Forge Privacy Notice

Who we are

Cybrary, Inc. (4600 River Road STE 400, Riverdale, MD 20737) operates Cybrary Forge ("Forge"), the hands-on cyber practice platform. Cybrary is the data controller for your account data, and acts as a data processor for content your organization places in Forge (learner records, engagement data) on your organization's behalf. Contact: privacy@cybrary.it.

What we collect

Forge collects only what the product uses:

• Account and profile: name, email, organization membership and role, optional profile details you choose to add.
• Learning activity: lab progress, scores, notes, save points, replay data and multiplayer room activity.
• Product usage: sign-in events (with IP address), page views, clicked labels (never typed text) and active-time pings, used for utilization reporting to your organization.
• Error reports and optional feedback: crash diagnostics, and screenshots or session recordings only when you explicitly send them.
• Communications: messages you send through Forge chat features, and email delivery and open tracking on the emails we send.

How we use it

To provide the product: run your labs, save your progress, score exercises, report utilization to your organization, keep the service secure, and respond to support requests. Forge does not run third-party advertising, heat-mapping or marketing analytics trackers.

AI processing

Some features (the AI guide, narration, auto-triage) send the content you give them to third-party AI model providers through our AI gateway (Google and OpenAI models; ElevenLabs for narration). These providers process the content only to return a result. Voice, image and text inputs are sent only when you use that feature. Model output may be wrong; in Forge a person always applies and saves — automation never acts on its own.

Slack and Teams message content is never used to train any model.

Who can see your activity

If you use Forge through an employer or school, that organization's managers and administrators can see your learning activity and utilization. Cybrary platform administrators can access content for support and safety, and such access is audited. Public profiles, writeups and leaderboards are public only when you choose them.

Retention

Account data is kept for the life of the account, then deleted or anonymized within 30 days of closure. Learner progress is kept 12 months after closure for transcripts and customer reporting, unless your organization asks sooner. Lab sessions and replay data are swept on rolling schedules of 14 to 180 days. Chat messages are kept 24 months. Error reports and feedback recordings are kept 90 days. Sign-in logs are kept 12 months. Backups age out within 35 days of deletion. Customer contracts and legal holds override these defaults.

Your rights

Depending on your region (including the EU/UK, Switzerland, Brazil and US state laws), you may have rights to access, correct, export or delete your personal data. A Forge account is part of your Cybrary account: deleting your Cybrary account deletes your Forge account. Requests go to privacy@cybrary.it, or to your organization's administrator for organization-managed data.

Children

Forge is for professional and educational use by people authorized by their organization. It is not directed to children under 13, and we do not knowingly collect their data. Your organization is responsible for authorizing any user under 18 and for any consent its law requires.

Changes and contact

We update this notice when the product changes; the version and effective date above show the current text. Questions and requests: privacy@cybrary.it.

Product privacy pages

Slack and Teams apps — what the chat apps read, store, and delete on uninstall.