Privacy Policy

Last updated: October 11, 2026

This Privacy Policy explains what personal data Deluge Forge processes, why, where it goes and what you can do about it. It covers the Deluge Forge editor extension (for VS Code and compatible editors), the Deluge Forge browser extension, the native messaging host and MCP server they install on your computer, and the website and licence service at forge.inventora.digital (together, "Deluge Forge"). The use of the software itself is governed by the End User License Agreement shipped with it and by our Terms of Use.

The controller of your personal data is Inventora Digital ("we", "us"). Contact for any privacy matter, including the rights listed in section 8: forge-support@inventora.digital.

1. Data that stays on your computer

The browser extension captures your Zoho session so the editor extension and the MCP server can act in Zoho as you. It runs on Zoho pages only (zoho.com, zoho.eu, zoho.in, zoho.com.au, zoho.jp, zoho.ca, zoho.com.cn and zohocloud.ca), including private windows if you allow the extension there, and processes:

• Zoho cookies: all cookies the browser holds for the Zoho site you are signed into, read with the browser's cookie API, together with the CSRF token among them. These are what lets requests reach Zoho as you.
• Organization identifiers: your Zoho organization id and name, read from the page address, from the configuration text embedded in Zoho's own pages, and from Zoho's API (crm.zoho.*/crm/v2/org and books.zoho.*/api/v3/organizations) using your own session.
• Tab information: which open tabs are Zoho pages, their addresses and, when you start a timer, the title and address of the active tab.

The extension does this when a Zoho tab loads or becomes active, when you open its popup or pair it, and once a minute in the background while Zoho tabs are open, so a session that Zoho renewed reaches the editor. It does not read what you type, the content of your records, or your Deluge scripts in the browser.

The captured session goes only to the native messaging host on the same computer, through the browser's Native Messaging channel, which is a local pipe and not the network. The host stores it in ~/.deluge-forge/sessions.enc, encrypted with AES-256-GCM under a key derived from your pairing code. Also on your computer, and never sent to us:

• the pairing code (in the editor's secret storage, in a file readable only by your user, and in the browser extension's local storage);
• time entries you record with the timer (encrypted), a local log of the native host that holds organization ids, domains and cookie names but not cookie values, and your editor workspace: the Deluge functions you pull, connections and variables.

The editor extension and the MCP server send your Zoho code and data only to Zoho, using your session. If you connect the MCP server to an AI assistant, the functions, logs and results you ask that assistant to read are passed to it by your own client. That assistant and its provider are chosen and contracted by you; we do not receive that data.

2. Data our servers receive

• Account: when you sign in with Google, we receive and keep your Google account id, your email address and whether Google verified it. We do not receive your Google password.
• Licence and device: a random device id generated on your computer, a device label such as "Visual Studio Code on darwin", the times your device last checked in, the editor extension version, your trial dates and plan, and the history of moves of your licence between devices. A sign-in credential is stored only as a one-way hash.
• Emails we send: when your licence moves to another device we email you about it; the address and message are kept with the request.
• Feedback and support: when you send feedback from the editor we store the type, subject and message you wrote, your account id and email, and, if you leave "Include diagnostics" on, the extension version, editor name, editor version and operating system, which are shown to you before you send. Feedback never includes your code, workspace names, organization ids or file paths.
• Technical logs: our hosting provider records technical request logs (such as IP address, time and the address requested) to operate and secure the service.

3. The website

• The landing page loads fonts from Google Fonts, which receives your IP address and browser details when the page loads.
• The early access form on the landing page is provided by Tally (tally.so). What you type there is processed by Tally and shared with us.
• The sign-in page (/device) loads Google's sign-in.

We do not use advertising or analytics cookies on the website.

4. Why we use it and on what legal basis

• To provide the product you asked for: sign-in, trials and licences, one device per licence, update requirements, and answers to your support requests (performance of a contract, LGPD art. 7, V).
• To keep the service secure and prevent abuse, such as limiting licence moves between devices and notifying you of them (legitimate interest, LGPD art. 7, IX).
• To answer early access requests made through the website form (consent, LGPD art. 7, I, which you can withdraw at any time).
• To comply with legal obligations (LGPD art. 7, II).

We do not use your data for advertising, profiling, credit decisions, or to train AI models, and we do not sell, rent or trade it.

5. Who processes it for us

• Google LLC (Google Cloud): hosting of the website and licence service, authentication, database and email delivery infrastructure, and Google sign-in.
• Tally: the early access form.
• Google Fonts: web fonts on the landing page.

Zoho is not our processor: the browser and editor extensions talk to Zoho on your behalf, under your own agreement with Zoho.

6. International transfer

Our providers may store and process data outside Brazil, including in the United States. These transfers rely on the safeguards the providers offer under their standard data processing terms, as allowed by LGPD art. 33.

7. How long we keep it

• Account, licence and device records: while your account exists, and deleted when you ask us to delete it.
• Feedback messages: for as long as needed to handle them and to keep a history of the product's issues, and deleted with your account on request.
• Data on your computer: until you remove it. Uninstalling the extensions and deleting the ~/.deluge-forge folder removes it; the browser extension's storage goes when you remove it from the browser.

8. Your rights

Under the LGPD you may ask us to confirm whether we process your data, give you access to it, correct it, anonymize, block or delete unnecessary or excessive data, port it, delete data processed on the basis of consent, tell you with whom we share it, and review your consent. Write to forge-support@inventora.digital from the email of your account; requests, including deleting your account, are handled by hand and answered within 15 days. You may also complain to the Brazilian data protection authority (ANPD).

9. Security

Sessions on your computer are encrypted at rest; licence tokens are signed and checked against keys built into the software; sign-in credentials are stored on our side only as hashes; and all traffic to our servers uses HTTPS. No system is perfectly secure: if an incident is likely to cause you relevant harm, we will notify you and the ANPD as the law requires.

10. Chrome Web Store Limited Use disclosure

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. The browser extension collects and uses data only to provide its single purpose, connecting your Zoho session to Deluge Forge on your own computer, and transfers nothing to us or to any third party.

11. Children

Deluge Forge is a professional tool and is not directed to anyone under 18.

12. Changes

We will publish any change on this page with a new date. If a change materially affects how we use data we already hold, we will tell you by email or in the product before it applies.