Forge privacy policy
Effective October 10, 2026
Forge is a macOS app for writing and editing files: Markdown, code, spreadsheets and more. This policy describes what it processes, what can leave your Mac, and what we — Honestly, the developer — collect. The short version: Forge works on files on your Mac, talks to the internet only where you have set it up to, and we collect nothing.
What Forge processes
- The files and folders you open. Markdown, text and code, CSV, JSON, Word, PowerPoint, Keynote, PDF and images. Forge reads and writes them where they are; it never copies them anywhere else.
- Folders you grant access to. Forge runs in the macOS sandbox and can only reach what you open. When a document needs the folder around it — to show its images or follow a link — Forge asks once and remembers the permission as a sandbox bookmark on your Mac.
- Settings, recent files and favorite folders, kept in the app's own storage on your Mac.
- Text in images, when you open one: macOS recognizes it on your Mac so you can select and copy it. Nothing is sent anywhere.
What leaves your Mac
Nothing, unless you set up one of the following. Each is under your control and off by default:
- GitHub. If you sign in with GitHub, Forge uses GitHub's device sign-in and asks for access to your repositories, so it can clone, commit, push and pull them. Your access token is stored in your macOS Keychain and sent only to GitHub. Forge looks up your GitHub name once, to sign your commits. While a repository is open, Forge may check GitHub for new commits in the background (you can turn this off in Settings); it only uploads when you commit and sync. Traffic goes directly from your Mac to GitHub, under GitHub's terms.
- iCloud Drive. Forge can keep documents in a Forge folder in iCloud Drive, which Apple syncs under your Apple Account and Apple's privacy policy.
- Your own storage bucket. If you add an S3-compatible bucket, images you add to a document with remote storage turned on are uploaded to it using the credentials you entered. Those credentials are stored in your macOS Keychain. Traffic goes directly from your Mac to the provider you chose.
- Images and pages a document links to. A document that shows an image from the web fetches it from that address, like a browser would, including when exporting or printing. That site sees the same basic information as for any browser request, such as your IP address; Forge doesn't send document contents with it.
Honestly operates no server and never sees your files, your tokens, your credentials or any of this traffic.
What we collect
Nothing. Forge has no Forge account, no analytics, no crash-reporting SDK and no advertising. The app does not contact Honestly. If you choose to share crash reports with app developers in macOS settings, Apple may pass anonymized crash logs to us under Apple's terms.
Your control
- Sign out of GitHub in Settings ▸ Favorites; this removes the token from your Keychain. You can also revoke Forge's access at any time on GitHub, under Settings ▸ Applications.
- Removing a bucket stops all uploads to it; its credentials can be removed from the Keychain at the same time.
- Turn off background fetching in Settings. Folder permissions are sandbox bookmarks you can clear by removing the app's container.
Children
Forge is not directed at children and collects no personal information from anyone.
Changes
If this policy changes, the new version is published at this address with a new effective date.