1. How document generation actually works
This is the highest-risk action on the platform, since it's the one place your personal details pass through our servers at all. The flow is the same for every AI-assisted tool, resume, cover letter, landlord letter, or court-form lookup:
- You type information into a form in your browser.
- It's sent over an encrypted HTTPS connection to our server.
- Our server forwards it to our AI provider (currently Google Gemini, paid API tier) solely to generate that one response.
- The result is returned to your browser and rendered there.
- Nothing from that request, your input or the generated output, is written to a database, a log file, or any other persistent storage on our side. It exists only in server memory for the duration of the request, then it's gone.
Closing the tab discards it from your side. Nothing further to discard on ours, because nothing was kept.
2. What we deliberately do not do
- No storage of document content, generated or typed in, at any point, on any server we control.
- No long-form free-text notes attached to your account, with one narrow exception: an optional private "this week" focus note, encrypted at rest with AES-256-GCM (authenticated encryption), that auto-expires within 30 days. Staff never see it.
- No ability for coaches, org admins, or Forzara staff to open, download, or view the content of anything you generate. That separation is enforced in the product itself: coach accounts have no code path that reads document content.
- No use of your data to train, fine-tune, or improve any AI model. Google's paid Gemini API terms exclude prompts and responses from model training.
- No advertising, no behavioral profiling, no selling or renting personal information.
3. Who can see what
If you're enrolled through a partner organization, your assigned coach can see the status of your milestones (not started, pending, approved) and any short optional note you choose to attach when submitting one. That's the entire visibility surface. They cannot see document content, and there is no admin view, export, or support tool anywhere in the codebase that exposes it. Forzara staff can see account metadata (name, email, join date, organization membership) for support purposes, and nothing more.
4. Infrastructure and technical controls
- Every connection is served over HTTPS, with HSTS enabled so a browser that has visited before won't even attempt a plain HTTP request the next time.
- Session cookies are marked
Secure, HttpOnly, and SameSite=Lax, so they're never sent unencrypted, never readable by page JavaScript, and not attached to most cross-site requests.
- Passwords are hashed with PHP's
password_hash() (bcrypt), never stored or logged in plain text, and checked against a database of known-breached passwords at signup and at every password change.
- A strict Content-Security-Policy with per-request nonces governs both scripts and styles. No inline script or style tag runs without the current request's nonce. The policy also sets X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Cross-Origin-Opener-Policy, and a locked-down Permissions-Policy that disables camera, microphone, geolocation, and other browser features the app never uses.
- Login and registration are rate-limited across multiple signals, not just a single IP address or account in isolation. Automated and abusive traffic patterns are detected and blocked. We don't publish the specifics.
- Every authenticated page is served with cache directives that keep participant data out of shared or disk browser caches.
- Two-factor login (SMS-based) is available on any account, including staff and admin accounts, and a hashed screen-lock PIN lets anyone quickly re-lock their own session on a shared device.
- Forzara sets exactly one cookie: a first-party session cookie,
__Host- prefixed so the browser itself refuses to accept it unless it's Secure, host-only, and scoped to the whole site, on top of the HttpOnly and SameSite=Lax flags already on it. No analytics, advertising, or third-party tracking cookies exist anywhere in the codebase. There's nothing to opt out of because nothing else is there.
- The optional weekly focus note described above is the one field with a legitimate reason to persist free text. It's encrypted at rest and purged automatically.
- Third-party code we vendor (like our HTML sanitizer) is checked against upstream security advisories and kept current, most recently a patch applied August 30, 2026.
5. Reporting a security issue
If you find something that looks like a security problem, a way to see data that shouldn't be visible, bypass a permission check, or anything else that doesn't match this page, we want to know before anyone else does.
For what we collect, retain, and delete, and your rights over your own account, see the Privacy Policy.