Legal
Privacy Policy
Last updated: August 28, 2026
This policy is written to be read, not skimmed past. It describes exactly what MergeSafe collects, why, where it lives, and how to erase it. How we treat your code is covered in depth on the security page.
The short version
- We collect the minimum: your email, name and avatar from GitHub or Google sign-in, and your audit reports.
- Your code is deleted as soon as each analysis finishes.
- No trackers, no ads, no data sales, no AI training, no marketing emails — we don't even have the ability to send email.
- One click exports everything as JSON; one click deletes everything, for real.
Who we are
MergeSafe (mergesafe.io) is an early-stage product operated by its founder and is not yet incorporated as a company; this policy will be updated when it is. For anything in this policy — questions, requests, complaints — the data controller can be reached at contact@mergesafe.io. Messages go straight to the founder.
What we collect
Account data. Sign-in is exclusively via GitHub or Google, so we never see or store a password. From your provider we receive and keep your email address, display name and avatar URL, plus the technical tokens needed to operate the integration (never shown to anyone, deleted with your account).
Your code — briefly. Code you submit is processed only for the duration of its analysis and then deleted. It never reaches our database.
Your reports. Each analysis stores its scores and findings: the project name (or owner/repo for GitHub analyses), file paths, line numbers and plain-language explanations. A few performance findings include an excerpt of the flagged line capped at 200 characters; detected secrets are recorded by type and location only, never their value.
Your triage decisions. If you dismiss or confirm a finding, we store that rule — including the optional free-text reason you may write.
API keys. Stored only as a cryptographic hash plus a short display prefix, with a last-used timestamp. The full key is shown to you once and cannot be recovered by anyone, including us.
Technical basics. Rate limiting briefly uses your IP address in the server's memory only — it is never written to a database. Server logs avoid personal identifiers and rotate with a hard size cap.
What we don't do
- No analytics or tracking scripts — the site ships with zero third-party trackers.
- No advertising, no sale or sharing of personal data — to anyone, ever.
- No AI training on your data, and no AI model ever receives your code.
- No emails — marketing or otherwise. MergeSafe has no email-sending capability at all.
- No profiling and no automated decisions about you.
Why we process it (legal bases)
- To provide the service (contract, GDPR art. 6(1)(b)) — your account, your analyses, your reports, your API keys.
- To keep the service safe (legitimate interest, art. 6(1)(f)) — rate limiting, abuse prevention, bounded technical logs.
- We run no consent-based processing — there is nothing here (no trackers, no marketing) that would need it.
Where your data lives
The API, the analysis engine and the database run on AWS in Stockholm, Sweden (eu-north-1) — inside the EU. Traffic is HTTPS-only.
Three third parties touch limited data, strictly to make the service work:
- Vercel serves the website itself, and as any web host processes visitor IP addresses to deliver pages.
- GitHub and Google act as sign-in providers, and GitHub additionally as the source of repositories you explicitly connect.
That is the complete list. No analytics vendor, no email provider, no AI provider.
How long we keep things
- Your code: minutes — the duration of the analysis, then deleted.
- Full reports: kept until a newer analysis of the same project supersedes them; older reports are then stripped down to scores only.
- Scores: kept while your account exists, so your history keeps working.
- Account data: until you delete your account.
- After deletion: nothing personal remains. We keep a single pseudonymized audit entry (a one-way cryptographic hash proving a deletion happened, linkable to no one) as required for accountability.
Your rights — and the buttons that exercise them
GDPR gives you rights of access, rectification, erasure, portability, restriction and objection. We've built the two big ones directly into your profile page:
- Export — download everything we hold about you (profile + all reports) as a JSON file, anytime.
- Delete — one click erases your account and every analysis in a hard delete, revokes our access tokens at GitHub and Google, and instantly invalidates every login session. There is no soft-delete, no retention window, no "30 days to change your mind".
For anything else — rectification, objection, questions — email contact@mergesafe.io. You also have the right to lodge a complaint with your supervisory authority (in France: the CNIL, cnil.fr).
Changes to this policy
If this policy changes, the date at the top changes with it, and material changes will be announced on the site before they take effect. We will never quietly weaken what this page promises.