Privacy Policy

Overview

Mergen runs on your own machine on every plan: the CLI, the IDE hooks and the VS Code extension all talk to a local server. On a paid plan you can also connect your machines to My Organization, the hosted Governance Console at mergen.app, for shared policy, fleet-wide audit and team approvals. This policy describes what stays on your machine and what My Organization receives, plus the handful of things (billing, optional telemetry) that apply on every plan.

Who is responsible for your data

For your account, billing, the website and Mergen's own operation, Mergen is the controller of your personal data. For the data your organization's machines send to My Organization (audit and approval records, machine metadata), your organization is the controller and Mergen processes that data on its behalf and on its instructions, under the Data Processing Addendum described below. Data that stays on your machine is never received by Mergen, so Mergen is neither controller nor processor of it. Contact for every privacy question: omer@mergen.app.

On your machine

The legacy browser extension

Mergen no longer distributes a browser extension. If you still run the legacy Mergen Chrome or Firefox extension, it captures the following events from browser tabs where you explicitly activate it, and sends them only to the local server described below:

• Console output (console.log, console.warn, console.error)
• Network requests made by the page (fetch, XMLHttpRequest): URL, method, status code, duration, and response body
• DOM snapshots: page URL, active element, localStorage and sessionStorage keys (not values, unless opted in)
• HMR (hot module replacement) events from Vite and webpack dev servers
• WebSocket and Server-Sent Event frames

The extension does NOT capture passwords, form input values, credit card numbers, or any data from browser tabs where Mergen is not actively enabled.

Where local data goes

On every plan, all captured events and gate decisions are sent via HTTP POST to a local server running on your machine at http://127.0.0.1:3000. This address is only reachable from processes running on your own computer: it is not accessible from the internet, your local network, or any other device, and nothing reaches My Organization unless you connect a paid plan to it (see below).

• No command, edit, or event content is sent to Mergen servers. Two exceptions: on Free, a signed-in install reports its protected tool-call count, so the 1,000/month limit cannot be reset by deleting a local file; on a paid plan, a sentence you type into Policies → Describe it is sent to draft a rule (see Subprocessors)
• No data is sent to any third-party analytics, logging, or monitoring service
• Gate decisions, approval history and settings are stored in ~/.mergen/ on your machine for the periods under "Retention and capture policy" below (the audit ledger for 90 days by default); captured runtime events are held in memory
• The ~/.mergen/ directory is stored on your local machine only

Source map de-minification

When source maps are present in your project, Mergen reads them from your local filesystem to convert minified stack frames into readable file paths and line numbers. Source maps are never uploaded or transmitted.

Calibration feedback

When you rate a diagnosis ("Did this fix it?") in My Machine, your feedback is stored locally in ~/.mergen/calibration.json. This file contains only the hypothesis tag, confidence score, and your verdict, never error messages, URLs, or any content from your application. Feedback is used locally to improve which detectors Mergen trusts for your specific codebase.

Local data retention and deletion

To delete all Mergen data on your machine, run:

rm -rf ~/.mergen/

This removes your license key, session history, calibration feedback, and all local configuration. The browser extension stores no data of its own; it only forwards events to the local server.

My Organization (paid plans)

What is transmitted

My Organization is available on Team and Business, and is only active once you sign in and your machine is linked to a paid organization. When it is, the following leaves your machine and is stored server-side, isolated to your organization:

• Actions Mergen blocked or flagged, and resolved approval decisions (outcome, triggering rule, timestamp, approver, and a redacted reason), needed for fleet-wide audit and approval history. Command or tool-call content is included only if your organization's capture policy permits it; by default it is not (see "Retention and capture policy" below)
• For an approval request routed to admins or a team, the identifiers (usually emails) of the people on that machine's approver roster who may approve it, so the console and Slack can refuse an approval from anyone else
• Machine metadata (hostname, operating system, Mergen version, which agent hooks are installed, and which integrations are configured), needed for fleet visibility
• Protected tool-call counts, needed for usage reporting and billing
• Policy sync acknowledgements and errors. Your organization policy is authored in the console and pulled down to each machine, which then enforces it locally
• Account and organization metadata (email, organization membership, role), needed for login and access control

My Organization never receives your source code, file contents, environment variable values, or request/response bodies, and approval and audit reasons pass through a redactor before they leave your machine.

Who can access it

My Organization data is isolated per organization: every read is filtered by organization, and one customer's organization cannot query another's. Access by Mergen personnel is limited to what's needed to operate the service (e.g. responding to a support request) and is not used to train models or shared with third parties.

Retention and capture policy

Mergen supports a configurable data capture policy, separate from whether a tool call is allowed to run: a gate decision (allow/hold/block) is made and enforced identically regardless of what gets retained afterward. By default, command and tool-call content stays on the local machine and is not transmitted to My Organization; an organization administrator can choose to permit additional execution content or metadata to reach My Organization, for example to support fleet-wide audit and governance across a team. This setting is controlled by the organization administrator, not by individual developers or by an AI agent, and applies consistently across every connected machine. Full configuration options are documented at mergen.app/docs/configuration.

