Privacy

Who is responsible for your information

Gary Jensen, operating as ForgeVPS in British Columbia, Canada, is responsible for the information processed by the ForgeVPS-operated website, hosted service, billing and download services. Gary is also the privacy contact: gary@forgevps.com.

This notice describes our processing, including information from customers outside Canada. When you self-host, you control the data in your installation and are responsible for your own users, applications and any privacy obligations that apply to that processing. A local installation administrator and its infrastructure providers may have access to that installation; they are not automatically ForgeVPS operators.

Self-hosted installations

The self-hosted panel uses its own database, local accounts, password hashes, sessions and machine credentials. These are not synchronised to our hosted database. Terminal sessions, file contents, database contents, local operational logs and credentials used by the workspace are not relayed through ForgeVPS.com. Installing the panel does not give Gary or the hosted service a remote login to it.

The installer and updater contact our HTTPS licensing service to authorise installation and update downloads. We receive and process:

• Your hosted account and monthly or lifetime entitlement, including existing complimentary lifetime plans and completed discounted purchases
• A random installation ID and an installation name, which currently defaults to your machine’s hostname
• Pairing and authorisation codes, licence credentials and installation secrets, transmitted over HTTPS; stored credential verifiers are hashes
• Creation, expiry and revocation information for licences, pairings and installations, and the release and operating-system/architecture target requested for download or an update check
• Normal connection and request metadata received by our servers and infrastructure, including the connecting IP address. A direct network connection is not anonymous even though workspace contents are not sent

Installation names and identifiers remain in your hosted account’s installation records while the account is retained. Removing an installation marks its credentials revoked and hides it from the active list; the revocation record and installation name remain until the account is deleted, subject to legal retention requirements. Expired pairing records are cleaned up during subsequent pairing activity. Receiving a release request does not mean we maintain a history of every locally installed version.

Opening the update panel can check the available release; manual update checks and enabled automatic updates also contact the release service. Lifetime installations do not require online checks for routine local sign-in or workspace use. Monthly installations periodically send their signed installation receipt to confirm subscription access and cache signed confirmations for up to seven days. These checks include the installation and licence identifiers, with normal connection metadata; they do not send workspace contents. New self-hosted releases send optional product-usage events to ForgeVPS.com by default. These are linked to the hosted account that activated the installation, not anonymous. Events include feature selections, action types and success/failure categories, foreground active time, event times, random session and installation identifiers, and the ForgeVPS release version. Local account names and emails are not included. Raw errors and operational logs are not uploaded. Visiting our website or approving an installation is separate hosted activity.

You can turn off this installation’s analytics or delete its linked usage history in Settings. A deletion timestamp is retained to reject delayed retries of erased events. Your hosted account’s analytics opt-out also stops collection for linked installations. Browser privacy signals are respected. Reporting never authorises a remote login, and analytics failure does not prevent local work. Unsent events are held only in bounded memory for up to ten minutes, and opting out clears that queue. Older releases do not report usage. The collector does not store machine IPs, hostnames, domains, repository URLs, file names or paths, commands, terminal output, SQL or database contents. Network infrastructure still receives the source IP as part of delivering HTTPS requests.

Installation and operation can contact third parties directly: operating system package repositories, software download providers, integrations you enable, and a certificate authority for HTTPS. The default public-IP HTTPS setup uses Caddy and Let’s Encrypt. Certificates are publicly logged through Certificate Transparency, which can expose the IP address or domain named in a certificate. Certificate private keys stay on your server. These contacts are separate from ForgeVPS usage analytics.

Removing an installation from your hosted account revokes its future download credentials; it does not uninstall the local panel or erase its database, accounts, logs or backups. Use your own administrator access to manage or delete those local copies.

Apple apps: direct SSH and device storage

The ForgeVPS apps for iPhone, iPad and Mac bundle their workspace interface and connect directly from your device to your Linux server over SSH. ForgeVPS account services do not proxy these SSH connections or receive their terminal contents, files, SQL or database results.

Each device generates its own SSH key. Private keys, connection records and saved server identities are stored in that device’s Keychain with device-only, non-synchronising protection. Connect each device separately to use the same VPS; shared terminal sessions and workspace state are stored on the VPS. Connecting a machine in an Apple app does not create a hosted machine connection or upload its private key to ForgeVPS.

The apps contact ForgeVPS for sign-in, account and plan verification, purchase reconciliation, sign-out and account deletion. The same ForgeVPS account can provide access across the apps and hosted website. Apple and RevenueCat process purchases as described below. Normal HTTPS connection metadata, including your connecting IP, is received by those services and their infrastructure.

