Privacy policy

VerWatch is built and run by Chris Rowe (Chris Rowe Ltd, a company registered in England and Wales), a web developer from Nottingham, UK, who has been building Craft sites since it was called Blocks and is the author of the popular Donkeytail and Block Usage plugins. VerWatch watches Craft CMS projects for outdated Composer packages and security advisories, runs the update in an isolated container, and proposes the result back to your repository as a pull request. This policy explains the information we collect and how we use it to provide the service.

When you sign in with GitHub we store your GitHub account id and login, and the name and email address GitHub gives us. When you sign in with a magic link we store the email address you typed. Either way we keep the teams you belong to, your role in each, and the notification settings you choose. If you invite someone to a team we store the address you invite them at so the invitation can reach them.

Your password, if you set one, is hashed. Two-factor secrets and recovery codes are encrypted.

Projects reach VerWatch through a GitHub App installed on your organisation or account. GitHub tells us which repositories the installation covers, and the names of those repositories are listed in VerWatch so you can see which ones are Craft projects and which were skipped.

A sync reads three files from the branches you have set for a project: composer.json, composer.lock and, when it exists, .ddev/config.yaml. From them we keep the list of packages the project uses, the installed version of each, the Craft and PHP versions, and where composer.json sits in the repository. That dependency list, and what Packagist tells us is available for it, is the data VerWatch shows and compares. A sync fetches nothing else from the repository.

An update run is different. The run clones the branch into a container that exists only for that run, installs and updates the dependencies there, commits the result to a branch named under verwatch/, opens a pull request, and exits. The clone goes with the container. What we keep from a run is its log (the milestones, Composer output and any error, which can quote file names and package versions from your project), the list of versions that changed, and the pull request links. We never commit to a branch of yours that VerWatch did not create, and merging is either your action or the auto-merge setting you chose for the project.

GitHub also sends us webhook events for the installation: pushes to the branches we watch, so we can re-sync when composer.json or composer.lock changed, and pull request events, so we can tell when one of ours was merged or closed. We keep the pull request state and the commit's reference, not its diff.

Once a run has finished we hold no copy of your source code. Removing a repository from the installation removes its project from VerWatch, and removing the installation removes all of them.

VerWatch runs on Laravel Cloud in London, where the database and cache live, and sends its email through Resend. Update runs happen in containers on Google Cloud Run in the United States, so the repository clone and the container's logs pass through Google's infrastructure for the length of the run. Laravel Nightwatch records errors and slow requests, which can include the page address and your user id.

To work out what is outdated we send the names of the packages a project uses to Packagist, which is also where security advisories come from. Where a changelog summary or a risk assessment appears beside an update, the package's public release notes were sent to OpenAI and TypeSafe to produce it. Nothing from your repository goes to either.

Payments go through Stripe. Stripe holds your card, and we keep the Stripe customer id, the card type and its last four digits so the billing page can show which card is on file. If you connect Slack we store the workspace token and the channel you chose, and post update outcomes there. Fonts are served from Bunny Fonts, which sees your browser's request like any other web host.

Bug reports sent from inside the app are filed as issues in our private tracker on GitHub with your name and email, the description you wrote, the page you were on, and the screenshot of it if you included one. The screenshot is stored on our servers and linked from the issue.

VerWatch sets the cookies it needs to keep you signed in and to protect forms from forgery, and nothing else. There are no analytics or advertising scripts on any page. On the public pages we count visitors with a daily hash of the request that stores no IP address or browser details and cannot link one day's visit to the next.

Project data stays for as long as the project does, and update history stays with its team. Deleting a team uninstalls the GitHub App from its installations, cancels any subscription at the end of the paid period, and deletes the team's projects, members, history and integrations. To delete your account altogether, email [email protected] from the address on the account and we will remove it along with any team you are the only member of. Database backups are kept for a short period after a deletion before they roll off.

Under UK data protection law you can ask for a copy of the personal data we hold about you, have it corrected or deleted, or object to how it is used. Email [email protected] and we will reply within a month. If you are unhappy with how we handled it you can complain to the Information Commissioner's Office at ico.org.uk.

When this policy changes we update the date at the top of the page, and if the change affects how your data is used we email the owners of every team before it takes effect.