you have questions about this Privacy Policy, our privacy practices, or wish to exercise your rights, contact us at:

Frequently Asked Questions

Do you save the documents I generate?

No. Documents and the information you enter to create them are never stored on our servers. They exist only in your browser session.

Can my probation officer, case manager, or support coach see my resume or other documents?

No. They cannot see document content, ever, that separation is enforced at the product level. Coaches and organization staff can see the status of milestones you submit, any short note you choose to attach, any messages you exchange through Forzara's messaging feature, and notes they themselves record during a review or follow-up meeting. They never see your optional personal focus notes.

What happens if you receive a subpoena or court order?

We can produce only the account and program data we actually hold for that person: account basics, organization membership, and milestone status at minimum, plus any notes, messages, or support requests tied to their account if they used those features. We never produce document content, because we never store any to begin with — that's true regardless of what's requested.

Do you sell my data to background check companies or anyone else?

No. We never sell, rent, or trade personal information.

What AI model do you use, and does it train on my data?

We currently use Google Gemini via the paid API. Under Google's paid terms, prompts and responses are not used to train or improve their models.

How do I permanently delete everything?

Go to Account Settings and delete your account, or email support@forzara.ai. We will delete or irreversibly anonymize your personal information within a reasonable time.

This Privacy Policy accurately describes how Forzara operates as of the effective date above. We designed the product to hold as little of your information as possible so that the path back can be yours alone.