MergeSmith

Privacy Policy

What MergeSmith stores, why, and what it will never do with it.

Last updated 31 July 2026.

What is stored

  • Your identity — your email address, your name if you give one, and the login and avatar of any GitHub or Google account you connect. You may sign in with a provider, with a password, or with both.
  • Your password, if you set one — never the password itself. What is stored is an Argon2id hash, which cannot be turned back into what you typed, combined with a key held outside the database so that a copy of the database alone is not enough to start guessing.
  • Project configuration — which Notion board, which repository, and the settings you chose.
  • Credentials you paste — Notion tokens, Anthropic keys, GitHub App secrets and webhook secrets. Every one is encrypted with AES-256-GCM before it is written, and nothing decrypted is ever sent to a browser: forms show whether a secret is set, never what it is. Session and callback tokens are stored only as SHA-256 hashes.
  • Run history — the timeline of each run: events, plans, questions and answers, and anything you typed to the agent.

Where it lives

In a Postgres database in Frankfurt (Neon, EU region), behind an app hosted on Vercel. Traffic is measured with Vercel’s analytics — page counts and performance, not advertising profiles.

What is never done

  • No secret appears in a URL, a log line, or an error message.
  • Nothing is sold, shared, or used to train anything.
  • Your repositories and boards are read only for the runs you start, with the access you granted, and that access can be revoked at any time from GitHub or Notion.

Deleting your data

Deleting a project deletes its runs and their whole history with it. Removing the GitHub App or the Notion connection cuts MergeSmith’s access the moment you do it.

Questions

Write to the address on iftah.dev.