Optional QR pairing uses an encrypted, short-lived relay hosted by ForgeVPS. The QR contains the pairing secret; keep it private because scanning it authorises the first device that completes pairing. The relay holds encrypted pairing messages until expiry or cleanup; the encryption secret and the device’s private SSH key are not sent to the relay. The server receives the device’s public key. Manual public-key setup is also available.

The Apple apps send first-party usage and diagnostic events as part of normal operation, without a separate analytics prompt or in-app opt-out: screens reached, feature interactions, foreground active time, action outcomes, sanitized failure categories and startup/connection timings. Reports include app platform, version, build, operating-system major version, environment and a random per-launch session identifier. Before sign-in, reports are anonymous and are not later linked to your account. While signed in, reports are linked to your ForgeVPS account. Changing accounts starts a new analytics session. We do not collect screen recordings, terminal input/output, editor contents, SQL, credentials, server addresses or file paths in these events.

We use these reports to measure feature adoption, understand onboarding and purchase flows, and diagnose reliability and performance issues. Current Apple-app releases collect these reports by default; the website and self-hosted analytics preferences do not disable this app reporting. Older app versions with an analytics switch retain their previous behaviour until updated. Updating does not change your website or self-hosted preferences. You may contact gary@forgevps.com about your data, including access or deletion requests. Anonymous pre-sign-in reports cannot be identified as belonging to a later account. Unsent events stay only in memory, limited to 200 events and ten minutes; raw server-side analytics are retained for up to 180 days. When you clear linked usage history or delete your account, we retain monthly counters for event types, features, platform, outcomes and rounded duration totals. These summaries have no account, session, visitor, device, purchase or installation identifiers, exact timestamps, attribution, or free-form data. They cannot be used to reopen an individual activity history and are kept for historical product reporting. Separate financial records may retain transaction identifiers as needed for billing and legal obligations. Minimal deletion-control records prevent delayed events restoring erased history. Purchase records are separate from app usage analytics. Apple may provide beta crash and diagnostic reports through TestFlight.

Onboarding answers and app preferences stay on your device; analytics records which onboarding screens were reached, not your selected answers. Signing out clears sign-in but keeps your device connections. After the service confirms account deletion, the requesting app removes that account’s local connection records, SSH keys and saved server identities. Interrupted cleanup retries on reopening; minimal account-identifier markers prevent deleted keys from being recreated by in-flight work. Remove connection records separately on your other devices. Removing a connection or deleting an account does not delete your VPS, its files, shared terminal state or entries in its authorised-key list. Use your own SSH access or provider console to revoke server access. Apple subscriptions must be cancelled separately.

Hosted connections: what ForgeVPS can access on your machines

Connecting a machine means installing a ForgeVPS public key into its authorized_keys as root. This is the same access you have over SSH, and there is no narrower version of it: the product installs packages, edits system configuration, manages a firewall and runs your build and start commands.

In practical terms ForgeVPS can read any file on the machine, run any command, and see any output. The Terminal, Files and Logs features are exactly that capability, exposed to you deliberately. There is no technical barrier stopping the same access being used otherwise; what there is instead is that the software only makes the connections described here, and that you can remove the key at any time.

Removing the ForgeVPS key from a machine’s authorized_keys prevents new SSH connections authenticated with that key. Existing authenticated connections must also be terminated to end access immediately. Use your own SSH connection or your provider’s console to revoke access. Removing a connected machine from ForgeVPS does not automatically remove its public key from your server.

What is stored in the hosted ForgeVPS database

Your account, from signing in with Google or Apple:

• Your name, email address and profile picture URL
• Your sign-in provider’s account identifier and OAuth tokens, for signing you in and revoking the connection when you delete your account
• Session records while you are signed in
• Your plan and historical trial records, to manage access and retain account history

For Apple purchases, we store the product and transaction identifiers, purchase environment, an account-association identifier, and verified access, expiration and revocation status. RevenueCat validates purchases with Apple and helps reconcile subscription changes, restores and refunds. We send RevenueCat a random identifier linked to your ForgeVPS account and purchase information. Its SDK also sends app, device and operating-system information needed to operate the purchase service. We do not send it your server credentials, files, terminal contents, account name or email. Automatic advertising-identifier collection is disabled. Apple processes payment; ForgeVPS does not receive your payment-card information. When you delete your ForgeVPS account, we request deletion of the linked RevenueCat customer profile; RevenueCat processes erasure asynchronously. Necessary purchase and ownership records may remain in our billing ledger and with Apple for billing, fraud prevention and legal retention; deleting your account does not cancel an Apple subscription.

The Apple apps use the direct-SSH design described above. Their local machine records and SSH keys are separate from hosted workspace records.

