Privacy Policy for MergeDeck
Effective date: September 13, 2026
MergeDeck is developed and operated by Mohammad Asif ("MergeDeck," "we," "us," or "our"). This Privacy Policy explains how information is handled when you use the MergeDeck iOS application.
Summary
MergeDeck is a client for a GitLab server selected by you. We do not operate an application backend that receives your GitLab account information or repository content. Most information used by MergeDeck is stored locally on your device or exchanged directly between the app and your selected GitLab server.
We do not sell your personal information, use it for advertising, or track you across apps or websites.
You may separately choose to send crash reports through Firebase Crashlytics. Crash reporting is optional and disabled unless you opt in.
Information stored on your device
MergeDeck may store the following information locally so the app can provide its features:
- The URL of each GitLab server you add;
- GitLab account metadata, such as your user ID, username, and display name;
- Your GitLab personal access token, stored in the iOS Keychain;
- Cached GitLab content, such as groups, projects, branches, merge requests, user profiles, pipelines, jobs, runners, and related list data;
- App preferences, including the selected account, runner filters, remote-image preference, and crash-reporting preference; and
- Temporarily cached images and other data required to display content.
This locally stored information is not sent to us. It may be included in device backups depending on your device and backup settings, except where iOS excludes particular Keychain items or application data.
Communication with your GitLab server
To provide its core functionality, MergeDeck communicates directly with the GitLab server URL you configure. The app sends your personal access token to that server to authenticate requests and receives the GitLab data you request.
Your GitLab server is operated by GitLab, your employer, your organization, or another third party—not by us. Its handling of your information is governed by its operator's privacy policy and practices. You should only connect MergeDeck to a server you trust and use a token with permissions appropriate for your needs.
Optional remote images
Remote image loading is disabled by default. If you enable it, MergeDeck may request avatars, README images, or other images from GitLab or external servers referenced by GitLab content.
These requests may disclose information normally associated with an internet request, including your IP address, device or network information, the requested image URL, and request time, to the server hosting the image. Because README content can reference arbitrary external hosts, the recipient depends on the content you view.
For some avatars, MergeDeck may contact Gravatar, a service operated by Automattic. The app sends an MD5 hash derived from the relevant email address as part of the Gravatar image URL. Hashing does not make this identifier anonymous. Gravatar also receives ordinary network request information. Gravatar's handling of data is governed by Automattic's privacy policy: https://automattic.com/privacy/.
You can disable remote images at any time in MergeDeck's privacy settings. Initials are displayed as the avatar fallback when remote images are disabled or unavailable.
Optional crash reporting with Firebase Crashlytics
MergeDeck offers optional crash reporting using Firebase Crashlytics, a service provided by Google LLC. Crash reporting is disabled unless you affirmatively opt in. You can withdraw your consent and disable future crash collection at any time in the app's privacy settings.
If you opt in, Firebase Crashlytics may receive diagnostic information such as:
- Crash reports, stack traces, and technical error information;
- An app-installation identifier;
- App version and configuration information;
- Device model, operating-system version, language, and device state;
- The time and circumstances of a crash; and
- Network information, such as an IP address, as part of communicating with Google's services.
We use this information only to understand crashes, diagnose technical problems, and improve MergeDeck's stability. MergeDeck does not integrate Firebase Analytics, and crash-reporting consent does not enable Firebase Analytics, advertising, or cross-app tracking.
Crash reports are processed by Google on our behalf and are subject to Google's applicable privacy and security terms. More information is available at:
- Firebase privacy and security: https://firebase.google.com/support/privacy
- Google Privacy Policy: https://policies.google.com/privacy
Disabling crash reporting stops future Crashlytics collection but does not necessarily delete reports already transmitted. Google retains and deletes Crashlytics data according to its service terms and retention practices.
How we use information
Information handled by MergeDeck is used to:
- Connect to and authenticate with your selected GitLab server;
- Display and manage GitLab content requested by you;
- Remember your accounts and app preferences;
- Cache content locally to improve performance and offline availability;
- Load remote images when you enable that feature; and
- Diagnose crashes and improve app reliability when you opt in to Crashlytics.
Disclosure of information
We do not sell or rent your personal information. Information is disclosed only as needed for the functions described above:
- To the GitLab server you configure;
- To image hosts, including Gravatar where applicable, when remote images are enabled;
- To Google through Firebase Crashlytics when crash reporting is enabled; or
- When required to comply with applicable law or a valid legal process.
Data retention and deletion
Local account information and cached GitLab content remain on your device until you remove the relevant connection, delete the app, or iOS removes the data. When you remove a GitLab connection, MergeDeck attempts to delete its locally stored token, account metadata, preferences, and cached content. Removing a connection from MergeDeck does not delete your GitLab account or revoke the token on the GitLab server; you must revoke it through GitLab if desired.
Downloaded remote images are held in memory during app use. MergeDeck stores these downloaded images to its image cache on disk, which are again deleted when system reports low disk space or when user deletes the app.
Crash reports already sent to Firebase Crashlytics are retained according to Google's Crashlytics retention practices. Because crash reports are generally associated with technical installation identifiers rather than account contact details, we may not be able to identify a particular report as belonging to you.
Data security
MergeDeck uses safeguards appropriate to the information it handles, including storing GitLab tokens in the iOS Keychain and requiring HTTPS for authenticated GitLab connections. No storage or transmission method is completely secure, however, and we cannot guarantee absolute security. The security of your GitLab data also depends on your device, network, selected GitLab server, token permissions, and any external content hosts you access.
Children's privacy
MergeDeck is not directed to children under 13, and we do not knowingly collect personal information from children. If you believe a child has provided information to us through optional crash reporting, contact us using the address below.
Your choices
You can:
- Choose which GitLab servers and accounts to add;
- Remove a GitLab connection and its associated local data;
- Revoke a personal access token through your GitLab server;
- Enable or disable remote image loading; and
- Enable or disable future Firebase Crashlytics reporting.
Depending on where you live, applicable law may provide additional privacy rights. You may contact us with a privacy-related request. Some information is stored only on your device or controlled by your GitLab server, so we may be unable to access or delete it on your behalf.
No affiliation with GitLab
MergeDeck is an independently developed, third-party application. It is not affiliated with, endorsed by, sponsored by, or otherwise associated with GitLab or the operator of any GitLab server you connect to.
The GitLab name, logos, and related trademarks are the property of their respective owners. References to GitLab are used solely to identify the service with which MergeDeck is designed to work. We claim no ownership of any GitLab trademark.
Changes to this policy
We may update this Privacy Policy to reflect changes to MergeDeck or applicable requirements. The updated policy will be posted at the same location with a revised effective date. Material changes will be communicated through the app or another appropriate method where required.
Contact
For questions or requests concerning this Privacy Policy, contact:
Mohammad Asif
Email: asif0456@outlook.com