Separately, retention durations differ by data type. On your machine, gate-decision audit-ledger records are automatically deleted after 90 days by default (configurable via MERGEN_LEDGER_RETENTION_DAYS), and in-memory event data after 72 hours (configurable via MERGEN_RETENTION_HOURS). In My Organization, audit and approval records are kept for 400 days (a year of history for an annual review, plus a month's margin) and then deleted automatically; unresolved approval requests are deleted after 30 days. Usage reports are kept for about 13 months for billing, and integration status reports for 30 days.

Deleting an organization

Removing a member from your organization revokes that member's licenses. Deleting your organization does not yet remove its records automatically: audit and approval records stay until their 400-day expiry. To have them erased sooner (for example to exercise a right to erasure under the GDPR or CCPA), contact omer@mergen.app; we erase the organization's data, or one member's personal data within it, and confirm within one month. Erased data also leaves our encrypted database backups as they expire, within 30 days. Export anything you want to keep first.

Geographic hosting

My Organization is currently hosted in the EU (the API on Railway in Amsterdam, the database on Supabase in Frankfurt; see Subprocessors below), but we have not yet published a fixed data-residency commitment (e.g. EU-only hosting). If your data-residency requirements are a factor in your decision to use My Organization, contact omer@mergen.app before onboarding and we'll confirm current hosting location and discuss options.

Applies to every plan

License and billing

If you purchase a paid plan, your payment is processed by LemonSqueezy (our payment processor). Mergen receives only a license key and the name and email address on the order to verify your subscription. Payment card details are handled entirely by LemonSqueezy and are never seen by Mergen. Your email is stored in your account record (locally in ~/.mergen/license.json for a solo license, or in your organization's account record on a team plan) and is not shared with third parties beyond the subprocessors listed below.

Why we process it (legal basis)

Under the GDPR and similar laws, each kind of processing needs a legal basis. Ours:

Website analytics and cookies

mergen.app uses Vercel Web Analytics to count page views. It sets no cookies, stores no persistent identifier, and does not track you across sites; it records the page, referrer, country and device type in aggregate. The cookies sign-in needs are set by Clerk, our authentication provider; they are strictly necessary and are not used for advertising or tracking. One more applies only if you arrive through a Lemon Squeezy affiliate link (a URL carrying an aff parameter): only then does mergen.app load Lemon Squeezy's affiliate script, which stores a referral identifier so that the affiliate is credited if you subscribe. Visitors who did not come from an affiliate link never load it. Some preferences, such as the light/dark theme, are kept in your browser's local storage and never sent to us.

International transfers

My Organization's API and database are hosted in the EU. Some subprocessors (Vercel, Clerk, Lemon Squeezy and Anthropic) are based in the United States, so data they process may be transferred outside the EEA. Where that happens we rely on the provider's certification under the EU-US Data Privacy Framework or on the European Commission's Standard Contractual Clauses in its data processing terms. Contact omer@mergen.app for a copy of the relevant safeguards.

Security incidents

If a security incident affects personal data we hold, we will notify affected customers without undue delay, and notify the competent supervisory authority within 72 hours of becoming aware of it where the law requires. For My Organization data, where your organization is the controller, we notify your organization so it can meet its own obligations.

Optional telemetry

Product telemetry is off by default on every plan; connecting to My Organization does not turn it on. To opt in, set MERGEN_TELEMETRY=1 before first start, or call POST /telemetry {"enabled": true} at any time; once enabled, it sends anonymous usage statistics at most once every 24 hours: server version, Node.js version, plan tier, and aggregate tool call counts (e.g. "analyze_runtime was called 3 times today"). No event content, error messages, URLs, or stack traces are included. You can opt out again at any time via POST /telemetry {"enabled": false}, or by checking current status with GET /telemetry.

Subprocessors

Services that may process data on our behalf, and why:

Apart from GitHub's encrypted backups, Slack, GitHub, and PagerDuty only receive data if you explicitly configure that integration; they are not in the data path for any customer who doesn't enable them.

Your rights

On every plan, you can ask to access, export, correct or delete the personal data Mergen holds about you, to restrict or object to its processing, and to withdraw any consent you gave. Contact omer@mergen.app; we answer within one month. If your data is in My Organization, we may refer your request to your organization, which is its controller, and help it respond. For data on your machine, you can do all of this yourself at any time: see "Local data retention and deletion" above. If you are in the EEA or the UK, you also have the right to complain to your local data protection authority.

California residents

Mergen does not sell personal information and does not share it for cross-context behavioral advertising. California residents have the rights described in "Your rights" above, and we will not discriminate against you for using them.

Data Processing Addendum (DPA)

A DPA is available on request for customers on a paid plan: contact omer@mergen.app.

Children

Mergen is a developer tool intended for professional use. It is not directed at children under 13, accounts are for people aged 16 or over (see the Terms of Service), and we do not knowingly collect information from children. If you believe a child has given us personal data, write to omer@mergen.app: we close the account and delete that data within one month.

Changes to this policy

If we make material changes to this privacy policy, we will update this page, increment the version number below, and email account holders before the change takes effect.

Contact

Questions about this privacy policy can be sent to omer@mergen.app.