For each machine you connect:

• A name you chose, its IPv4 address, SSH username and port
• A keypair generated for that machine. The public half is stored as-is; the private half is encrypted with AES-256-GCM before it is written, and is only ever decrypted in memory to open a connection
• Status, provisioning progress, and when it was last reached
• For machines ForgeVPS created rather than ones you connected: the provider region, server type and image

For each app you deploy:

• The repository name and branch, and your install, build and start commands
• The assigned port, deploy status, and which release is live
• If a deploy fails, the reason and the last few kilobytes of its build output, so the failure can be shown to you. This is scanned before storage and known credential formats — private keys, passwords inside connection strings, API token shapes, authorization headers — are masked
• Which GitHub installation the repository came from, and its account name

When something goes wrong:

• Error messages, stack traces and context such as the route, your user id and the machine involved. These are scanned for credentials the same way build output is, and are deleted after 30 days
• One line per web request in the server log: the time, method, path, status and duration. Query strings are removed rather than logged

Hosted mode: data retained on your machine

The following information is primarily retained on your server, rather than in the hosted product database. It can pass through the hosted workspace when you view or edit it. Disconnecting a machine does not delete these files or logs from your server:

• Environment variables for your deployed apps. These are written to a file on your machine and read from there. ForgeVPS transfers them over SFTP when you edit them but does not retain a copy
• Your application’s runtime logs. Streamed from files on your machine when you open the Logs tab, never stored here
• Deploy history and build logs, which are files alongside your releases. Limited failed-build output may also be retained in the hosted database as described above
• Dev server configuration and custom domains, which live in files and in your machine’s web server configuration
• Your code, which is cloned from GitHub to your machine directly. Files you open, upload or edit can pass through the hosted service to fulfil that request; it is not intended to keep a separate repository copy

First-party analytics on our website and hosted app

ForgeVPS automatically collects usage analytics on its landing page, guides and hosted application to understand acquisition, improve the product, identify where onboarding fails and measure the sales funnel. There is no permission popup for this first-party collection. This notice describes that processing; using the service is not recorded as an affirmative analytics-consent choice.

• Page visits, public guide slugs, grouped app routes, timestamps, coarse device/browser/operating-system categories and browser language
• The connecting IP address for each tracked visit, and an approximate country derived locally from that address. Country can be linked to a signup and retained in first/last-touch purchase attribution. VPNs and mobile networks may make this estimate inaccurate; we do not collect GPS coordinates or infer a street address.
• Public referrer hostnames and sanitized campaign tags such as source, medium and campaign. A keyed reference derived from a Google advertising click identifier recognizes repeat visits from the same tagged click. We do not retain raw click identifiers, complete referring URLs or arbitrary query strings in our analytics database
• Foreground engagement time, page scroll depth, navigation and named actions such as viewing the paywall, opening checkout, connecting a machine or completing a deployment
• On the public landing page: named sections seen for at least one second, active viewing time per visible section, deepest page reach, CTA placement and depth at the time of a click. We also record named demo interactions and chapters, active demo time, coarse load timings, and fixed categories of loading failures. We do not store click coordinates, page snapshots, mouse-movement trails or text from clicked elements. A random page-visit ID and layout version keep observations together. Linked sign-ins, historical trial events and verified payments can be attributed to the latest landing visit within seven days, using only activity observed before each outcome
• Waitlist submission attempts and whether the landing page showed a success or error response; analytics does not include the email field
• Random visitor and visit identifiers. Where a browser can be linked to a signed-in account, operators can view that account’s activity and its journey from the landing page into the app

Analytics never records terminal input or output, commands, keystroke contents, clipboard contents, code, file contents or filenames, SQL, passwords, environment-variable values, OAuth tokens or payment-card details. Our first-party collector does not use session replay, advertising pixels or fingerprinting. Raw analytics IP addresses are cleared during daily cleanup after 30 days. IP-to-country lookups run locally; visitor IPs are not sent to an external geolocation service. This product includes GeoLite2 data created by MaxMind, available from MaxMind. An IP-derived hash is also used temporarily in memory for request rate limiting.

Usage events, visits and inactive visitor records are removed after 180 days. Reports are available only to authorized ForgeVPS operators. Verified account and payment records are separate from optional usage tracking: disabling usage analytics does not disable billing, security logs or the records needed to provide your account.

Website cookies and your analytics preference

The hosted web app uses necessary sign-in/session cookies. Website analytics additionally uses signed first-party cookies on app.forgevps.com: a visitor identifier lasting up to 90 days and a visit identifier with a rolling 30-minute lifetime. The landing page sends events to that same first-party collector, allowing continuity between the website and app without sharing your sign-in cookies with the landing-page server.

Website usage analytics is on by default unless you have opted out. Explicit choices are remembered for up to a year in this browser and, when signed in, on your account. We preserve previously recorded opt-outs. Browser collection also honors Do Not Track and Global Privacy Control signals. You can change your choice or delete linked usage history below or in Settings, without losing access. Sign in to apply deletion to your account’s linked usage history; while signed out it applies only to the current unlinked browser identity. Clearing cookies can remove a browser-only preference.

