Privacy Policy

Fora is used by organizations: companies, teams and the people they invite. Personal data plays one of two roles here.

• Workspace content is everything people put in a workspace: messages, posts, documents, tasks, goals, comments, files, meeting notes and transcripts. The organization that owns the workspace (the “Customer”) decides what goes in it and who can see it. For this content we are the Customer's service provider, or “processor”. We process it only to provide the Services, under our Terms of Service and the Customer's instructions.
• Everything else covers visits to our website, account and sign-in details, billing, security logs and support. For this data we decide how it's used; we are its “controller”.

Some questions about workspace content are for your organization, such as why something was kept or who can see it. We'll point you to your workspace's owner or admins, and help them answer.

What you give us

• Account details: your name and email address, and your password, which we store only as a one-way hash. You can also add a photo, job title, pronouns, department, status and a short “doing” line.
• Workspace content: whatever you and your colleagues write, upload or share, including polls, reactions and files.
• Meeting transcripts: made only when the meeting's host turns transcription on. See Calls, meetings and transcription.
• Fora AI conversations: the questions you ask Fora AI, its answers, files you attach, and any “memories” you ask it to keep.
• Billing details: the plan, number of seats, billing contact and tax details. Card numbers go straight to Stripe; we never see or store them.
• Support and feedback: what you send us when you write to us or use Send feedback in the app.

What the Services record as you use them

• Presence and activity: whether you're online, your status, read receipts and typing indicators. Your colleagues see these; that's their purpose.
• Activity and audit records: which account did what and when, such as creating a project, changing a role or exporting data. Workspace managers and admins can view this record.
• Technical data: IP address, browser and device type, and server logs. We use these to run the Services, keep them secure and limit abuse.
• Usage measures: storage used, minutes spent in calls and how much Fora AI is used. We use these to apply plan limits and to understand our costs.
• Error reports: technical details when something breaks. On mobile these identify you by account ID only.
• Device tokens: if you allow notifications in a mobile app, the token Apple or Google uses to deliver them.

What we get from others

• From your organization: your email address and role, when an admin invites you.
• From your colleagues: anything they write that mentions you, or that they share with you.
• From Stripe: whether a payment succeeded.
• From Google, if you sign in with Google: your name, email address and profile picture. If you connect Google Calendar, your calendar events. See Google sign-in and Google Calendar.

From people who don't have a Fora account

Some people use part of Fora without an account: someone who books time through a booking page, someone invited to a meeting by email, or someone reading a shared link. What we collect from them, and why, is in People outside a workspace.

We use personal data only for the purposes below. If you're in the European Economic Area, the UK or Switzerland, the law requires a “lawful basis” for each purpose, and we list it beside each one.

Some things we do not do:

• We do not sell or rent personal data.
• We do not share it for cross-context behavioural advertising, and we show no ads.
• We do not build advertising profiles.
• We make no automated decisions that have legal or similarly significant effects on you.

We send no marketing email today. If we ever do, it will be opt-in.

Fora AI answers questions about your workspace, and can draft, summarize and suggest tasks. Here is how it handles your data:

• It sees only what you can see. When you ask it something, it reads the workspace with your permissions and nobody else's. It may read work items, documents, comments, meeting transcripts, the names and titles of people in the workspace, and any files you attach.
• It uses a third-party model. To produce an answer, we send your question and the relevant workspace content to our AI provider, Meta Platforms, Inc., through its model API. We also use the same provider to correct the spelling of people's and projects' names in meeting transcripts.
• We don't train AI models on your content. Fora does not use workspace content, questions or answers to train or fine-tune any AI model.
• It can read the public web when asked. If you ask it to look at a web page, our servers fetch that page.
• Memories are yours to manage. You can see and delete anything you asked Fora AI to remember.
• Scheduled summaries are off by default. A workspace admin can turn them on, for example to turn meeting notes into action items.

AI output can be wrong. Check anything important before you rely on it.

You can sign in to Fora with your Google account, and you can connect your Google Calendar. Both are optional.

Sign in with Google

Google gives us your name, your email address, whether Google has verified it, and your profile picture. We use them to create or find your Fora account and to show your name and picture to your colleagues. We ask Google for nothing else when you sign in.

Google Calendar

When you connect Google Calendar (Settings → Connected accounts), you allow Fora to see and edit events on your Google calendars. Fora uses that permission only for these things, all of which you can see in the app:

• showing your Google events on your Fora calendar, where only you see them;
• keeping your booking page from offering times your calendar marks as busy;
• changing, moving, deleting or answering one of your Google events when you do that in Fora — the same change Google Calendar would make, including Google telling the other people on it;
• when a booking is set to take place on Google Meet, adding that meeting to your main calendar with a Meet link, and moving or removing it when the booking changes. Fora asks Google not to send its own invitations; Fora sends the invitation itself.

What we keep. We read your events when you open your calendar or when someone opens your booking page. We hold them in memory for about a minute and do not store them. Someone who opens your booking page sees only which times are free, never your events. We store the access Google gives us, encrypted, so the connection keeps working.

