Privacy Policy
Vercelly is an independent iPhone client for Vercel, made by Perttu Lähteenlahti. It has no accounts of its own, no ads and no analytics or tracking SDKs. The one diagnostic tool it uses is crash reporting, described below. This page lists everything the app stores and who it talks to.
Your Vercel access token
You sign in by installing the Vercelly integration on your Vercel team, or with an access token you create yourself. Either way the resulting token is stored in the iOS Keychain on your device and sent to Vercel's API (api.vercel.com). Home Screen widgets read it from a shared container on the same device so they can call Vercel's API themselves.
It also goes to Vercelly's own service, described under Deploy notifications. Every request the app or a widget makes to that service carries the token, which the service passes to Vercel to find out who you are, and to create or delete the webhooks that notifications come through. That includes requests you might not think of as notifications, like sending feedback or a widget registering itself. If you sign in through the Vercel integration, the service also exchanges the sign-in code for you, so the new token passes through it once on the way to the app. The same happens if you sign in with an access token and install the integration to turn on notifications for a team, except that the app then throws the new token away and keeps using yours.
The service holds the token only while it handles that one request. It never saves it.
Vercel doesn't share Web Analytics with integrations, so if you signed in with the integration you can add a separate access token just for analytics. That token is stored the same way, is shared with the Analytics widget on your device, and is sent only to Vercel. It never goes to Vercelly's service.
Your Vercel data
Projects, deployments, build logs, domains, environment variables and analytics are fetched directly from Vercel and cached on your device so the app opens quickly. They are not sent anywhere else, apart from the few details the sections below name. Removing an account in the app deletes its token and cached data, and tells the service to stop sending that account's notifications to your phone.
Site icons
To show a favicon next to each project, the app requests it from Google's favicon service (www.google.com/s2/favicons) and then from the site itself. These requests include the domain name of the site, not your token.
Deploy notifications
If you turn on notifications, the app registers your device's push token with Vercelly's notification service, which runs on Cloudflare Workers. It stores your Vercel user ID, your device push token, which teams and projects you watch (their IDs and names) and which events you want to hear about, so it can send notifications through Apple Push Notification service. It also stores the ID and signing secret of the webhook it creates on each team you watch, so it can tell that an event really came from Vercel.
When a deployment changes, Vercel sends the service the project, the branch and the commit message. The service uses them to write the notification and doesn't keep them, but the text of the notification does pass through Apple.
The service also keeps short-lived markers, gone within a day, so it doesn't send the same notification twice.
Ask me and I'll delete everything the service holds about you, including the items below.
Live Activities
If you're on Pro and Live Activities are on, the app gives the service the tokens Apple issues for them: one for your device, which lets the service start an activity when a build begins, and one for each activity while it runs, which lets it show the result. The first stays until you turn Live Activities off, lose Pro, switch accounts in the app or sign out. The second is deleted when the build ends, or after three hours at the latest. The app also sends your project's usual build time, in seconds, so the countdown is about right. That number is stored against the project ID and expires after 30 days.
Widgets
If you have a Vercelly widget on your Home Screen on iOS 26 or later, the service stores the push token WidgetKit gives that widget, so a deployment can refresh it straight away. Those pushes carry no data and don't depend on notification permission. The token is removed when you remove your last widget or sign out.
Weekly overview
On the free plan, the service keeps a running count for the weekly overview: how many deploys finished, how many failed, and the IDs of the projects involved. Nothing else about them. Each week's counts are deleted automatically after 15 days. Turn off Weekly overview in Settings and the counting and the notification both stop.
Feedback
If you send feedback from the app, the service stores your message, your Vercel user ID, the app version and build, and your platform, then forwards them to my inbox through Resend so I can read them. The reply-to email is optional. It starts filled in from your Vercel account, and you can change or clear it before sending. I only receive what you leave in the field, and I use it to reply to you. I keep feedback so I can act on it. Ask me and I'll delete it.
Purchases
Vercelly Pro is sold through the App Store and managed with RevenueCat. RevenueCat receives your Vercel user ID (so Pro follows you across devices) and your App Store purchase receipts to decide whether Pro is active. The notification service asks RevenueCat the same question, to decide what to send you, and keeps the answer for up to 30 days. See RevenueCat's privacy policy. Payment details are handled by Apple and never reach the app.
Crash reports
When the app crashes or hits an error, it sends a report to Sentry so I can fix it. A report holds the stack trace and error message, the app version, your device model and iOS version, the screens and requests leading up to it (including the addresses of Vercel requests, which name team and project IDs), and a random ID for this install. Sentry also receives how long a sample of screens took to load. Your Vercel account, name and email are not attached. Access tokens, Authorization headers and token-like URL parameters are scrubbed in the app before a report is sent.
TestFlight
If you use the beta, Apple shares crash reports, feedback you choose to send and basic device information with the developer through TestFlight, under Apple's privacy policy.
The website
vercelly.com is hosted on Netlify. Visits are counted with Umami, which I host myself at stats.perttu.dev. If you leave your email to hear about the App Store release, it is stored by Netlify Forms and used to send that one message, then deleted.
Contact
Questions or deletion requests: perttu@lahteenlahti.com.