Effective 30 September 2026
By default, MergeTap runs entirely on your device and talks directly to Azure DevOps and Microsoft Entra, or to GitHub, using credentials you supply. We collect no analytics.
There is one optional feature that changes this. If you switch on "Also notify when the app is closed" for an account, MergeTap's notification server stores that account's credential, encrypted, and checks Azure DevOps for you every 15 minutes. For a GitHub account it checks GitHub the same way. It then sends your notifications through Google's Firebase Cloud Messaging, so the titles of pull requests and the names of projects pass through Google to reach your phone. This is off until you turn it on, it applies only to the account you turn it on for, and turning it off asks the server to delete what it holds. If the server cannot confirm the deletion, the app tells you.
If you never switch it on, nothing you do with your pull requests, builds or deployments is transmitted to the provider of this application, and the app never asks your phone for a push token.
Two further exceptions: buying a subscription, handled by Apple or Google and by RevenueCat, who tell us whether a subscription is active — never who you are or what you reviewed — and a crash report, sent only if the app crashes, to a self-hosted error-tracking instance the provider of this application runs themselves.
Responsible for data processing within the meaning of Article 4 (7) GDPR is Nicolas Mehlei, whose full details are in the imprint.
Unless you switch on server notifications for an account, the application performs no processing on our systems, and our responsibility is limited to the application as supplied to you. For an account you have registered, we also process what is described under "Notifications when the app is closed" below. Your use of Azure DevOps is governed separately by Microsoft, and your use of GitHub by GitHub, Inc.; each acts as controller for the data held in your organization or repositories.
The following is written to storage on your device and nowhere else:
Requests go to Microsoft- and GitHub-operated endpoints authenticated with your own credentials, to RevenueCat if you buy a subscription, to our own self-hosted crash-reporting instance if the app crashes, and to MergeTap's notification server only for an account you have registered for server notifications:
This section applies only to an account for which you have switched on "Also notify when the app is closed" in that account's settings, after confirming a message that describes it. For any other account, none of it happens.
What the app sends to MergeTap's notification server when you switch it on, and keeps up to date while it is on:
If the app crashes or hits an unhandled error, a report is sent to Bugsink, a crash-reporting instance the provider of this application runs and controls themselves — it is not a third-party service, and no data from it is shared with anyone else. The app uses the Sentry SDK to send these reports, configured to point at Bugsink rather than at Sentry's own service.
A crash report includes the error message, the code location it occurred at, the app version, and basic device/OS information needed to diagnose it. Personal access tokens, Microsoft Entra tokens and GitHub tokens are stripped before the report leaves your device.
Nothing is sent unless the app actually crashes or hits an unhandled error — there is no routine or background reporting.
Payment is taken by Apple's App Store or Google Play, never by this application. We never see or handle your card details.
Purchases are managed through RevenueCat, a subscription service that validates the store's receipt and tells the app whether a subscription is active.
Stated explicitly, because these are the things users most often have to assume about an application:
Processing on your device serves solely to provide the functions you have asked for, and rests on Article 6 (1) (b) GDPR — performance of a contract and steps taken at your request.
Storing credentials in the operating system's secure store is technically necessary to provide the service and is likewise covered by Article 6 (1) (b) GDPR.
Server notifications rest on your explicit consent under Article 6 (1) (a) GDPR, given when you switch the feature on and confirm the message shown. You can withdraw it at any time by switching the feature off; withdrawal does not affect anything done before.
Processing a subscription — validating a store receipt and keeping track of whether it is active — is performance of the contract you enter when you buy it, also Article 6 (1) (b) GDPR.
Data stored by the application remains on your device until you remove it. Removing an account deletes its stored credentials. Uninstalling the application removes everything the application has stored on the device.
For an account registered for server notifications, MergeTap's server also holds that registration until you switch the feature off or remove the account in the app, both of which ask the server to delete it. If the server cannot be reached at that moment the app tells you, and the server copy remains until the request succeeds. Uninstalling the app does not by itself delete the server copy; switch the feature off first. To have it removed in any other case, use the contact address in the imprint.
If you have never switched server notifications on, we hold nothing about you, and there is nothing for us to retain or delete on your behalf.
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing (Art. 21).
Unless you have switched on server notifications, the provider of this application holds no data about you, and these rights are exercised directly against the operator of the Azure DevOps organization you connect to, and against Microsoft. For data held by MergeTap's notification server, and for any request concerning the application itself, use the contact address in the imprint.
You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in the member state of your residence, place of work, or the place of the alleged infringement.
Notifications — used to alert you about pull requests and approvals awaiting you: generated on your device, or, for an account you registered for server notifications, delivered through Google's Firebase Cloud Messaging. Declining this permission leaves every other function intact.
Network access — required to reach Azure DevOps.
Azure DevOps Services and Microsoft Entra ID are operated by Microsoft. Your use of them is subject to Microsoft's own terms and privacy statement, available at https://privacy.microsoft.com/privacystatement.
Google's Firebase Cloud Messaging carries notifications for accounts registered for server notifications. It is operated by Google under Google's own terms and privacy policy. MergeTap's notification server is hosted on Microsoft Azure.
Depending on your organization's configuration, Microsoft may process data outside the European Union. That processing is outside our control and is governed by Microsoft's agreements with your organization.
This notice was last updated on 30 September 2026. Where the application changes what it stores or whom it contacts, this notice is updated in the same change.