Privacy Policy

1. Who we are

Whimsy Forge is a membership community and creativity-and-fitness platform operated by Charity LeBlanc LLC (doing business as "Whimsy Forge"), a Florida limited liability company. Charity LeBlanc LLC is the data controller responsible for your personal information.

Contact for privacy matters:
Charity LeBlanc LLC
7901 4th St N, Ste 300
Saint Petersburg, FL 33702-4399
United States
Email: support@whimsyforge.com

This policy explains what personal information we collect, why we collect it, who we share it with, how long we keep it, and the rights you have over it.

2. Information we collect

2.1 Information you give us

• Account and membership details — your name and email address when you subscribe to our newsletter, contact us, purchase a membership, or join the community.
• Community profile and fitness information — if you join a squad or guild, we store information such as your display name, your stated fitness experience level, your goals, and the region you select, so we can place you in an appropriate group.
• Payment information — when you purchase a membership, payment is processed by our payment providers (Stripe and SamCart). We do not store your full card number on our systems. We receive and store transaction details such as your name, email, and purchase history.
• Support communications — the content of messages you send us through our contact form or support channels, including any information you choose to include.
• Help center searches and questions — when you search the help center or send a question through it, we store the text of your search or question so we can answer it, understand what people are looking for, and improve our help content. If you ask our team, we also collect the email address you give us so we can reply.

Please do not submit medical history, diagnoses, injury details, or other sensitive health information through the service. Whimsy Forge is not a medical or healthcare service, and we do not intend to collect health or medical information.

2.2 Information we collect automatically

When you visit our website or interact with our marketing, we may collect:

• Device and connection data — your IP address and browser user-agent string.
• Usage data — the page you arrived on, the website that referred you, and marketing source identifiers.
• Advertising identifiers — Meta (Facebook) cookies such as _fbc and _fbp, and our own first-party _wf_meta_attr cookie recording which ad campaign a visit came from, where present.

2.3 Session recordings in our mobile app

In the Whimsy Forge mobile app, we record how the app is used — the screens you open, taps, scrolling, and how you move between screens — and replay those sessions back as a video-like recording. We use this to find the places where the app is confusing or broken. Recordings are captured and stored by PostHog on our behalf.

Recordings are masked on your device before they are sent to us. On the app's own screens, everything you type and all images are hidden, so passwords, payment details, and photos are not captured — but text the app displays, such as names and email addresses, can still appear. Our masking does not reach inside the community area, which is a web page shown within the app, so posts, photos, avatars, and names there may appear in a recording. Recordings are viewable only by our team, and are automatically deleted after 30 days.

We do not record sessions on our website — session recording applies to the mobile app only. You can ask us to delete your session recordings at any time using the contact details in section 11.

2.4 Cookies and tracking technologies

We use cookies and similar technologies for essential site functionality, security, analytics, and advertising. Where required by law, we ask for your consent before setting non-essential cookies, and you can change your choices at any time. Our Cookie Policy describes the cookies we use and how to manage your preferences.

3. How we use your information

The table below sets out what we do with your personal information, the data involved, and our legal basis under the UK and EU GDPR.

4. How we share your information

We do not sell your personal information for money. We share it with the service providers below, each of which processes personal information on our behalf and is required to protect it and use it only as we direct.

Payments and checkout

• Stripe — payment processing and subscription billing.
• SamCart — checkout for certain products.

Community, content, and communications

• Circle — hosts our membership community; receives your name, email, and member tags.
• HelpScout — customer support ticketing; receives your name, email, and message content.
• Webflow — hosts certain web forms; when you submit one, your name, email, and message are sent to us and routed into our support system.
• OpenRouter — we use an AI language-model provider, accessed through OpenRouter, to help classify and draft responses to support messages. The content of support conversations may be sent to this provider for processing. We do not use the content of support conversations to train our own AI models.
• OpenAI — when you use the help center, we send the text of your search query, and the text of our help articles, to OpenAI's embeddings service so we can match your question to the most relevant article by meaning. We do not send your name or email to OpenAI for this, and we do not use these searches to train our own AI models.
• Postmark — delivery of transactional and marketing emails.
• Mux and Bunny — video hosting and delivery; may process your IP address when you stream video.

