Privacy Policy

Overview

Mergen ships in two deployment modes with different data-handling profiles: Mergen Local (the default — CLI, MCP server, browser extension, IDE hooks, all running on your own machine) and Mergen Cloud (opt-in, for teams that need cross-device policy sync, fleet audit, or hosted HITL delivery). This policy describes each mode separately so it stays accurate for whichever one you use, plus the handful of things — billing, optional telemetry — that apply regardless of mode.

Mergen Local

What the browser extension captures

The Mergen Chrome and Firefox extensions capture the following events from browser tabs where you explicitly activate the extension:

• Console output (console.log, console.warn, console.error)
• Network requests made by the page (fetch, XMLHttpRequest) — URL, method, status code, duration, and response body
• DOM snapshots — page URL, active element, localStorage and sessionStorage keys (not values, unless opted in)
• HMR (hot module replacement) events from Vite and webpack dev servers
• WebSocket and Server-Sent Event frames

The extension does NOT capture passwords, form input values, credit card numbers, or any data from browser tabs where Mergen is not actively enabled.

Where local data goes

In Mergen Local, all captured events and gate decisions are sent via HTTP POST to a local server running on your machine at http://127.0.0.1:3000. This address is only reachable from processes running on your own computer — it is not accessible from the internet, your local network, or any other device, and Mergen Cloud is not involved unless you explicitly enable it (see below).

• No data is sent to Mergen servers in Local mode
• No data is sent to any third-party analytics, logging, or monitoring service
• No data is stored in a database or file that persists beyond the current debugging session (events are held in a 2,000-event in-memory ring buffer and optionally in a local ~/.mergen/ session file)
• The ~/.mergen/ directory is stored on your local machine only

Source map de-minification

When source maps are present in your project, Mergen reads them from your local filesystem to convert minified stack frames into readable file paths and line numbers. Source maps are never uploaded or transmitted.

Calibration feedback

When you rate a diagnosis ("Did this fix it?") in My Machine, your feedback is stored locally in ~/.mergen/calibration.json. This file contains only the hypothesis tag, confidence score, and your verdict — never error messages, URLs, or any content from your application. Feedback is used locally to improve which detectors Mergen trusts for your specific codebase.

Local data retention and deletion

To delete all Mergen Local data, run:

rm -rf ~/.mergen/

This removes your license key, session history, calibration feedback, and all local configuration. The browser extension stores no data of its own — it only forwards events to the local server.

Mergen Cloud

What is transmitted

Mergen Cloud is opt-in (MERGEN_CLOUD_MODE=true, or a hosted policy-sync/fleet-audit workspace you create). When enabled, the following leaves your machine and is stored server-side, isolated to your tenant:

• Gate decisions and audit events (allow/hold/block outcomes, triggered policy, timestamp, actor) — needed to power fleet-wide audit history and the CI gate. Additional execution details, including command or tool-call content, are transmitted only if your organization's configured retention policy permits it — by default, that content is not transmitted (see "Retention and capture policy" below)
• Incident and telemetry data you send to Mergen Cloud endpoints (e.g. /incident, OTLP traces/logs) — needed for cross-device incident correlation and the impact report
• Policy configuration and override-corpus entries you sync across your team — needed so every developer's local gate enforces the same rules
• Account and workspace metadata (email, org membership, RBAC role) — needed for login and access control

Mergen Cloud never receives your source code, environment variable values, or full request/response bodies beyond what a specific integration (e.g. OTLP trace ingest) is configured to send — and the PII shield redacts emails, phone numbers, AWS keys, PEM certs, JWTs, and credit card numbers on write, before storage, on top of whatever your organization's retention policy already withheld.

Who can access it

Cloud-mode data is tenant-isolated: every read is filtered by tenant ID, and one customer's workspace cannot query another's. Access by Mergen personnel is limited to what's needed to operate the service (e.g. responding to a support request) and is not used to train models or shared with third parties.

