Privacy Policy

1. Who we are

The Emporium Forge is a service of SICKMEYER GROUP, LLC, located in Worthington, Minnesota, United States (“Company,” “we,” “us,” or “our”). This Privacy Policy explains how we handle personal information in connection with emporiumforge.com, Cinema Forge, other Forges available on the platform, account administration, billing, and related support (the “Service”).

“Personal information” means information that identifies, relates to, or can reasonably be linked to an individual, including information treated as personal data under applicable law.

We are responsible for determining how personal information is used to operate our accounts and Service. This policy does not replace the independent privacy policies of Stripe or an external AI service that you choose to use.

Privacy questions and requests can be sent to support@emporiumforge.com. Our full contact information appears in Section 16.

2. The essentials

• We do not sell your personal information to third parties.
• Stripe processes payments. We do not store full payment-card numbers, card security codes, or bank-account payment credentials on our systems.
• We use your email address for account access and account communications, and subscription status to determine access to paid features.
• Cinema Forge and other Forges run entirely in your browser. Your projects and creative content are stored only on your own device — not on our servers. Users can take generated prompts to an AI service of their choosing.
• Subscription cancellation and deletion of personal information are separate actions. See Section 11.

3. Information processed through the Service

Account and sign-in information

We collect the email address you provide when creating or accessing your account. We use it to send sign-in links and account messages and to associate your account with its subscription entitlement. Signing in creates a session record (a session identifier and its expiration) so you stay logged in; we do not separately log each sign-in attempt or your device information beyond what's needed to issue that session.

If you opt in to trusted devices, we also store, for each trusted device, a one-way hash of a device token, the browser and operating-system description your browser sends (its “user agent”), and the dates the device was added and last used. We use this solely to authenticate you, to show you your list of trusted devices, and to protect your account. It is not used for tracking or advertising. Trusting a device is optional and based on your consent; you can withdraw it at any time by forgetting the device (see Section 7).

Subscription and transaction information

When you subscribe, you provide payment information through Stripe. Stripe processes the transaction. The information we retain in our own systems is limited to: your Stripe customer and subscription identifiers, your plan and billing interval, your subscription status (trialing, active, past due, or canceled), and your current billing period's end date. We do not receive or store your card number, card security code, card brand, last four digits, or billing address — that information stays with Stripe.

Information you provide in messages

If you contact us, we receive the contact information and content you choose to send, such as a billing question, support request, or privacy request. Please do not include full payment credentials, identity documents, or sensitive personal information unless specifically necessary and requested through an appropriate channel.

Creative inputs, prompts, and outputs

Cinema Forge runs entirely in your browser. It makes no network requests to our servers or to any third party — the only external resource it loads is Google Fonts' stylesheets, for typography. Everything you create — your ideas, prompts, and generated outputs — is stored only in your browser's local storage, on your own device. We have no server-side copy of it and no visibility into your projects, prompts, or outputs. Clearing your browser's site data will remove this content; we cannot retrieve or restore it for you.

Do not include someone else's personal or confidential information in a prompt unless you are authorized to use it in this way. The Service does not require you to include sensitive personal information in creative prompts.

Technical information and cookies

Each time you open Cinema Forge through /forge, we log your account, your IP address, and the timestamp, to investigate abuse and confirm the access controls are working correctly. Our hosting infrastructure (Amazon Web Services) also generates standard operational request and error logs used for troubleshooting and security. We do not use analytics, advertising, or session-replay tools of any kind.

Cookies and similar storage technologies are addressed in Section 7.

We obtain personal information directly from you, from your interaction with the Service as described above, and from providers such as Stripe and Resend when they supply information needed for the activities described in this policy.

4. How we use information

• Create and authenticate accounts — your email address and session information.
• Provide the features you request — your account entitlement, checked against your subscription status.
• Administer trials, subscriptions, and billing — your account email and the Stripe subscription/transaction records described in Section 3.
• Respond to questions and privacy requests — your contact information and messages.
• Protect the Service and investigate technical problems — the technical/access information described in Section 3.
• Meet legal and recordkeeping obligations — relevant account, transaction, and security records.

