Terms of service

By creating an account, joining a team or connecting a repository you agree to these terms on your own behalf and, if you act for a company or a client, on theirs. The privacy policy is part of them and explains what we read from your repositories and what we keep.

VerWatch watches Craft CMS projects for outdated Composer packages, security advisories and available updates, then runs the update in an isolated container and opens a pull request with the result. Every package stays within its installed major version, compatible versions are checked against the project's installed Craft version in the way Craft's own updater does, and a run that cannot give the production and staging branches the same changeset stops and says why. These are the rules VerWatch works by, and we may refine how they are applied as Craft and Composer change.

The timeline shows what has shipped and what we are looking into. Work listed as in discovery or planned is our current intention and not a promise of when, or whether, it arrives.

You sign in with GitHub or with a link sent to your email, and you are responsible for keeping both of those accounts secure. A team's owners decide who belongs to it and what role they hold, and the team is responsible for what its members do in VerWatch, including the updates they run and the pull requests they merge. If an API token or MCP connection you created is used, that use counts as yours.

You may only connect repositories you own or are allowed to grant access to, and installing the GitHub App is how you grant it. Everything in a repository stays yours. VerWatch reads what it needs to find and update dependencies, writes only to branches it creates under verwatch/, and opens pull requests for you to review.

An update is a change to your code, and reviewing it is your job. VerWatch refuses changesets it can tell are unsafe, such as a package going back a version or a PHP requirement the project cannot meet, but it cannot test your site, and a pull request that installs cleanly can still change behaviour you depend on. If you turn on auto-merge for a project you are choosing to ship those changes without that review, and you accept the result. Pull requests you do not want can be closed, and their branches deleted, with no effect on anything else.

VerWatch is free while it is in beta, with pricing to be confirmed in the future. Until then every team without a subscription is on the Beta plan, which has the Agency plan's allowance of updates, with no card required. Each plan caps the number of updates a team can run in a month, and the Monitor plan runs none, so the current caps are on your team's billing page. We will give notice through the timeline and by email before the beta ends and a plan has to be chosen.

Plans are billed monthly or yearly in advance through Stripe, in the currency the team was first billed in. You can change or cancel the plan at any time, a cancellation stops the next renewal and the plan runs until the end of the period already paid for, and we do not refund the remainder of a period. If a payment fails we will tell you and Stripe will try again, and until it goes through the team is treated the same way as one whose trial has ended. We will give you at least thirty days' notice by email before a price change applies to a plan you are on.

Tokens for the API and MCP server act as the person who created them, within the teams that person can reach, and are subject to the rate limits described in the API reference. Keep them secret, and revoke any you think has leaked from your settings page.

Do not use VerWatch against repositories or sites you have no right to change, try to get around plan limits or rate limits, probe or disrupt the service or the containers it runs, or use it to distribute anything unlawful. We may suspend a team or an account that does any of these, and we will tell you why.

We work to keep VerWatch up and to run updates promptly, but we do not promise a particular level of availability, and runs depend on GitHub, Packagist and Google Cloud being up too. We may change, add or retire features, and will give notice through the timeline and by email before retiring something a plan depends on.

VerWatch is provided as it is, and we do not warrant that it is free of errors or that every update it proposes will suit your site. To the extent the law allows, we are not liable for loss of profit, data or business, or for any indirect loss, arising from your use of VerWatch, and our total liability to a team in any twelve months is limited to the fees that team paid us in those twelve months. Nothing in these terms limits liability that cannot be limited by law.

You can delete a team from its settings page at any time, which uninstalls the GitHub App, cancels the subscription at the end of the paid period and removes the team's data as the privacy policy describes. To close your account entirely, email us. We may end the agreement with thirty days' notice, or at once if these terms are broken, and will give you the chance to export what you need from the API first where we can.

VerWatch is built and run by Chris Rowe Ltd, a company registered in England and Wales, and these terms are an agreement with that company. They are governed by the law of England and Wales, and its courts have exclusive jurisdiction over any dispute about them. When the terms change we update the date at the top of the page, and we email the owners of every team before a change that affects their rights takes effect. Anything else, write to [email protected].