Last updated Aug 2, 2026
Privacy Policy
Short version: we hold your email, your VA connection, and your claim status. We don't sell any of it or run ads. Delete your account and it's gone right away.
1. What we collect
Your email address and password hash. A VA access token, once you link. The claim fields VA returns: claim type, status, filed date, VA's estimated window, the conditions you claimed, and VA's paperwork flags. Basic records of when you sign in.
2. What we do with it
We compare today's claim status to yesterday's. If it changed and you asked to watch that claim, we email you. That's the only reason we hold claim data. We do not sell it, rent it, or hand it to advertisers, data brokers, or anyone building a marketing list of veterans.
3. Your VA connection
You sign in on VA.gov, not here. We never see your VA.gov username or password. VA gives us a token that only reads claim status. You can revoke it from your account page or from VA.gov, and it stops working immediately.
4. What's in our emails
One line saying what changed — for example, "claim status changed" — plus a button to sign in. Never the actual value: not your new status, not a rating, not a dollar figure, not a letter's contents. Email isn't private enough for that. If someone else reads your inbox, they learn you use Forward March and nothing else.
5. Who else sees it
Three companies help us run this, each doing one job. Amazon Web Services hosts the app and stores your data, in the United States. Amazon SES delivers our emails. Stripe processes payment for the paid plan — Stripe never sees your claim data, and we never see your card number. We don't use any other company to move or process your data.
We run our own analytics, self-hosted on our own server — not Google Analytics, not Meta Pixel, not any third-party analytics company. It counts visits and clicks so we know what's used. That data never leaves our own infrastructure.
We'll hand over data if a court validly orders it, and we'll tell you unless we're barred from telling you.
6. How long we keep it
Claim data and your VA token live as long as your VA link is active. Unlink your account — from your account page or from VA.gov — and we delete every stored claim record right away.
If we go a full year without a successful sync on your account, we treat the link as dead: we revoke the VA grant, delete your stored claim data, and unlink you automatically. You get warning emails two months, one month, one week, and one day before that happens, so you have time to reconnect.
Deleted data comes out of our live database immediately. Our database keeps rolling backups for disaster recovery only, which age out within 35 days. Stripe keeps its own payment records under its own retention rules; that's between you and Stripe, not something we control.
7. Deleting everything
Account → Delete account. It runs right away: we revoke your VA access grant, delete every claim record, cancel any active subscription, and delete your login. There's no waiting period. Your claim at VA itself is untouched — deleting your Forward March account has no effect on VA.gov.
8. No sale of veteran data
We do not sell your data. We do not trade it, rent it, or barter it. We don't use it for targeted advertising, and we don't hand it to data brokers or anyone building a marketing list of veterans. There's no partner program and no exception to this section. If Forward March is ever sold or merged, this policy goes with it, and we'll email you before your data moves to anyone new.
9. Security
Encrypted in transit and at rest. VA tokens live in a managed secret store, never in plain text. A small number of people can reach production, and their access is logged. If we ever have a breach that affects your data, we'll email you within 24 hours of finding it.