What we never do. We don't read your email, files or contacts. We don't use data from Google to serve ads, and we don't sell it or pass it to anyone except as needed to run the features above, for security, or where the law requires. We don't use it to train AI models, including general-purpose ones. People at Fora don't read it unless you ask us to help with a problem and agree to it, it's needed for security, or the law requires it.

Limited Use. Fora's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Turning it off. Disconnect in Settings → Connected accounts. That revokes Fora's access at Google and deletes the stored access. You can also remove Fora from your Google account at myaccount.google.com/permissions. Deleting your Fora account deletes it too.

• Calls are live, not recorded. Audio and video travel between participants through LiveKit while the call happens. Fora does not record or store call audio or video.
• Transcription is the host's choice. When a meeting's host turns it on, one participant's app sends the meeting's audio to our speech-to-text provider in short segments. The provider turns each segment into text. We keep the text, attributed to speakers, on the meeting, and we don't keep the audio. The meeting shows that it's being transcribed.
• Calls held elsewhere. Fora can also transcribe a call on another service when a user shares that call's audio with Fora. Some people on that call may not use Fora. Our Terms require the person transcribing to tell everyone on the call, and to get their consent where the law requires it.
• Who sees transcripts: the same people who can see the meeting in the workspace. Transcripts are kept until the meeting or the workspace is deleted.

Booking pages

A Fora user can publish a booking page (a link ending in /@their-name) and booking links under it where people who don't use Fora book time with them. When you book, we collect your name, your email address, the time you picked, your timezone, and — only if you give them — a phone number, a note, and your answers to any questions the person you're booking asks. We also record where the visit came from: the campaign tags in the link you followed (utm_source, utm_medium, utm_campaign, utm_term and utm_content), and the address of the page that sent you, without its query string. If the link fills in your name or email for you, those are the values we keep once you book. We use all of this to arrange that meeting and nothing else: it goes to the person you booked, onto a meeting in their Fora workspace, and into the confirmation and calendar invite we email to you and to them. Your note, your answers and where you came from go only to them: the email and invite we send you don't repeat them. Unless the person you booked has turned them off, we also email you a reminder a day before and an hour before the meeting, with its time in your timezone, where it happens, your link to join, and the link to move or cancel it — never your note or your answers. Some booking links are for a workspace's own team: to book one you sign in to Fora, and the booking is made with your account's name and email address. Your email address is also kept, as a one-way digest, to limit how many bookings one address can make in an hour. The email we send you carries a private link to reschedule or cancel; we store only a one-way digest of that link. A booking, including a cancelled one, is kept as a record in that workspace until the workspace deletes it or is deleted. To have yours removed, write to us or to the person you booked.

Meetings you're invited to by email

A Fora user can invite you to a meeting by typing your email address. We keep your email address and the name they gave on that meeting, and email you a link that is yours alone. When you open it, you give the name the host will see and ask to join; the host lets you in. You join the call in your browser, without an account. Calls are not recorded (see Calls, meetings and transcription). A few minutes after the meeting ends, we email you its summary and decisions. Your name and address stay on the meeting as part of that workspace's record.

Shared documents and guests

• Someone reading a document through a public link gives us nothing but the technical data any website receives. If the link asks for a password or an email address, we check what you enter. If the link lets you comment, your comment is saved on the document with the name or email address you gave.
• If someone shares something with your email address, you become a guest in their workspace: an account limited to what was shared with you, covered by the rest of this policy.

Inside your workspace

Fora is for working together, so what you post is seen by the people it's shared with.

• Workspace owners and admins manage members and settings. The owner can export the whole workspace, including messages.
• Guests see only the projects and groups they're invited into.

Our service providers

We use the companies below to run the Services (our “sub-processors”). Each one receives only what it needs for its job, under contract terms that limit its use to that job.

We'll update this list before a new sub-processor starts handling personal data. Customers who want an email when it changes can write to hello@foraos.io.

Things that reach other services because you used them

• Push notifications are delivered by Apple or Google. They contain the sender's name and a preview of the message.
• Link previews: when someone pastes a link, our servers fetch the page to show its title and image. The fetched preview is cached for up to 7 days.
• Embedded videos (YouTube, Loom, Vimeo) and images from other sites in posts load from those sites when you view them. Those sites see your IP address and may set their own cookies, under their own policies.

Other times we disclose data

• When the law requires it. We disclose data in response to a valid legal process. Where we're allowed to, we tell the affected Customer first, and we push back on requests that are overbroad.
• To protect people. We may disclose data to prevent harm, fraud or abuse of the Services.
• In a business transfer. If Fora is merged, acquired or sold, data may transfer to the new owner, under this policy. We'll give notice before that happens.
• With your consent, or at your organization's direction.

Fora staff

Our staff can see a workspace's metadata, members and usage, to support it.

• Staff open or export a workspace's content only when it's needed for support you asked for, for security, or to meet a legal obligation.
• Staff actions that change or export a workspace are recorded in that workspace's own activity log, where its admins can see them.

