Privacy Policy
How we handle your information.
1. Who we are
BulletForge is a service of FISTWORLD Authentix Incorporated, a North Carolina S-corporation ("BulletForge," "we," "us," "our"). We operate the BulletForge web and mobile applications and the website at bulletforge.co.
This Privacy Policy explains what information we collect when you use BulletForge, how we use it, who we share it with, and the rights you have over it. It applies to all BulletForge services, including the bullet generator, counseling tracker, journal, adverse-action document drafting, and Academy lessons.
2. What we collect
Account information
When you create an account, we collect:
- Your email address (required for authentication)
- A name, if you choose to provide one (optional)
- Authentication data managed by Supabase Auth (hashed password or magic-link tokens)
Content you create
BulletForge stores the content you create in the app, including bullet drafts, counselings, journal entries, soldier profiles, adverse-action documents (such as GOMOR rebuttals and Article 15 statements), and any context you provide to the AI bullet generator. You retain ownership of this content. See the Terms of Service for the limited license you grant us to operate the service.
Payment information
Paid subscriptions and one-time purchases are processed by Stripe, Inc. We never see or store your full payment card number. Stripe sends us a customer ID and a record of your subscription status. Stripe's own privacy policy applies to information you provide to them: stripe.com/privacy.
Usage data
We collect technical information about how you use the service, including pages visited, features used, requests made to the AI generator, timestamps, IP address, browser type, and device type. We use this to operate and improve the service.
Communications
If you contact us at hello@bulletforge.co or through the contact form, we retain your message and email address so we can respond and follow up.
3. How we use it
We use information to:
- Provide, maintain, and improve the BulletForge service
- Generate AI-assisted bullets, counselings, and other content at your request
- Process payments and manage subscriptions through Stripe
- Send transactional emails (receipts, account confirmations, password resets, important service notices)
- Respond to your questions and provide customer support
- Detect, investigate, and prevent fraud, abuse, or violations of our Terms of Service
- Comply with legal obligations and respond to lawful requests
- Conduct internal analysis to improve the product (in aggregate, de-identified form where practical)
We do not sell your personal information. We do not share your content with advertisers. We do not run ad networks on BulletForge.
4. AI processing
BulletForge uses large language models from Anthropic, PBC to generate bullet drafts, counseling drafts, and adverse-action documents such as GOMOR rebuttals and Article 15 statements. When you ask the service to generate or polish any of these, the prompt content you submit, including any narrative context you provide, is sent to Anthropic's API for processing. The generated response is returned to you and stored in your account.
Adverse-action documents can contain disciplinary and legal information about you or a Soldier you are assisting. That content is handled the same way as everything else described in this section: it is sent to Anthropic only when you ask for a draft, it is not used to train any model, and it is removed when you close your account or ask us to delete it.
Anthropic processes API content under their commercial terms. Per Anthropic's published policy, API submissions are not used to train Anthropic's models by default. See Anthropic's privacy policy for details.
BulletForge does not use your content to train any AI model. Your bullets, counselings, adverse-action documents, and other content are stored to provide the service to you, not as training data for us or third parties.
5. Service providers we use
We rely on a small number of third-party service providers ("sub-processors") to run BulletForge. Each one only processes the data needed to do its job. Current sub-processors:
- Anthropic, PBC: AI generation (US)
- Supabase, Inc.: database, authentication, file storage (US)
- Stripe, Inc.: payment processing, subscription billing (US)
- Cloudflare, Inc.: website hosting, CDN, edge functions, DNS (global)
- Resend, Inc.: transactional email delivery (US)
- Google LLC (Google Workspace): our internal email at hello@bulletforge.co (US)
- Expo, Inc.: mobile application delivery, push notifications (US)
- PostHog, Inc.: privacy-first, cookieless product and traffic analytics (US)
We may add or change sub-processors. We will update this list when we do. Material changes will be communicated through this policy and, where appropriate, by email.
6. Cookies and similar tech
The bulletforge.co marketing site sets no cookies. We measure traffic and click-through with PostHog in a cookieless configuration: a random visitor identifier is kept in your browser's local storage (not a cookie, never shared across sites), session recording and autocapture are turned off, and your IP address is discarded rather than stored. You can clear this identifier any time by clearing your browser's site data.
The BulletForge web application sets functional cookies required for authentication (managed by Supabase Auth) and to remember your session. We do not use third-party advertising cookies or cross-site trackers anywhere.
7. How long we keep data
- Account data: for as long as your account is active. If you delete your account, we delete or anonymize your personal information within 30 days, except where retention is required by law (e.g., tax records).
- Content you create: stored in your account until you delete it or close your account.
- Payment records: retained as long as required by tax and accounting law (typically 7 years).
- Support communications: retained for up to 2 years to maintain context for follow-up support.
- Aggregated analytics: retained indefinitely in de-identified form.
8. How we protect data
We use standard industry security controls: encryption in transit (HTTPS/TLS), encryption at rest for the database (managed by Supabase), role-based access control, and the principle of least privilege for internal access. No system is perfectly secure. If you become aware of a security issue, email hello@bulletforge.co.
9. Your rights
You can exercise the following rights at any time by emailing hello@bulletforge.co:
- Access: ask for a copy of the personal information we hold about you.
- Correction: ask us to fix inaccurate information.
- Deletion: ask us to delete your account and personal information.
- Portability: ask for a copy of your content in a machine-readable format.
- Opt-out of marketing: use the unsubscribe link in any marketing email. (Transactional emails about your account cannot be opted out.)
- Object / restrict: ask us to stop or limit certain uses of your information.
We will respond within 30 days. We may verify your identity before fulfilling a request.
10. State-specific rights
If you are a resident of California, Virginia, Colorado, Connecticut, or Utah, your state's privacy law gives you additional specific rights:
California (CCPA / CPRA)
You have the right to know what categories of personal information we collect, the purposes for which we use it, the categories of third parties we share it with, and the specific pieces of information we hold about you. You have the right to delete your information and to correct it. You have the right not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioral advertising, so the "Do Not Sell or Share My Personal Information" right does not produce a separate effect on our service: we already do not do that.
Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA)
You have rights to access, correct, delete, and obtain a portable copy of your personal data. You may opt out of targeted advertising, the sale of personal data, and certain profiling. We do not engage in targeted advertising, sell personal data, or conduct profiling that produces legal effects.
To exercise any of these rights, email hello@bulletforge.co with "Privacy Request" in the subject line. We may need to verify your identity.
11. International users
BulletForge is operated from the United States. If you access the service from outside the US (including from US military installations abroad), your information will be transferred to and processed in the United States. By using the service, you consent to this transfer.
If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the rights afforded by GDPR, including access, rectification, erasure, restriction, portability, and objection. You also have the right to lodge a complaint with your local data protection authority.
12. Children under 18
BulletForge is not intended for and is not directed to children under 18. We do not knowingly collect personal information from children under 18. If we learn that we have, we will delete it. If you believe a child under 18 has provided us with personal information, contact hello@bulletforge.co.
13. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email. Your continued use of BulletForge after the effective date of the updated policy constitutes acceptance of the changes.
14. Contact
FISTWORLD Authentix Incorporatedd/b/a BulletForge
Email: hello@bulletforge.co
Web: bulletforge.co/contact