Privacy
Forge stores the minimum state needed to connect your GitHub account, prepare reviewable changes, show captures later and carry out decisions you approve.
Last updated 20 August 2026.
What Forge stores
Account and GitHub access
Your GitHub numeric user id, current login and Forge GitHub App installation id. Forge also keeps one GitHub user credential encrypted at rest. It is used only to create a personal repository, because a GitHub App installation token cannot do that.
OAuth connection
Registered client names and redirect addresses, hashes of short-lived authorization codes, and the user id they belong to. Forge access and refresh tokens are signed; the refresh token is held by your client rather than stored in a separate Forge table.
Changes and approvals
GitHub remains the only copy of repository files. For a requested merge or discard, Forge stores the repository name, change branch, expected commit, changed-file evidence, expiry, decision and outcome. An approval link can act for seven days; its record currently remains until the Forge account is deleted.
Public-page captures
A capture page contains the public source URL, title and screenshots you requested. New captures are mapped to your Forge account for deletion and expire after 30 days. The signed link is a bearer link: anyone you give it to can view it until it expires.
Usage and analytics
Forge stores one daily capture count per user. When PostHog analytics is enabled, it receives only product shape: tool name, success or failure, duration, file or viewport counts, action and outcome. It never receives repository names, file contents, patches, intents, captured URLs or tokens.
What Forge does not keep
- Chat transcripts.
- A mirror, checkout or workspace copy of your repositories.
- Repository secrets or environment variables.
- Private-page captures; Forge accepts only public HTTP or HTTPS URLs.
Who processes data
GitHub provides identity and repository operations. Cloudflare hosts the Worker, database, capture bucket and Browser Rendering. PostHog receives the limited analytics described above only when its optional key is configured. Forge does not sell personal data.
Your controls
- Revoke or narrow the Forge GitHub App installation from GitHub at any time.
- Disconnect Forge from your chat client to stop that client using it.
- Ask for the Forge account and its mapped captures to be deleted.
For support or deletion, use one of the public contact links at timcoy.uk and ask for a private response route. Do not send tokens, private repository details or captured-page contents.
Security and changes
Forge uses repository-scoped GitHub App access, encrypted storage for the one user credential, signed capture and approval links, and explicit approval before the default branch moves or a change is discarded. This notice will be updated when the stored data, processors or retention behaviour changes.