Fora stores and processes data in the United States, whichever country you use it from. Some of our providers also process data in other countries (see the table above).

• From the EEA, UK or Switzerland: when we or our providers transfer personal data out, we rely on the European Commission's Standard Contractual Clauses, and the UK and Swiss equivalents, or on another lawful transfer mechanism.
• From Canada: data stored in the United States is subject to US law. US authorities may be able to access it there.

• Your account: kept while it's active. When you delete it, it is anonymized straight away:
  • your name becomes “Deleted user” and your email address is erased;
  • your sessions, sign-in credentials and device tokens are deleted;
  • your memberships end.
  What you posted stays in the workspace, because it's part of your organization's record, and is attributed to “Deleted user”.
• A workspace: kept until its owner deletes it. Deletion takes three steps:
  • deletion is scheduled, and the owner can cancel it for 7 days;
  • then the workspace closes and everyone loses access;
  • 30 days after it closes, its content is permanently deleted. That covers messages, posts, documents, tasks, goals, meetings and transcripts, comments, reactions, files and memberships.
• Activity and audit records: kept for the life of the workspace, unless an admin sets a shorter retention period, which some plans allow.
• Unpaid or ended subscriptions: a workspace suspended for non-payment keeps its content. We may delete it 90 days after suspension or termination, as our Terms describe.
• Billing records: kept as long as tax and accounting law requires.
• Google Calendar: your events aren't stored (they're held in memory for about a minute). The access Google gives us is kept until you disconnect or delete your account.
• Error reports, server logs and cached link previews: kept for a limited period, then deleted automatically.
• Backups: copies of deleted data can remain in our database provider's backups until those backups expire.

We protect personal data with safeguards that match its sensitivity:

• All traffic is encrypted in transit with TLS, and browsers are told to use only encrypted connections.
• Our database provider encrypts data at rest.
• Each organization's data is kept apart by row-level security policies in the database itself, as well as by the application.
• Passwords are stored only as one-way hashes.
• Access that Google gives us for your calendar is encrypted at rest.
• Sign-in attempts are rate-limited.
• Staff access runs through a separate administrative system with its own accounts, two-factor authentication for administrators, and an audit trail.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities as the law requires. To report a vulnerability, write to hello@foraos.io.

Wherever you live, you can ask us to do any of the following. We give these rights to everyone, not only where a law requires it.

• Access: get a copy of the personal data we hold about you.
• Correct: fix it. Most of your profile you can edit yourself in Settings.
• Delete: delete your account yourself, in Settings on the web or in the mobile app, or ask us to.
• Portability: a workspace's owner can export its content as a file. You can ask us for your own data in a portable format.
• Object or restrict: ask us to stop, or limit, processing that relies on our legitimate interests.
• Withdraw consent where we relied on it, without affecting what came before.
• Notifications: choose, for each kind, whether it arrives instantly, in a digest, or not at all, in Settings.

How we handle a request:

• Write to hello@foraos.io. We'll confirm it's you, and answer within 30 days, or tell you why we need longer where the law allows it.
• You won't be treated differently for using these rights.
• If the request is about workspace content, we may need your organization, as its controller, to act on it. We'll help them do so.

Complaints

If you're not satisfied with our answer, you can complain to your local data protection authority. For example:

• an EU supervisory authority;
• the UK Information Commissioner's Office;
• the Office of the Privacy Commissioner of Canada.

United States residents

State privacy laws, including California's, ask us to say which categories of personal information we collect. They are:

• identifiers, such as your name, email address and IP address;
• customer records, such as billing details;
• commercial information, such as your plan and purchases;
• internet activity, such as your use of the Services;
• audio, which is processed in transit for transcription and not retained;
• professional information, such as your title and department.

We collect these for the purposes in How we use it, and disclose them only as in Who we share it with.

• We don't sell or “share” personal information as those laws define it, and we haven't done so in the past 12 months.
• We use sensitive information, such as your password, only to provide the Services.
• You can make a request yourself, or through an authorized agent whose authority we can verify.
• We honor Global Privacy Control signals. Because we don't sell, share or track, there's nothing further for them to switch off.

Our website (foraos.io) sets no cookies and uses no analytics or tracking tools.

The app (app.foraos.io) uses only what it needs to work:

These are strictly necessary, so they don't need consent. We don't use advertising or third-party tracking cookies.

The Fora apps ask for your camera and microphone (for calls) and your photo library (to share images in chat). They also ask to send notifications.

• Each permission is optional, and you can change it in your device settings.
• The apps don't access your contacts or your location.

Fora is a tool for work and isn't directed to children. You must be at least 16 to use it. If we learn that we hold personal data about a child under 16, we'll delete it. Please tell us at hello@foraos.io if you believe we do.

We'll post any change here and update the effective date. If a change is material, we'll tell account owners by email or in the app at least 30 days before it takes effect, unless the law requires the change sooner.

For any question or request about privacy, write to: