Merge & Tell
Legal

Privacy Policy

Last updated: October 22, 2026

This Privacy Policy explains how John Farrell (“we”, “us”) collects, uses, and shares information when you use Merge & Tell (the “Service”), a tool that watches your merged GitHub pull requests, drafts social posts from them, and publishes those posts to the accounts you connect.

1. Information we collect

  • Account information. Your email address. You sign in with a one-time link sent to it, or with GitHub or Google, which give us the email address on that account. We do not ask for or store a password for Merge & Tell itself.
  • Connected-platform data. When you connect an external account, we access the data described in Connected platforms below and store an access token so the Service can act on your behalf.
  • Content you create. The pull requests we analyze, the draft posts we generate, your edits and approvals, ICPs, schedules, and related settings.
  • Connection activity. A log of connection events, shown to you in the app’s Activity feed: connect, test, publish, disconnect, and tokens going stale. Secrets are redacted from these records.
  • AI agent access. If you connect an AI agent, the agent’s name, the scopes you approved, and a hash of each token it holds. See AI agents below.
  • Technical data. Standard server and security logs (e.g. IP address, timestamps, error diagnostics) generated when you use the Service.

2. How we use information

  • To provide the Service: analyze your PRs and draft content.
  • To publish posts to the platforms you connect: the posts you approve, and, for any network you set to publish on its own, the posts your routing rules send without a per-post approval. That is off by default, and only someone on your account, or an agent you gave the publish scope, can turn it on.
  • To authenticate you and keep your account secure.
  • To operate, debug, and improve the Service.
  • To communicate with you about your account and support requests.
  • To process payments for paid plans and prevent abuse.

We do not sell your personal information, and we do not use your pull-request content or generated drafts to train our own models.

3. Connected platforms

The Service only works by connecting to other platforms. You choose which to connect, and you can disconnect any of them at any time.

  • GitHub. Through the GitHub App you install, we read your merged pull requests (titles, descriptions, labels and code diffs) to draft content from them. When you ask for a product profile or a .marketing.yml, we also read the repository’s description, README, labels and folder names. If you ask Merge & Tell for media in a pull request comment, we read that comment and reply to it on the pull request.
  • X, Bluesky, Mastodon, LinkedIn, Threads, WordPress & WordPress.com. When you connect an account we store its access token, or the app password or application password you created for us, so we can publish posts and read back their status. Images and videos you attach are fetched from the public link you gave and uploaded to the network at publish time; we do not keep a copy.
  • Discord & Slack. When you connect a channel we store the incoming webhook URL you created, which is itself the credential, and for Slack the channel’s name. We post to that one channel and do not read its messages.
  • Resend & Mailchimp. When you connect a newsletter provider we store the API key you created and your From address. We check that the From domain is verified, read the names of your audiences or segments so you can pick one, and send product-update newsletters through your own account. Your provider does the sending and handles unsubscribes. To keep your subscriber list in step with your provider, we read some of your contacts. From a Mailchimp audience you pick, we copy each subscribed member’s email address and first name into your subscriber list, and record the addresses Mailchimp lists as unsubscribed or cleaned so they are never added again. From Resend, we read which contacts have unsubscribed and record those addresses, and before adding an address we check whether Resend already has it. We also store the addresses you import by CSV, through the API or through an AI agent, with the consent note you give for them. We add those addresses only to lists in your own Resend or Mailchimp account, never one that has unsubscribed, and pass on the unsubscribes you record with us. Merge & Tell never emails your subscribers itself.

4. AI agents

You can let an AI agent, such as Claude Code, Codex, Cursor or Claude on claude.ai, work on your account through our MCP server at merge.tel/mcp. You sign in and approve that access in your browser. The agent gets only the scopes you approved: read (see your account), configure (change settings, write drafts, start connections) and publish (queue posts, and turn on publishing without approval).

  • We store the agent’s name and the addresses it asked to be sent back to. For each access you approve we store which account and user it belongs to, its scopes and when it expires, and a hash of each token the agent holds, never the token itself.
  • An access token lasts one hour. A refresh token lasts 30 days and is replaced each time it is used, so an agent stays connected while it is in use and loses access after 30 days idle. A personal token you create yourself lasts until you revoke it.
  • Your Account page lists every connected agent and personal token, and revokes any of them. Changes an agent makes show in your Activity feed.
  • No tool accepts a password, token, webhook URL or card number. Those go into Merge & Tell’s own forms or the network’s own pages.
  • What a tool returns, such as your settings, drafts and pull-request text, goes to the agent and to the AI provider behind it. That provider handles it under its own terms and privacy policy, not ours.

5. Service providers (subprocessors)

We share data with a small set of vendors who process it on our behalf to run the Service. Each is bound to use it only for that purpose.

  • Anthropic: AI drafting. Pull-request titles, descriptions and diffs are sent to Anthropic’s Claude API to draft the marketing copy. When a post carries an image and nobody wrote alt text for it, the image’s public link is sent too, so Claude can describe it (you can turn this off in Schedule settings). When you ask for it, we also send text you point us at: a product website, writing samples for a voice, or a thread you are replying to. Anthropic processes this as our subprocessor.
  • Supabase: Database, authentication & secret storage. Hosts the application database, handles sign-in, and stores your connection tokens encrypted in Supabase Vault.
  • Netlify: Application hosting. Serves the application and runs its server-side functions.
  • Postmark: Email delivery. Sends the email the Service sends you: sign-in links, the daily digest and account notices. It receives your email address and the message.
  • Google Analytics: Website analytics. Measures visits to the public pages of merge.tel, not the signed-in app. It sets cookies and receives your IP address, browser details and the pages you visit.
  • Stripe: Payments. Processes subscription payments for paid plans. Card details go to Stripe directly; we never see or store them.

We update this list when our providers change. Material changes are reflected in the “last updated” date above.

6. How we store and protect your data

Connection tokens are stored encrypted in a dedicated secrets vault and are only ever used server-side. They are never exposed to your browser, the Activity feed, or any URL. We restrict access to production data and rely on our hosting and database providers’ security controls. No system is perfectly secure, but we treat credential handling as the most sensitive part of the Service.

7. Data retention

We keep your information for as long as your account is active. When you disconnect a platform, its stored token is deleted. When you delete your account, we delete or de-identify your personal data within a reasonable period, except where we must retain it to comply with legal obligations, resolve disputes, or enforce our agreements.

An agent token is deleted once it expires, and a revoked one 30 days after it was revoked.

Separately, when a sign-in link is requested we record the email address and the requesting IP address so we can rate-limit sign-in requests and stop the Service being used to send unwanted mail. We use these records for one hour and routinely delete them once they are older than 24 hours, whether or not an account is ever created.

8. Your rights and choices

You can access and update much of your information directly in the app, disconnect any connected platform, and request deletion of your account. Depending on where you live, you may also have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any of these, email john@merge.tel. We will respond within the time required by applicable law.

9. Children

The Service is not directed to anyone under 16, and we do not knowingly collect personal information from children.

10. International transfers

Our providers may process and store data in countries other than yours, including the United States. Where required, we rely on appropriate safeguards for such transfers.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “last updated” date and, for material changes, take reasonable steps to notify you.

12. Contact

John Farrell is the controller of your personal data. For any privacy question or request, contact john@merge.tel.