Privacy

Account and GitHub access

Your GitHub numeric user id, current login and Forge GitHub App installation id. Forge also keeps one GitHub user credential encrypted at rest. It is used only to create a personal repository and when you explicitly ask Forge to search public GitHub. Ordinary repository work uses your repository-scoped App installation instead.

OAuth connection

Registered client names and redirect addresses, hashes of short-lived authorization codes, and the user id they belong to. Forge access tokens are signed. Refresh tokens are opaque, client-bound, rotate on every use and are stored only as hashes; inactive refresh tokens expire after 30 days. Used and expired token records are removed with the Forge account and may remain until then so replay can be detected.

Changes and approvals

GitHub remains the only copy of repository files. For a requested merge or discard, Forge stores the repository name, change branch, expected commit, changed-file evidence, expiry, decision and outcome. An approval link can act for seven days; its record currently remains until the Forge account is deleted.

Public-page captures

Forge renders public pages on demand and returns screenshots in the tool response. It stores only your daily capture count; it does not keep a screenshot gallery or persistent copy of captured pages.

Usage and analytics

Forge stores one daily capture count per user. When PostHog analytics is enabled, it receives only product shape: tool name, success or failure, duration, file or viewport counts, action and outcome. It never receives repository names, file contents, patches, intents, captured URLs or tokens.