We do not currently use personal information for analytics, marketing profiling, or AI model training. If that changes, we will update this policy in advance and obtain consent where required — this policy is a disclosure of current practices, not blanket permission for unrelated future uses.

5. Stripe and other service providers

We disclose personal information to providers where needed to operate the Service:

• Stripe — processes payments and administers billing. Stripe receives the information supplied during checkout under its own policies; we receive the subscription and transaction information described in Section 3.
• Resend — delivers sign-in and account emails. It processes recipient email addresses, message content, and delivery information needed to provide that service.
• Amazon Web Services — hosts the website and its server functions (compute and content delivery) in the United States (us-east-1 / Northern Virginia), processing account, subscription, and technical information as needed to run the Service.
• Neon — hosts our database (also in us-east-1 / Northern Virginia), storing the account, subscription, and access-log information described in Section 3.

No AI provider is called by our platform itself — Cinema Forge runs entirely in your browser, as described in Section 3. We enter into appropriate data-processing terms with providers that process personal information on our behalf. Some providers, including Stripe, also process information for their own legally permitted purposes, such as fraud prevention and compliance, under their own policies.

Learn more: Stripe Privacy Policy and Resend Privacy Policy.

We may also disclose relevant information when reasonably necessary to comply with a lawful legal demand, establish or defend legal claims, or protect the rights and safety of users and the Service. If the business undergoes a merger, acquisition, or asset transfer, relevant information may be disclosed to advisers or the successor under appropriate confidentiality and legal safeguards. This does not authorize selling personal information as a separate product.

6. Your prompts and external AI services

You choose whether to copy or submit generated prompts to an external AI service. Information you submit directly to that service is then subject to its own terms and privacy practices; our subscription does not control that provider's data retention or model training.

We do not use your creative inputs or outputs for model training or other product development — our platform never receives them in the first place, since Cinema Forge runs entirely in your browser (Section 3).

7. Cookies, browser storage, analytics, and advertising

We use a session cookie (secure, HTTP-only) that keeps you signed in. It is necessary for account access and is not used for tracking or advertising.

If you choose “Trust this device,” we set a second, optional cookie (also secure and HTTP-only) that lets you sign in without an emailed link for up to 30 days after you last use the device; that period renews with use. It is used only for authentication and security. You can view and remove trusted devices at any time at Settings → Devices, or choose “Forget this device” when logging out. Removing a device deletes its record and ends trusted sign-in on it immediately; clearing your browser's cookies has the same effect on that browser. We may also revoke trusted devices at any time to protect your account.

Cinema Forge stores your projects and creative content in your browser's local storage, on your own device (Section 3). You can clear this through your browser's settings at any time; doing so does not cancel your subscription or affect your account.

We do not use analytics, advertising pixels, session-replay tools, or email open/click tracking. We do not sell personal information, and none of our practices fall into a legally defined “sale” or “sharing” for cross-context behavioral advertising. If this changes, we will update this policy and provide the applicable opt-out mechanism in advance.

8. Legal bases where required

Where applicable data-protection law requires a lawful basis, we rely on the basis appropriate to the specific activity:

• Contract: necessary processing to provide your account, requested Forge features, and subscription administration.
• Legitimate interests: proportionate security, abuse prevention, troubleshooting, and support, balanced against your rights and reasonable expectations.
• Legal obligation: records or disclosures necessary to satisfy applicable legal duties.

Information necessary to authenticate your account or confirm your subscription is required to provide those functions; if you do not provide it, we may be unable to offer account-based or paid access.

Right to object: Where applicable, you may object to processing based on legitimate interests. Contact us using Section 16.

