Privacy

What ForgeVPS can access on your machines

Connecting a machine means installing a ForgeVPS public key into its authorized_keys as root. This is the same access you have over SSH, and there is no narrower version of it: the product installs packages, edits system configuration, manages a firewall and runs your build and start commands.

In practical terms ForgeVPS can read any file on the machine, run any command, and see any output. The Terminal, Files and Logs features are exactly that capability, exposed to you deliberately. There is no technical barrier stopping the same access being used otherwise; what there is instead is that the software only makes the connections described here, and that you can remove the key at any time.

Removing the ForgeVPS key from a machine’s authorized_keys prevents new SSH connections authenticated with that key. Existing authenticated connections must also be terminated to end access immediately. Use your own SSH connection or your provider’s console to revoke access. Removing a connected machine from ForgeVPS does not automatically remove its public key from your server.

What is stored in the ForgeVPS database

Your account, from signing in with Google:

• Your name, email address and profile picture URL
• Your Google account identifier and OAuth tokens, for signing you in
• Session records while you are signed in
• Your plan and when your free trial first started, to manage access and prevent repeat trials on the same account

For each machine you connect:

• A name you chose, its IPv4 address, SSH username and port
• A keypair generated for that machine. The public half is stored as-is; the private half is encrypted with AES-256-GCM before it is written, and is only ever decrypted in memory to open a connection
• Status, provisioning progress, and when it was last reached
• For machines ForgeVPS created rather than ones you connected: the provider region, server type and image

For each app you deploy:

• The repository name and branch, and your install, build and start commands
• The assigned port, deploy status, and which release is live
• If a deploy fails, the reason and the last few kilobytes of its build output, so the failure can be shown to you. This is scanned before storage and known credential formats — private keys, passwords inside connection strings, API token shapes, authorization headers — are masked
• Which GitHub installation the repository came from, and its account name

When something goes wrong:

• Error messages, stack traces and context such as the route, your user id and the machine involved. These are scanned for credentials the same way build output is, and are deleted after 30 days
• One line per web request in the server log: the time, method, path, status and duration. Query strings are removed rather than logged

What stays on your machine and is never copied here

A deliberate amount of the product keeps its data on your server rather than in this database, which means it stays yours and it disappears when you delete or disconnect the machine:

• Environment variables for your deployed apps. These are written to a file on your machine and read from there. ForgeVPS transfers them over SFTP when you edit them but does not retain a copy
• Your application’s runtime logs. Streamed from files on your machine when you open the Logs tab, never stored here
• Deploy history and build logs, which are files alongside your releases
• Dev server configuration and custom domains, which live in files and in your machine’s web server configuration
• Your code, which is cloned from GitHub to your machine directly and never passes through ForgeVPS storage

First-party analytics on the website and app

ForgeVPS automatically collects usage analytics on its landing page, guides and application to understand acquisition, improve the product, identify where onboarding fails and measure the sales funnel. There is no permission popup. This notice describes that processing; using the service is not recorded as an affirmative analytics-consent choice.

• Page visits, public guide slugs, grouped app routes, timestamps, coarse device/browser/operating-system categories and browser language
• Public referrer hostnames and sanitized campaign tags such as source, medium and campaign; not complete referring URLs or arbitrary query strings
• Foreground engagement time, page scroll depth, navigation and named actions such as viewing the paywall, opening checkout, connecting a machine or completing a deployment
• On the public landing page: named sections seen for at least one second, deepest page reach, CTA placement and depth at the time of a click. We do not store click coordinates, page snapshots, mouse-movement trails or text from clicked elements. A random page-visit ID and layout version keep observations together. Linked sign-ins, trials and verified payments can be attributed to the latest landing visit within seven days, using only activity observed before each outcome
• Waitlist submission attempts and whether the landing page showed a success or error response; analytics does not include the email field
• Random visitor and visit identifiers. Where a browser can be linked to a signed-in account, operators can view that account’s activity and its journey from the landing page into the app

Analytics never records terminal input or output, commands, keystroke contents, clipboard contents, code, file contents or filenames, SQL, passwords, environment-variable values, OAuth tokens or payment-card details. Our first-party collector does not use session replay, advertising pixels, fingerprinting or IP geolocation. An IP-derived hash is used temporarily in memory for request rate limiting, not stored in the analytics database.

