Privacy, device control & AI safety

1. What Forge is

Forge consists of an Android application and an optional PC companion. It exposes selected tools through the Model Context Protocol (MCP), including file access, building apps, diagnostics and—when explicitly enabled—commands and device control. Forge is a tool connection, not the AI model generating instructions.

Different Forge features run on different hardware: Android operations run on the device; PC operations run on the PC account you authorise. An AI provider may run its model remotely. No claim is made that the entire workflow is offline.

2. What information may be processed

• On your devices: locally saved projects, code, app builds, approval records, local settings, device pairing data and connection credentials.
• Through your configured connection: tool names and arguments, commands, code, files or file contents you expose, screenshots, logs, build output and other tool results. These can contain sensitive personal information.
• Connection metadata: device identifiers, OAuth client metadata, scope grants, token hashes, transport status, request timing and security records needed to operate and protect the connection.
• Website and infrastructure: IP address and operational request data needed to deliver and secure the website, downloads and any relay services you choose to use.

Important: If you connect a cloud AI service, prompts and returned tool data may be processed by that provider under its own privacy terms. A configured relay/tunnel may carry these data in transit. Do not connect private records unless you are comfortable with the selected provider and connection.

3. Who can control your device

Connecting to a compatible AI client requires its own OAuth sign-in and declared permissions. Advanced Android phone access is a separate switch. Raw shell commands and remote APK installations additionally require a matching, time-limited owner confirmation on the phone. Disable access, disconnect a client or revoke sign-ins if you no longer trust the connection.

Android's shell permissions are powerful; they are not an operating-system sandbox. Commands can change or delete data, alter settings, install software or break a working setup. Maintain backups and review the exact requested action before approving.

4. Where requests travel

The tool code executes on your Android device or PC. Remote AI clients require a reachable HTTPS MCP endpoint. In the preview this can use an owner-configured tunnel or relay; the publicly hosted multi-user service and its final retention guarantees have not yet been launched or confirmed. The /forge path is a service endpoint, not a public onboarding page.

Transport encryption and access controls reduce exposure but cannot guarantee security against every software defect, compromised account or device, malicious prompt or third-party service. Avoid leaving privileged access enabled when unnecessary.

5. Storage, retention & deletion

Forge stores connection and project state on the device or companion PC until you delete it, uninstall the relevant app or revoke the associated credentials. Some build artefacts and local audit trails may remain on your own filesystems after stopping a connection. OAuth access tokens are short-lived; refresh access can persist until expiration or revocation. Relay, website and AI-provider operational logs have their own retention arrangements and should be reviewed separately before public service use.

To stop access, use Stop connection and Advanced phone access OFF, revoke authorised clients and remove unwanted PC pairings. These controls prevent new actions but cannot undo commands that already finished. Consult the main Saient privacy policy for website privacy and your rights.

6. AI output accuracy and responsibility

AI can get things wrong. Responses, proposed commands, generated code and analysis can be inaccurate, unsafe, incomplete or misleading. Review and independently verify results before relying on them, especially where money, health, legal rights, devices or important files are concerned.

Saient supplies Forge's software and connection tools; Saient does not create or control the outputs of independent third-party AI models. The person operating Forge decides which models and tools to use and which operations to authorise. This statement does not remove Saient's own legal responsibilities or restrict rights that cannot legally be excluded.

7. Third-party providers, children & support

ChatGPT, Claude and Gemini CLI may offer different MCP features, account requirements and privacy practices. These are independent services and their compatibility with every Forge version is not guaranteed. Forge is not intended for unsupervised use by children and is not a replacement for qualified professional advice.

For privacy requests, account or safety concerns, product issues, or accessibility help, contact chrishall@staticplay.co.uk. You may have statutory privacy rights under UK law, including rights to access, rectification, deletion or complaint to the ICO. See our main privacy policy and terms.

8. Changes before public release

Forge is in testing. Public distribution, hosted multi-user relay design and service-specific retention disclosures require further verification. Significant policy changes should be dated and published before launch. This page does not imply an app-store or AI-provider approval.