Privacy Policy
Last updated 16 September 2026
VergeServer is a private operations console. It is used by one operator and the people they invite to monitor and manage the servers, cloud accounts and projects that operator runs. It is not a consumer service, there is no public sign-up, and accounts exist only because an administrator created them.
VergeServer is operated by Verge Inc., a company based in California, United
States (“we”, “us”). This policy explains what we collect, why we hold it,
who else can see it, and how long it is kept. It covers the console at https://127.0.0.1:2012,
the desktop application, the mobile application, and the tool endpoints that projects call. Verge
Inc. is the controller of the information described here, except where we act on an operator's
instructions, as set out in section 1.
1. Who this policy is about
- Authorised users — the operator, and the team members an administrator has created an account for.
- People whose details pass through the tools — for example the recipient of a WhatsApp message or a voice call placed by a project, or the sender of an email that becomes a change request. We process those details on behalf of the project that asked for the message or call; that project is responsible for having a lawful reason to contact the person.
Data belonging to an operator's own customers, which sits inside the databases, buckets, mailboxes and servers VergeServer connects to, remains the operator's. VergeServer is a tool for reaching that infrastructure, and it holds only what is described below.
2. What we collect
Account and sign-in
- Name, email address, profile photo, role (Administrator, Contributor, Read Only) and the per-user scopes that decide which sections, projects and services the account can open.
- A password stored only as a bcrypt hash, and the secret behind the authenticator app used for the mandatory second step of every sign-in.
- Activation and password-reset codes, which expire.
- The IP address the sign-in came from. Where an administrator has restricted an account to particular addresses, that list is stored on the account and checked at sign-in.
- A session identifier held in Redis and a matching cookie in the browser.
Infrastructure and monitoring data
- Heartbeat samples from registered servers: processor, memory, disk, network and process figures, service states, and error counts, along with reboot and alert history.
- Inventories mirrored from connected accounts: AWS resources, costs and security findings, Cloudflare zones, DNS records and analytics, Sentry projects and unresolved issues, Expo builds and store listings, and the worker-client fleet roster.
- Records of actions taken from the console — who deployed, restarted, rebooted, or made a write to AWS, and when.
Content you put into the console
- Projects and their settings, including the ports, paths, repository and site addresses you record against them.
- Tasks, change requests, project notes, to-do items, documents and their attachments, together with the name of the person who wrote or completed each one.
- Credentials you choose to store for a project — database, FTP and SSH sign-ins, deploy keys, and the mailbox sign-in. These are encrypted at rest and are described in “How it is protected” below.
- Where a project connects its mailbox, VergeServer signs in through Microsoft Graph with the permission you grant and reads the mailbox live. Messages are not copied into our database. What we store is the encrypted sign-in token and, in Redis, short-lived encrypted access tokens.
- Where change requests arrive by email, the content of a message that becomes a card — the sender's name and address, the text and any attachments — is stored as that card.
- Mail we send (activation, password reset, alerts, change-request updates, a document you choose to email) is delivered through our email provider, which processes the recipient address and message in order to deliver it.
Tools
- WhatsApp — the recipient's number, the message or media sent, the identifier returned, and the delivery receipts (sent, delivered, read, failed).
- YouTube Download — the requested link and the details of the video, and the produced file until its link expires.
- Voice Calls — the number called, the words spoken, the generated audio, which phone took the call, and the outcome and duration.
- For every tool run: the calling project, the parameters, the time, the result and the caller's IP address. Long values are recorded by length rather than content, and keys and secrets are never written to these records.
Logs and diagnostics
- Server and job logs, which include request paths, timings and error messages.
- Unhandled errors, emailed to the operator's address. Values labelled as passwords, tokens, secrets or keys are redacted before the mail is sent, and repeats are grouped and capped.
- Where the desktop application is used, transcripts of coding sessions are shipped to the operator's own log store.
3. Cookies and local storage
VergeServer sets one cookie: the session that keeps you signed in. There are no advertising, tracking or analytics cookies, and no third-party trackers on any page. The desktop application additionally keeps a per-machine boot cookie, and both it and the console remember small display preferences in the browser's local storage — the terminal text size, a chosen view, a sidebar order, whether sounds are muted. Those never leave the machine.
4. Why we hold it
- To sign you in, keep the session, and enforce roles, scopes and address restrictions.
- To monitor servers, raise and resolve alerts, and show the fleet dashboard and kiosks.
- To carry out the actions you ask for: deployments, restarts, database and file access, messages, calls and downloads.
- To keep an audit trail of changes made through the console.
- To notify people — alert mail, change-request updates, activation and reset mail.
- To keep the service working and secure, to diagnose faults, and to meet legal obligations.
We do not sell personal information, we do not share it for advertising, and we do not use it to train machine-learning models.