Advertising and analytics

• Meta (Facebook) — we send purchase and event data to Meta's Conversions API, and we upload hashed (SHA-256) email addresses to Meta to build custom and lookalike advertising audiences and to suppress ads to existing customers. Hashing reduces but does not eliminate the personal nature of this data.
• Google — tag management and analytics.
• PostHog — product analytics, error monitoring, and mobile session recording. Receives usage and error events from our app, our website, and our servers; masked session recordings from the mobile app; your IP address; and your member account identifier. We identify you to PostHog by an account number rather than by your name or email address.

Infrastructure, security, and operations

• Cloudflare — bot protection and content delivery; processes connection data including your IP address.
• CookieYes — consent management; stores your cookie-consent preferences and a record of your choices.
• Sentry — error monitoring; may capture your IP address, email, and request details when an error occurs.
• BetterStack — application logging and uptime monitoring; logs may contain IP addresses.
• DigitalOcean — the hosting infrastructure where our databases run.

We may also disclose personal information when required by law, to enforce our terms, or in connection with a merger, acquisition, or sale of assets.

5. International data transfers

We are based in the United States, and our service providers are located in the United States and other countries. If you access Whimsy Forge from outside the United States — including from the UK, EU, or EEA — your personal information will be transferred to and processed in the United States.

Where required, we rely on appropriate safeguards for these transfers, which may include Standard Contractual Clauses, adequacy decisions, or a provider's participation in a recognized data transfer framework such as the EU-US Data Privacy Framework.

6. How long we keep your information

We keep your personal information for as long as your account is active and for as long as needed to provide the service. After that, we retain personal information only as long as necessary for the purposes described in this policy — including to comply with our legal, tax, and accounting obligations and to resolve disputes. By way of example:

• Billing and transaction records are retained for seven years to meet tax obligations.
• Marketing email records are retained until you unsubscribe or ask us to delete them, subject to keeping you on a suppression list so we honor your choice.
• Support messages are retained for as long as needed to provide support and maintain reasonable business records.
• Help center search queries are retained for up to 90 days to help us improve our help content, then automatically deleted.
• App session recordings are automatically deleted 30 days after they are captured.
• Analytics and advertising data are retained according to the settings of our analytics and advertising providers.

7. Your privacy choices and rights

You can manage your information at any time: unsubscribe from marketing emails using the link in any marketing email, and change your cookie choices at any time using the cookie-preferences control on our site.

Depending on where you live, you have some or all of the following rights over your personal information:

• Access — request a copy of the personal information we hold about you.
• Correction — ask us to correct inaccurate information.
• Deletion — ask us to delete your personal information.
• Portability — request your information in a portable format.
• Objection and restriction — object to or ask us to restrict certain processing.
• Withdraw consent — withdraw consent at any time where we rely on it. To stop receiving marketing emails, use the unsubscribe link in any email.
• Complain — lodge a complaint with your local data protection authority.

To exercise any of these rights, email us atsupport@whimsyforge.com. We will respond within the time required by applicable law, generally within one month. We may need to verify your identity before acting on your request.

8. Children's privacy

Whimsy Forge is intended for adults. You must be 18 or older to create an account. Anyone under 18 may use the service only with the consent and involvement of a parent or legal guardian. We do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, please contact us and we will delete it.

9. How we protect your information

We use technical and organizational measures to protect your personal information, including encryption in transit, access controls, and bot protection on our forms. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

10. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you.

11. Contact us

Questions about this policy or your personal information? Contact:

Charity LeBlanc LLC
7901 4th St N, Ste 300
Saint Petersburg, FL 33702-4399
Email: support@whimsyforge.com