Security

1. How document generation actually works

This is the highest-risk action on the platform, since it's the one place your personal details pass through our servers at all. The flow is the same for every AI-assisted tool, resume, cover letter, landlord letter, or court-form lookup:

• You type information into a form in your browser.
• It's sent over an encrypted HTTPS connection to our server.
• Our server forwards it to our AI provider (currently Google Gemini, paid API tier) solely to generate that one response.
• The result is returned to your browser and rendered there.
• Nothing from that request, your input or the generated output, is written to a database, a log file, or any other persistent storage on our side. It exists only in server memory for the duration of the request, then it's gone.

Closing the tab discards it from your side. Nothing further to discard on ours, because nothing was kept.

2. What we deliberately do not do

• No storage of document content, generated or typed in, at any point, on any server we control.
• No long-form free-text notes attached to your account, with one narrow exception: an optional private "this week" focus note, encrypted at rest (AES-256), that auto-expires within 30 days. Staff never see it.
• No ability for coaches, org admins, or Forzara staff to open, download, or view the content of anything you generate. That separation is enforced in the product itself, not just in policy, coach accounts have no code path that reads document content.
• No use of your data to train, fine-tune, or improve any AI model. Google's paid Gemini API terms exclude prompts and responses from model training.
• No advertising, no behavioral profiling, no selling or renting personal information.

3. Who can see what

If you're enrolled through a partner organization, your assigned coach can see the status of your milestones (not started, pending, approved) and any short optional note you choose to attach when submitting one. That's the entire visibility surface. They cannot see document content, and there is no admin view, export, or support tool anywhere in the codebase that exposes it. Forzara staff can see account metadata (name, email, join date, organization membership) for support purposes, and nothing more.

4. Infrastructure and technical controls

• Every connection is served over HTTPS.
• Session cookies are marked Secure, HttpOnly, and SameSite=Lax, so they're never sent unencrypted, never readable by page JavaScript, and not attached to most cross-site requests.
• Passwords are hashed with PHP's password_hash() (bcrypt), never stored or logged in plain text.
• A strict Content-Security-Policy with per-request nonces limits which scripts can execute on any page, alongside X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Cross-Origin-Opener-Policy, and a locked-down Permissions-Policy that disables camera, microphone, geolocation, and other browser features the app never uses.
• Every authenticated page is served with cache directives that keep participant data out of shared or disk browser caches.
• Two-factor login (SMS-based) is available on any account, including staff and admin accounts, and a hashed screen-lock PIN lets anyone quickly re-lock their own session on a shared device.
• Forzara sets exactly one cookie: a first-party session cookie, __Host- prefixed so the browser itself refuses to accept it unless it's Secure, host-only, and scoped to the whole site, on top of the HttpOnly and SameSite=Lax flags already on it. No analytics, advertising, or third-party tracking cookies exist anywhere in the codebase, there is nothing to opt out of because nothing else is there.
• The one field with a legitimate reason to persist free text, the optional weekly focus note described above, is encrypted at rest and purged automatically. It is the exception, not the norm.

5. Reporting a security issue

If you find something that looks like a security problem, a way to see data that shouldn't be visible, bypass a permission check, or anything else that doesn't match this page, we want to know before anyone else does.

For what we collect, retain, and delete, and your rights over your own account, see the Privacy Policy.