5. Who else processes it
VergeServer runs on infrastructure and services provided by others. Each receives only what the relevant feature needs:
| Service | What it handles |
|---|---|
| Amazon Web Services | Hosting, databases and the asset store holding uploaded files, logos, documents and produced files |
| Microsoft (Graph) | Live access to a connected project mailbox, using the permission granted at sign-in |
| Meta (WhatsApp Business Cloud API) | Delivery of messages sent with the WhatsApp API tool, and the receipts returned |
| SendGrid | Delivery of mail we send |
| Cloudflare | DNS and traffic analytics for zones you connect |
| Sentry | Application error tracking for projects you connect |
| Expo / EAS | Mobile build, submission and update records for projects you connect |
| Optional sign-in with a Google account, and push notifications that wake a Voice Calls phone | |
| SomezingAI | Generates the spoken audio for Voice Calls from the text of the message |
| Network proxy provider | Carries YouTube Download traffic |
A linked WhatsApp number in the WhatsApp Messenger tool connects to WhatsApp directly as that number's own session. We may also disclose information where the law requires it, or to establish or defend legal claims.
6. Where it is held
We are based in the United States, and data is held on servers and storage in the cloud regions the operator has configured. The services listed above may process it in the regions where they operate. If you are outside the United States, using VergeServer means your information is transferred to and processed there, where data protection law differs from your own; where information moves between countries it is protected by the safeguards those providers offer under their own terms, including the standard contractual clauses where they apply.
7. How long it is kept
| What | Kept for |
|---|---|
| Detailed server heartbeats | 7 days by default, then folded into one summary row per server per day, which is kept |
| Tool request records | 90 days by default |
| Files produced by a tool | 7 days by default, then the file and its link are removed |
| Voice call audio | Dropped a day after the call finishes; the outcome record remains with the request |
| Alerts, actions and audit records | Kept as the history of the fleet |
| Notes, documents, tasks, change requests and attachments | Until deleted from the console. Deleting a folder deletes everything inside it, including the stored bytes, and there is no recycle bin |
| Accounts | Until an administrator deletes the account |
| Sessions | Until sign-out or expiry |
| Logs and error reports | Rotated on the operator's own retention |
The default periods above are configurable by the operator, and some records are kept longer where we must do so by law.
8. How it is protected
- Every sign-in takes two steps: a password or a social sign-in, then a code from an authenticator app. Authenticator secrets are issued by an administrator; there is no self-enrolment.
- Passwords are stored as bcrypt hashes. API and device tokens are stored only as SHA-256 hashes, so the original cannot be read back from our records.
- Stored project credentials — database, FTP, SSH and mailbox sign-ins — are encrypted at rest. Database passwords never leave the server. An SSH or FTP key is released only to the operator's own desktop application, for a person with write access, and the release is logged.
- SSH and SFTP host keys are pinned, so a changed server key stops the connection rather than being accepted silently.
- Access is limited by role and by per-user scopes for modules, projects, cloud services and documents, and may be limited further to particular sign-in addresses.
- Message content and uploaded files are shown in a sandboxed frame that cannot run scripts, and files are served so that a browser will not execute them.
- Traffic to the console is served over HTTPS.
No system is perfectly secure. If a breach affects personal information, we will act on it and notify those affected where the law requires.
9. Your choices and rights
Depending on where you live, you may have the right to ask for a copy of the personal information we hold about you, to have it corrected or deleted, to object to or restrict how it is used, and to receive it in a portable form. To exercise any of these, write to [email protected]. We may need to confirm who you are before we act, and we will answer within the time the applicable law allows.
If your account was created by an operator, ask that operator first — they control the account, its scopes and the content inside their projects, and we will usually refer your request to them. You may also complain to your local data protection authority.
10. California privacy rights
Verge Inc. is based in California, and California residents have specific rights under the California Consumer Privacy Act as amended (the CCPA/CPRA):
- To know what personal information we have collected about you, the categories of sources, the purposes, and the categories of third parties it was disclosed to — all of which are set out in sections 2 to 6 above.
- To delete personal information we hold about you, and to correct information that is inaccurate.
- To opt out of sale or sharing. We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding twelve months, and we do not knowingly do either for anyone under 16.
- To limit the use of sensitive personal information. The sensitive information we handle — account credentials and the stored credentials for systems you connect — is used only to provide the service and keep it secure, which is a use the CCPA does not require us to limit further.
- Not to be discriminated against for exercising any of these rights. We do not offer financial incentives for personal information.
The categories we collect under the CCPA are identifiers (such as name, email address and IP address), account credentials, internet and device activity from using the console, and professional information (your role and the projects you work on). We keep each category for the periods in section 7. To make a request, write to [email protected]; an authorised agent may act for you with written permission. We will verify the request against the account before acting on it, and we do not charge for it.
11. Children
VergeServer is a tool for operating server infrastructure. It is not directed at children and we do not knowingly create accounts for or collect information from anyone under 16.
12. Automated decisions
We do not make decisions about people by automated means. Alerts raised automatically concern servers and cloud resources, not individuals.
13. Changes to this policy
We may update this policy as the console changes. The date at the top shows when it was last revised, and a significant change will be notified to account holders by email.
14. Contact
Questions about this policy, or about the information we hold: Verge Inc., California, United States — [email protected].