Privacy Policy
Last updated: November 2, 2026
This policy explains how Tailcall, Inc., a Delaware corporation ("ForgeCode", "we") collects, uses and shares information when you use forgecode.dev, the ForgeCode console, cloud machines ("factories"), the forge agent software, automations and the ForgeCode LLM gateway (the "Service").
1. Information we collect
Account information. Your email address, name and, if you sign in with Google or GitHub, the identifier from that provider. We store account and sign-in records (including session and sign-in events) in our identity service.
Your content. Code, files, repositories you clone, prompts, conversations and outputs you create in the Service. This lives mainly on your cloud machine's disk. If you turn on conversation sync or semantic code search, conversations or code chunks and their embeddings are also stored on our servers.
Credentials you give us. Model-provider API keys you bring ("bring your own key") are stored encrypted on the machine where the forge agent runs. Secrets you save in the console are stored in Google Cloud Secret Manager.
Billing information. Subscription status, prepaid credit balance and transactions. Card details are collected and stored by Stripe, not by us.
Usage and device data. Usage records for the LLM gateway (model, tokens, cost), service logs (IP address, request metadata), and product analytics: Google Analytics on forgecode.dev and in the web console, Apollo.io website visitor tracking on forgecode.dev (which may identify the company a visit comes from), and PostHog telemetry from the forge agent. Agent telemetry may include conversation text with credentials removed; you can limit it to metadata only, or turn conversation telemetry off, in the settings of the agent's telemetry extension.
Communications. Messages you send to [email protected].
2. How we use information
To provide, operate and secure the Service; to authenticate you; to run your agents and route your requests to the AI model providers you choose; to bill you; to provide support; to understand and improve the Service; to prevent abuse; and to meet legal obligations. We do not sell personal information, and we do not use your content to train AI models.
3. How we share information
We share information only with service providers that help us run the Service, under contracts that limit their use of it:
- Hosting and infrastructure: Google Cloud (United States, us-central1), GitHub (console hosting, source code), Cloudflare (DNS, networking).
- AI model providers you use: for example Anthropic, OpenAI, Google (Vertex AI / Gemini) and DeepSeek receive the prompts and context needed to answer each request.
- Feature providers: Voyage AI (code embeddings for semantic search), Exa (web search tool), ngrok (device relay), Slack and GitHub (only if you connect them).
- Analytics: PostHog, Google Analytics and Apollo.io.
- Payments: Stripe.
- Legal reasons: when required by law, or to protect the rights and safety of ForgeCode, our users or others; and to a successor in a merger or acquisition.
4. Security
We protect information with encryption in transit and at rest, per-user isolation of cloud machines, least-privilege access for our staff with multi-factor authentication, logging and monitoring, and regular vulnerability scanning. More detail: https://trust.forgecode.dev.
5. Retention and deletion
- We keep information while your account is active and as needed to provide the Service.
- Deleting a cloud machine deletes its disk and everything on it.
- To delete your account and associated data, email [email protected] from your account's email address. We confirm your identity and complete deletion within 30 days. Database backups expire within 35 days. We keep billing records as long as the law requires.
6. Your rights
Depending on where you live (for example under the GDPR in the EEA and UK, or the CCPA in California), you may have the right to access, correct, delete or export your personal information, and to object to or restrict some processing. Email [email protected] to make a request. We will not discriminate against you for exercising these rights. You may also complain to your local data protection authority.
7. International transfers
We process information in the United States and in other countries where our service providers operate. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses.
8. Children
The Service is not directed to children under 16, and we do not knowingly collect their personal information.
9. Changes
We will post changes here and update the date above. If a change is material, we will notify you before it takes effect.