Effective date: November 2, 2026 Publisher: Adam Fischer, independent developer, Florida ("we," "us," "the developer") Applies to: the ClaimForge application for Mac, iPad, and iPhone (the "App")
ClaimForge is a professional tool for licensed public adjusters. Client claim files you import are stored on your device and decrypted only on your device. The developer operates no server, holds no accounts, and never receives or sees your clients' data. The App itself sends nothing about a claim except a product barcode when you ask it to suggest a value — described below. You — the adjuster — are the custodian of your clients' information; ClaimForge is designed so that no one else, including us, ever touches it.
Location in imported photographs. Photographs your client captured inside LossList may carry the location their camera recorded; photographs they added from their photo library arrive without location data, because LossList removes it before packaging. ClaimForge neither adds nor removes that metadata. A located photograph of damage is often the evidence itself, and it travels into the carrier report you assemble.
Imported client claim files. When you import a client's encrypted claim package with its security code, the package decrypts on your device and its contents — the client's contact details, loss details, inventory, photos, receipts, and interview answers — are stored locally in the App's storage. Nothing is uploaded anywhere. The developer has no ability to access, recover, or decrypt client files.
Product lookups — the only thing the App sends about a claim. When you ask ClaimForge to suggest a replacement value for an item that has a barcode, the App sends the barcode digits only — nothing about you, your client, or the claim — to UPCitemdb, a public product database, to retrieve a current price. It operates under its own privacy policy and is not controlled by us. If you never use the suggestion feature, the App sends nothing about a claim at all, apart from the unreadable paid-client fingerprints it keeps in your own iCloud account (see Data retention and deletion). Lookups are not linked to any identity, and the developer operates no server and receives nothing. This is what the App Store privacy label lists as Usage Data (Product Interaction and Other Usage Data): the barcode digits sent to UPCitemdb when you ask for a suggested value. It is used only to provide that feature, is not linked to you, and is not used for tracking. Like any web request, the lookup reaches UPCitemdb with your device’s IP address, which that service may log. ClaimForge itself has no analytics.
Purchases. Your subscription and any per-claim import charges are handled entirely by Apple's In-App Purchase system. The App never sees or handles your payment details. When you pay for a client file, the App attaches a random identifier to the purchase so that a payment Apple approves later — for example after Ask to Buy — can be matched to that file on your device. The identifier is created on your device and contains nothing about your client. ClaimForge versions 1.0.23 through 1.0.27 instead used an identifier derived from a one-way hash of the client's name together with the property address or claim number, and Apple keeps that identifier with the purchase record. A charge started on one of those versions and approved after you update still carries that older identifier in Apple's record; version 1.0.28 and later only compare it on your device and never send it again.
Declarations details from your client. If your client transcribed their declarations page in LossList, those details arrive inside their encrypted claim package and are displayed to you read-only. ClaimForge never receives the policy document itself and does not interpret coverage; you make every coverage determination.
Your work product. Valuations you enter and approve, structural scope notes, coverage narratives, and generated reports are stored locally on your device.
File checks on import. On import, the App checks every file against the package's own manifest of cryptographic fingerprints (SHA-256). A package whose signature does not check out is marked “Signature failed” rather than refused. This runs entirely on your device.
Reports and exports you initiate. PDF reports you generate are written to your device. Sharing or sending them is performed by you through your chosen service; the developer is not a party to it and receives nothing.
Device backups. App data may be included in your device or computer backups according to your settings. Those backups are governed by Apple's terms and your accounts.
Client claim files contain sensitive personal information. ClaimForge's local-first, encrypted design supports your confidentiality obligations, but device security (passcode, FileVault, OS updates, physical control) and lawful handling of client data remain your responsibility as the professional of record.
Subscriptions are processed entirely by Apple through your Apple Account. We never see or store payment information. If your subscription lapses, imported claim data remains on your device — we do not delete your data.
Client files stay on your device until you remove them. Nothing expires or deletes itself. To remove a client file, mark the claim closed from its workspace, then open Closed claims, select it and confirm. That removes the claim, its valuations, its conversation log, its decrypted photos and the carrier report ClaimForge saved for it from the device, and cannot be undone; copies of a report you sent or saved elsewhere are not affected. The space is reclaimed the next time ClaimForge launches. Two things are deliberately kept. The first is the sealed file your client sent you, wherever you saved it. The second is a one-way fingerprint recording that this client’s file has already been paid for. It is derived from the client’s name together with the property address or claim number, and from the random claim identifier LossList writes into the claim file, but is not any of those itself, and it exists so that re-importing the same client’s claim is not charged again. If this device is signed in to iCloud, an unreadable version of this fingerprint is also kept in your own iCloud account, so another of your devices doesn't charge you again. It can't be turned back into a name or address, and we can't read it. Temporary copies the App makes of a client file while importing it are deleted as soon as the import finishes or is canceled; if the App closes before then, they are removed the next time it launches. On iPhone and iPad, deleting the App removes all App data from the device (subject to your backups). On a Mac, removing the App does not remove its data; it remains in your user Library until you delete it.
Because the developer never possesses your data or your clients' data, there is no developer-held data to access, correct, or delete. Requests from your clients about their information are yours to fulfill from your device, as the data custodian.
If a future version adds features that change how data is handled, we will update this policy and note the new effective date before those features take effect.
Questions about this policy: hello@praxis-hq.ai