Usage events, visits and inactive visitor records are removed after 180 days. Reports are available only to authorized ForgeVPS operators. Verified account and payment records are separate from optional usage tracking: disabling usage analytics does not disable billing, security logs or the records needed to provide your account.

Cookies and your analytics preference

The app uses necessary sign-in/session cookies. Analytics additionally uses signed first-party cookies on app.forgevps.com: a visitor identifier lasting up to 90 days and a visit identifier with a rolling 30-minute lifetime. The landing page sends events to that same first-party collector, allowing continuity between the website and app without sharing your sign-in cookies with the landing-page server.

Usage analytics is on by default unless you have opted out. Explicit choices are remembered for up to a year in this browser and, when signed in, on your account. We preserve previously recorded opt-outs. Browser collection also honors Do Not Track and Global Privacy Control signals. You can change your choice or delete linked usage history below or in Settings, without losing access. Sign in to apply deletion to your account’s linked usage history; while signed out it applies only to the current unlinked browser identity. Clearing cookies can remove a browser-only preference.

Payments and waitlist information

Stripe processes payments. We store your plan and Stripe customer, checkout, payment and refund identifiers, amounts, currency, payment status, timestamps, tax/discount amounts and billing country when supplied. We retain financial records for accounting and payment reconciliation even when usage tracking is off; account links are removed when the account is deleted. We do not store card numbers.

If you submit the landing-page waitlist form, the email address you provide, submission time, form location and campaign information are stored separately to notify you about ForgeVPS. That is separate from an analytics event and is not automatically matched to an app account. Contact us below to remove your waitlist entry.

Who can see it

Account access is per-user: every part of the application checks that a machine or app belongs to you before doing anything with it.

The exception worth stating plainly is that ForgeVPS operators can see the error and analytics records described above, including account-linked activity and payment history, across accounts. That is how faults get diagnosed and the service is measured. Operators also, unavoidably, have administrative access to the database and to the server the product runs on.

Third parties

• Stripe — checkout, payment processing and payment reconciliation
• Vercel — hosts the landing page and provides separate, aggregated Web Analytics for that website
• Google — sign-in. They confirm who you are and supply your name, email and picture
• GitHub — repository access, through a GitHub App you install and can uninstall. ForgeVPS requests short-lived tokens as needed rather than storing a long-lived one
• Supabase — the hosted PostgreSQL database everything above is stored in
• Hetzner — only for machines ForgeVPS creates on your behalf. Machines you connect yourself involve no provider relationship on our side

Our first-party usage analytics is stored in our own PostgreSQL database, hosted by Supabase. Separately, the landing page sends page views to Vercel Web Analytics, including page paths, referrers, device/browser information and approximate location. We remove page URL queries and fragments and do not send account IDs or payment records to Vercel. This integration respects the analytics opt-out and browser signals described above. Vercel uses a request-derived identifier that is discarded after 24 hours; its reports are separate from your account-linked ForgeVPS history. See Vercel’s analytics privacy documentation. We do not use Google Analytics or DataFast. We do not sell this data or share it with advertising networks.

Deleting your data

Settings has a JSON export of account and infrastructure configuration, excluding your machines’ encrypted private keys. Signed-in users can also download linked analytics and payment history, without an active plan. For a waitlist entry or other records, contact us below. You can also delete usage history using the control above.

Deleting your account removes your account record, machine records, app configuration and GitHub connections. It does not touch your servers: they are yours, rented from your provider, and anything ForgeVPS deployed keeps running exactly as it is. What ends is the ability to reach them from here. The ForgeVPS key remains in each machine’s authorized_keys until you remove it, and removing it is worth doing.

Security, stated honestly

Machine private keys are encrypted at rest with a key held in the server’s environment. That protects against a stolen database backup. It does not protect against someone who compromises the server itself, since anything running there can decrypt what it is able to read. Connections to your machines use SSH; the site is served over HTTPS.

Changes and contact

Material changes to what is collected will be reflected here. For anything about this page, or to ask what is held about you, email gary@forgevps.com.