Atelier
    Forge legal documentation

    Forge / Legal

    Privacy Policy for Forge

    Effective date: July 17, 2026

    Overview

    Forge is an Android application that connects directly to development machines you own. This privacy policy explains what data Forge stores locally, what leaves your device, and how it is protected.

    Forge has no Forge cloud account, no developer-operated backend, and no centralized data collection. The application is designed to operate as a direct client between your device and services you explicitly configure.

    Information We Collect

    Connection and Workspace Data

    • SSH connection profiles: display name, hostname or IP address, port, username, and workspace paths
    • Trusted SSH host-key fingerprints and algorithms (SHA-256)
    • Workspace metadata and UI preferences

    Credentials

    • SSH passwords, private keys, and passphrases
    • AI provider API keys (for cloud providers only)
    • These are stored using Android Keystore-backed encryption via Expo SecureStore

    Assistant History

    • Bounded and redacted assistant messages
    • Completed command and tool results
    • This data is encrypted with AES-256-GCM before storage in AsyncStorage

    File Transfer Metadata

    • Transient references to files you explicitly select for upload or download during active operations

    Information We Do NOT Collect

    Forge does not collect, transmit, or store:

    • Advertising identifiers
    • Location data
    • Contacts
    • Broad storage or media library contents
    • Screen recordings or screenshots
    • Crash reports or analytics events
    • Usage telemetry
    • Any data for advertising purposes

    Local Data Storage

    SecureStore (Android Keystore-backed)

    Credentials are stored with WHEN_UNLOCKED_THIS_DEVICE_ONLY accessibility, meaning they are:

    • Encrypted using Android Keystore
    • Available only while the device is unlocked
    • Not included in Android backups
    • Tied to the specific device

    AsyncStorage (Sandboxed)

    Non-secret metadata is stored in the application sandbox:

    • Connection profiles (without credentials)
    • UI preferences
    • Provider configuration (base URLs, model names)
    • Encrypted assistant history

    Assistant History Encryption

    Assistant messages and results are:

    • Bounded to prevent unbounded growth
    • Redacted to remove common secret patterns
    • Encrypted with AES-256-GCM before reaching AsyncStorage
    • Stored with the encryption key held separately in SecureStore
    • Excluded from backup

    Remote Connections

    All remote connections are initiated only at your explicit direction:

    SSH/SFTP/Terminal

    • Credentials and operations go directly to the SSH server you configured
    • Protected by SSH encryption in transit
    • Host-key verification uses trust-on-first-use with SHA-256 fingerprints
    • Changed host keys block future connections

    File Transfers

    • Uploads: Files you explicitly select go directly to your SSH server via SFTP
    • Downloads: Files are written only to locations you explicitly select via the Android system document picker
    • Forge does not retain copies of transferred files
    • Binary transfers are capped at 5 MiB per file

    AI Providers

    Cloud AI Providers

    When you configure a cloud AI provider (OpenAI, Anthropic, OpenRouter, or compatible endpoints):

    • Your API key is stored in SecureStore, scoped to the specific provider and origin
    • API keys are never sent to a different provider or origin than the one they were saved for
    • The following data is sent to your configured provider:
      • Your prompts and messages
      • Explicitly attached source code or file contents
      • Selected diffs or excerpts
      • Tool results from read-only operations
      • System prompt instructing the model about Forge's capabilities and safety rules
    • All cloud provider communication uses HTTPS
    • API keys are transmitted only in Authorization headers or provider-specific authentication headers
    • Provider responses are bounded and validated before use

    Local AI (Ollama)

    When you configure a local Ollama endpoint:

    • No API key is stored or sent
    • The same assistant context as cloud providers is sent to your local endpoint
    • Local Ollama traffic uses HTTP and is not encrypted
    • You must enable this explicitly with allowInsecureLocalHttp
    • Use only on trusted private networks or with a VPN

    AI Data Controls

    • You control which provider receives your data
    • You can change or remove providers at any time
    • Assistant history can be cleared
    • Source attachments are not persisted to history
    • Credentials are never included in AI requests

    Files and Documents

    Forge respects your file privacy:

    • Files are accessed only through the Android system document picker
    • Forge requests no broad storage or media library permissions
    • Selected files are held in transient memory only during the active operation
    • Forge does not add selected files to assistant history
    • Forge does not persist document URIs or retain copies after transfer completion
    • Android or the document provider may retain system-level grants until you revoke them

    Photos

    Forge does not access photos, media, or files unless you explicitly select them through the Android system document picker for a specific upload operation. The app does not request media library permissions.