9. Retention

We currently do not run an automated process that deletes account records after a subscription cancels or expires — cancellation ends your access (Section 11 and our Terms of Service) but does not, by itself, delete your account or its records. Retention works as follows:

• Account and sign-in records — kept while your account exists; deleted upon a closure request (Section 11).
• Trusted-device records — kept for up to 30 days after the device was last used, then deleted; also deleted when you forget the device or your account is closed.
• Creative inputs and outputs — not retained by us at all; stored only in your browser (Sections 3 and 7).
• Billing records — kept while your account exists and as needed for accounting purposes; Stripe separately retains its own transaction records under its policy.
• Access and technical logs — kept indefinitely at this time for abuse investigation and troubleshooting; removed upon an account-deletion request where feasible.
• Support and privacy-request records — kept as needed to document the request and our response.
• Backups — our hosting and database providers maintain their own backup copies under their standard practices; a deletion request is applied to production data, and backup copies age out on the provider's normal cycle rather than being individually purged.

10. Security

We use reasonable technical and organizational measures appropriate to the information processed, including encrypted connections (HTTPS) between your browser and our servers, an encrypted database, and access limited to the people and providers who need it for authorized functions. No online system can guarantee complete security.

Protect access to your email and do not share sign-in links or account sessions. Contact us if you suspect unauthorized account access. Where a personal-information breach triggers a legal notification duty, we will provide the required notifications.

11. Cancellation, account closure, and privacy requests

You can cancel subscription renewal using the Stripe billing portal linked from the Service. Cancellation ordinarily preserves access until the end of the paid period, as described in our Terms of Service.

Canceling billing is not the same as deleting your Emporium Forge account or personal information. We do not currently delete accounts automatically after cancellation or expiration — your account and its records remain until you ask us to remove them. To request account closure, deletion, access, correction, or another privacy action, email support@emporiumforge.com from your account address where possible, and describe the request. Do not send full payment credentials.

We may verify your identity using information reasonably necessary for the request, and will not require excessive identifying information. We will respond within the deadline required by applicable law and explain any lawful extension or refusal. Some requests may affect our ability to provide particular features.

Stripe may retain its own transaction records or require a separate request for information it controls independently. We remain responsible for responding to requests concerning information under our own control.

12. Your rights and choices

Depending on your location and the applicable law, you may have rights to access, correct, delete, or obtain a portable copy of your personal information; to restrict or object to certain processing; and to appeal a denied request or complain to a regulator. We will not unlawfully discriminate against you for exercising privacy rights. Some information remains necessary to supply the features you request.

Which specific statutory rights apply depends on the laws that cover you and your location; this policy does not determine that coverage for you. To exercise any right described above, contact us using Section 16 and we will address your request under the law that applies to it.

For people protected by EEA or UK data-protection law, you may complain to the authority where you live, work, or believe a violation occurred. UK complaints may be directed to the Information Commissioner's Office. You do not have to complete our internal process before contacting a regulator.

We do not currently send marketing or promotional emails — only account and sign-in emails necessary to operate the Service.

13. International processing

SICKMEYER GROUP, LLC operates from the United States, and the Service is hosted in the United States (AWS and Neon, both in the us-east-1 / Northern Virginia region), as described in Section 5. If you access the Service from outside the United States, your information is processed there, under United States law rather than the law of your own country.

We have not appointed an EU or UK representative and do not currently rely on a specific international-transfer certification or contractual mechanism. As our international customer base grows, we will assess whether this is required and update this policy accordingly. International access to the Service is not treated as a waiver of your local privacy rights.

14. Adults-only service and automated processing

The Service is intended for people aged 18 and older. We do not knowingly offer accounts to minors. If you believe a minor has supplied personal information through an account, contact us so we can investigate and take appropriate action, including deletion where required.

The only automated decision the Service makes is checking your subscription status to determine whether you can access paid features — a direct, expected function of the subscription itself, not profiling. We do not use automated decision-making that produces a legal or similarly significant effect beyond that access check.

15. Changes to this policy

We may update this policy to reflect changes in the Service, our practices, or applicable law. We will update the date above. For material changes, we will provide appropriate notice through the Service, email, or another legally sufficient method before the change applies where required. An updated policy does not retroactively authorize an incompatible use of previously collected information.

16. Contact us

SICKMEYER GROUP, LLC
Operator of The Emporium Forge
Worthington, MN, United States
Privacy and support email: support@emporiumforge.com
Website: https://emporiumforge.com

Please identify the account email and nature of your request. Do not include payment credentials or unnecessary sensitive documents.