Retention and capture policy

Mergen supports a configurable data capture policy, separate from whether a tool call is allowed to run — a gate decision (allow/hold/block) is made and enforced identically regardless of what gets retained afterward. By default, command and tool-call content stays on the local machine and is not transmitted to Mergen Cloud; an organization administrator can choose to permit additional execution content or metadata to reach Mergen Cloud, for example to support fleet-wide audit, governance, or CI-gate workflows across a team. This setting is controlled by the organization administrator, not by individual developers or by an AI agent, and applies consistently across every connected machine. Full configuration options are documented at mergen.app/docs/configuration.

Separately, retention durations differ by data type: raw event/telemetry data (console, network, HMR events sent to a Cloud endpoint) is automatically deleted after 72 hours by default (configurable via MERGEN_RETENTION_HOURS). Gate-decision audit-ledger records are automatically deleted after 90 days by default (configurable via MERGEN_LEDGER_RETENTION_DAYS). Incident records do not currently have an automatic expiry and are retained for the lifetime of your workspace to preserve audit-trail integrity — a common requirement for the compliance use cases Mergen Cloud is built for.

Deleting a workspace or organization

Deleting your Cloud workspace revokes all API keys and marks the workspace inactive immediately. It does not delete previously recorded incident, event, or audit-ledger data — that data is retained after workspace deletion for the same audit-trail-integrity reason described above, and is not currently removed by a self-service action. If you need this data removed (e.g. to exercise a right to erasure under GDPR/CCPA), contact privacy@mergen.app and we will evaluate the request — including options like redacting personal data from retained audit records while keeping the non-personal audit trail (rule triggered, outcome, timestamp) intact.

Geographic hosting

Mergen Cloud infrastructure is currently hosted with our infrastructure providers (see Subprocessors below); we have not yet published a fixed data-residency commitment (e.g. EU-only hosting). If your data-residency requirements are a factor in your decision to use Mergen Cloud, contact privacy@mergen.app before onboarding and we'll confirm current hosting location and discuss options.

Applies to both modes

License and billing

If you purchase a paid plan, your payment is processed by LemonSqueezy (our payment processor). Mergen receives only a license key and your email address to verify your subscription. Payment card details are handled entirely by LemonSqueezy and are never seen by Mergen. Your email is stored in your account record (locally in ~/.mergen/license.json for a solo license, or in your Cloud workspace for a team plan) and is not shared with third parties beyond the subprocessors listed below.

Optional telemetry

Product telemetry is off by default in both Mergen Local and Mergen Cloud — enabling Cloud mode does not turn it on. To opt in, set MERGEN_TELEMETRY=1 before first start, or call POST /telemetry {"enabled": true} at any time; once enabled, it sends anonymous usage statistics at most once every 24 hours: server version, Node.js version, plan tier, and aggregate tool call counts (e.g. "analyze_runtime was called 3 times today"). No event content, error messages, URLs, or stack traces are included. You can opt out again at any time via POST /telemetry {"enabled": false}, or by checking current status with GET /telemetry.

Subprocessors

Services that may process data on our behalf, and why:

Slack, GitHub, and PagerDuty only receive data if you explicitly configure that integration — they are not in the data path for any customer who doesn't enable them.

Your rights

Regardless of deployment mode, you can request to access, export, correct, or delete personal data Mergen holds about you by contacting privacy@mergen.app. For Mergen Local, you can also do this yourself at any time — see "Local data retention and deletion" above.

Data Processing Addendum (DPA)

A DPA is available on request for customers on a paid plan — contact privacy@mergen.app.

Children

Mergen is a developer tool intended for professional use. It is not directed at children under 13 and does not knowingly collect information from children.

Changes to this policy

If we make material changes to this privacy policy, we will update this page and increment the version number below. Continued use of Mergen after a policy update constitutes acceptance of the revised policy.

Contact

Questions about this privacy policy can be sent to privacy@mergen.app or general support at hello@mergen.app.