    SSH Credentials

    SSH credentials receive the highest level of protection:

    • Stored in Expo SecureStore with Android Keystore backing
    • Marked as WHEN_UNLOCKED_THIS_DEVICE_ONLY
    • Never written to AsyncStorage or included in assistant history
    • Never transmitted except to the SSH server during authentication
    • Scoped to specific connection profiles
    • Deleted when you remove a connection profile

    Encryption

    At Rest

    • Credentials: Android Keystore-backed SecureStore
    • Assistant history: AES-256-GCM encrypted in AsyncStorage
    • Encryption keys: Stored separately in SecureStore

    In Transit

    • SSH/SFTP/Terminal: SSH protocol encryption
    • Cloud AI providers: HTTPS/TLS
    • Local Ollama: HTTP (unencrypted, user-explicitly opted-in)

    Backup Protection

    • Android application backup is disabled
    • SecureStore values are excluded from backup
    • Encrypted assistant history cannot be decrypted from backup due to separate key storage

    Security

    Forge implements defense-in-depth security:

    • Host-key verification with trust-on-first-use
    • Changed host keys block connections
    • Command approval workflows for AI-suggested actions
    • Patch validation with base-content checks
    • Secret redaction in AI context construction
    • No debug-mode fallbacks in production
    • Native Android module for SSH operations

    However, Forge is not:

    • A shell sandbox
    • A secret manager
    • A guarantee that approved commands are safe
    • A substitute for server-side security controls

    Users remain responsible for commands approved against their machines.

    Third-Party Services

    Forge connects only to services you explicitly configure:

    Required for Operation

    • Your SSH server(s)
    • Your AI provider(s) (if configured)
    • Your local Ollama instance (if configured)

    Not Connected

    • No Forge-operated servers
    • No analytics services
    • No crash reporting services
    • No advertising networks
    • No CDN for application logic

    Dependencies

    The application includes open-source libraries. See Open Source Licenses for details.

    Children's Privacy

    Forge is a professional developer tool and is not directed to children. The application does not knowingly collect information from children under 13.

    International Transfers

    Your data remains on your device unless you explicitly send it to a configured service. When you connect to remote servers or AI providers, your data is subject to the privacy practices of those services, which may be located in other countries.

    Data Retention

    Local Data

    • Connection profiles and credentials: retained until you delete them
    • Assistant history: retained until you clear it or uninstall the app
    • You can clear assistant history at any time from Settings

    Remote Data

    • Data sent to your SSH server is subject to your server's retention policies
    • Data sent to AI providers is subject to their retention policies
    • Deleting local Forge data does not delete data already sent to remote services

    Uninstall

    Uninstalling Forge removes all local application data. This does not affect data stored on your SSH servers or AI providers.

    User Controls

    You have full control over your data:

    • Add/remove connections: Manage SSH profiles in Settings
    • Clear credentials: Remove individual connections or all saved credentials
    • Clear assistant history: Remove all AI conversation history
    • Change AI providers: Configure different providers or remove AI configuration
    • Disable local Ollama: Toggle the allowInsecureLocalHttp setting
    • Android app data: Use Android Settings to clear all app data or uninstall
    • Document permissions: Revoke Android document provider access in system settings

    Contact Information

    For questions about this privacy policy or Forge's data practices:

    A privacy contact with monitoring capability must be established before public distribution.

    Policy Updates

    Material changes to Forge's data handling, privacy practices, or connected services will result in an updated privacy policy. Changes will be reflected in:

    • The privacy policy document
    • The application version
    • Play Store listing updates

    Users will be notified of material changes through the Play Store update process.

    Note: This privacy policy describes Forge's intended behavior based on the current implementation. Final compliance should be verified against the signed production artifact and Google Play's current Data safety requirements.