Privacy
What Mergepond and mergepond.dev collect, why, and who else handles it. Last updated 8 November 2026.
The short version
- Mergepond never uploads your repositories. Your code stays on your Mac and on the machines you SSH into.
- The app sends usage stats only if you turn them on, and never includes repo names, file paths, branch names, remotes or code.
- The website uses no cookies to track you.
- Payments are handled by Stripe. We never see your card number.
- We don’t sell your information or use it for advertising.
Who we are
Mergepond is made by Webb Ventures PTY LTD (ABN 69 659 494 014), Australia, and Webb Ventures US LLC, United States. If you buy Pro, the company named on your receipt is responsible for your purchase information.
The Mergepond app
Mergepond works on repositories on your Mac and, with Pro, on machines you reach over SSH. It runs Git there for you. Your files, history and credentials are never sent to us.
The app contacts our servers at api.mergepond.dev only to:
- Check for updates, by downloading a small file that names the newest version.
- Activate and check a Pro licence. This sends the licence key, an identifier for your Mac (a one-way hash of its hardware ID, so the ID itself never leaves your Mac), your Mac’s name as shown in Sharing settings, and the app’s version. This is how you can see and remove your Macs in your account.
- Send usage stats, only if you turn them on in Settings. These are events such as “app launched” with the colour scheme and whether you have Pro. You can turn them off at any time.
When you open a repo on another machine, Mergepond copies a small helper, pond-agent, to that machine over your own SSH connection. It runs as your SSH user, opens no ports and talks only to the app.
The website
- We count page views and clicks with PostHog, through our own server. It keeps nothing in cookies or local storage, so a visit can’t be followed from one day to the next.
- Cloudflare Turnstile checks that forms are sent by a person. Cloudflare also tells us your country, which decides which company sells to you.
- If you sign in to your account, we keep your email address and a session cookie that keeps you signed in. Sign-in links are sent by email and expire after one use.
- If you joined the waitlist before launch, we kept your email address to tell you when Mergepond launched. Ask us and we’ll delete it.
When you buy Pro
Stripe takes your payment and works out any tax. We receive your email address, your country, what you paid, and Stripe’s references for the payment. We use them to send your licence key, show your purchases in your account, handle refunds, and keep the records tax law requires.
Who else handles your information
- Cloudflare: hosting, our database, bot checks and downloads.
- Stripe: payments and tax.
- Resend: sending email, such as licence keys and sign-in links.
- PostHog: usage stats, stored in the United States.
These services may store information outside your country, including in the United States. Each is bound to use it only to provide its service to us.
How long we keep it
Licence and purchase records are kept for as long as your licence exists and then as long as tax and accounting law requires. Sign-in links and expired sessions are deleted. Usage stats are kept for up to two years.
Your choices
You can ask for a copy of the information we hold about you, ask us to correct it, or ask us to delete it, except records we must keep by law. Email us and we’ll reply within 30 days. If you’re not happy with how we handle a request, you can complain to the privacy regulator where you live; in Australia that’s the Office of the Australian Information Commissioner.