Payments and waitlist information

Stripe processes payments. We store your plan and Stripe customer, checkout, payment and refund identifiers, amounts, currency, payment status, timestamps, tax/discount amounts and billing country when supplied. We retain financial records for accounting and payment reconciliation even when usage tracking is off; account links are removed when the account is deleted. We do not store card numbers.

If you submit the landing-page waitlist form, the email address you provide, submission time, form location and campaign information are stored separately to notify you about ForgeVPS. That is separate from an analytics event and is not automatically matched to an app account. Contact us below to remove your waitlist entry.

Who can see it

Hosted account access is scoped to the signed-in account. Self-hosted administrators control access to their own installation and its machine.

The exception worth stating plainly is that ForgeVPS operators can see the error and analytics records described above, including account-linked activity and payment history, across accounts. That is how faults get diagnosed and the service is measured. Operators also, unavoidably, have administrative access to the database and to the server the product runs on.

Third parties

• Stripe — checkout, payment processing and payment reconciliation
• Apple and RevenueCat — iOS purchases, subscription status, restoration and refund reconciliation, using purchase information and an account-linked identifier
• Vercel — hosts the landing page and provides separate, aggregated Web Analytics for that website
• Google — sign-in. They confirm who you are and supply your name, email and picture for hosted accounts. Self-hosted local sign-in does not require Google
• GitHub — repository access, through a GitHub App you install and can uninstall. ForgeVPS requests short-lived tokens as needed rather than storing a long-lived one
• Supabase — the hosted PostgreSQL database for our hosted account, licensing and product records. Self-hosting uses the database configured for that installation
• Hetzner — only for machines ForgeVPS creates on your behalf. Machines you connect yourself involve no provider relationship on our side

Our first-party usage analytics is stored in our own PostgreSQL database, hosted by Supabase. Separately, the landing page sends page views to Vercel Web Analytics, including page paths, referrers, device/browser information and approximate location. We remove page URL queries and fragments and do not send account IDs or payment records to Vercel. This integration respects the analytics opt-out and browser signals described above. Vercel uses a request-derived identifier that is discarded after 24 hours; its reports are separate from your account-linked ForgeVPS history. See Vercel’s analytics privacy documentation. We do not use Google Analytics or DataFast. We do not sell this data or share it with advertising networks.

Deleting your data

In the iOS app, Account → Delete account remains available without an active plan. Deletion disconnects Sign in with Apple when linked. Cancel Apple subscriptions separately in Apple’s subscription settings; deleting a ForgeVPS account does not cancel Apple billing. Self-hosted installation data remains under your control.

Hosted Settings has a JSON export of account and infrastructure configuration, excluding your machines’ encrypted private keys. Signed-in users can also download linked analytics and payment history, without an active plan. For a waitlist entry or other records, contact us below. You can also delete usage history using the control above.

Deleting your hosted account removes your account record, machine records, app configuration, GitHub connections and associated self-host licence and installation records. Anonymous monthly usage counters are retained without account, visitor or session links. Financial records may remain as described above. It does not touch your servers: they are yours, rented from your provider, and anything ForgeVPS deployed keeps running exactly as it is. What ends is the ability to reach them from here. The ForgeVPS key remains in each machine’s authorized_keys until you remove it, and removing it is worth doing.

Security, stated honestly

Machine private keys are encrypted at rest with a key held in the server’s environment: our server in hosted mode, and your own installation in self-hosted mode. That protects against a stolen database backup. It does not protect against someone who compromises the server itself, since anything running there can decrypt what it is able to read. Connections to your machines use SSH; the site is served over HTTPS.

Location, retention and your rights

Our service providers may process information in Canada or other countries, where local laws and lawful government-access powers may differ. Self-hosted data location depends on the infrastructure and integrations you choose; self-hosting does not move your hosted billing and licence records onto your VPS.

We retain account and licensing information as needed to provide access, address disputes and comply with legal obligations. The specific usage and error retention periods are stated above. Local self-hosted records and backups remain under your administrator’s retention choices.

You may ask Gary for access to or correction of personal information we hold, ask about our practices, or raise a privacy complaint. Where applicable, you may withdraw consent subject to legal and contractual limits; we will explain effects on services that need the information. We may verify your identity before acting. If we cannot resolve a complaint, you can contact the Office of the Information and Privacy Commissioner for British Columbiaor another privacy regulator with jurisdiction. This notice does not limit rights available under applicable privacy law.

Changes and contact

Material changes to what is collected will be reflected here. For anything about this page, or to ask what is held about you, email gary@forgevps.com.