Privacy Policy

Scalene is an independent client for Vercel, shipping as a native app for Apple devices and a native app for Android. Neither has user accounts, advertising, or third-party analytics. This policy describes the data the apps and the push relay behind them actually handle, and it says so wherever the two platforms differ.

What stays on your device

You sign in by pasting a Vercel API token, which the app uses to call the Vercel API on your behalf. On iPhone, iPad, Mac, and Apple Watch that token is stored in the system Keychain. On Android it is encrypted with a hardware-backed key in the Android Keystore and is never written anywhere in plaintext. On either platform it is never written to Scalene’s servers, and it is never shared with anyone other than Vercel and, transiently, the push relay as described below.

A paired Apple Watch holds its own copy in its own Keychain, separate from the iPhone’s; it cannot read the phone’s.

Project, deployment, analytics, and usage data are fetched from Vercel directly by the app. Some of this is cached on your device so screens load quickly. Signing out clears the stored token and the cache.

The push notification relay

Notifications require a small server, because neither Apple’s nor Google’s push service will accept events directly from Vercel. If you enable notifications, the relay stores:

• A random identifier for this installation of the app, generated on the device itself and sent when it registers. It is what the relay files the registration under. It is not an advertising identifier, and nothing about your hardware or your Vercel account goes into it; deleting the app discards it, and reinstalling mints a new one.
• A push token identifying the device to its notification service - an APNs device token on iPhone, iPad, and Mac, or an FCM registration token on Android - together with which of the two services to send through.
• The Vercel team and project identifiers you subscribed to.
• Your notification preferences, recorded per device so each device can differ.
• A webhook signing secret for the team, used to verify that incoming events genuinely come from Vercel.
• On iPhone and iPad, while a deployment is building: that deployment’s identifier, the Apple broadcast channel the relay uses to update and end its Live Activity - the build status that appears on the Lock Screen while it runs - and which of Apple’s two push environments that channel belongs to. That record belongs to the deployment rather than to you: it names no device and no person, and it expires on its own within a day. Android has no Live Activities, so nothing like it is stored for the Android app.
• The time the device registration and the team record were each last written - set when a device registers or refreshes its push token, and when a team’s webhook is set up again. It is a stamp on the record itself, not a log of what you do in the app.

When you change notification settings, the app sends your Vercel token to the relay once, for that request only, so the relay can confirm with Vercel that you actually administer the team you are subscribing to. Without that check, knowing a team identifier would be enough for someone else to subscribe their device to your events. The token is used for that single verification call and is never stored or logged.

Deployment events pass through the relay to reach your device. The relay turns each event into the alert you read - project and deployment names, and the outcome - and hands that to Apple’s Push Notification service (APNs) or Firebase Cloud Messaging (Google) to deliver. Nothing is held beyond the time delivery takes.

What is not collected

• No analytics, telemetry, or crash-reporting SDKs. The Android app bundles Google’s Firebase Cloud Messaging library, because Android has no first-party way to receive a push; it is there to deliver notifications and nothing else. Firebase Analytics and Crashlytics are not included - though the messaging library does bring one Google-issued installation identifier with it, described under Service providers below.
• No advertising identifiers, and no data sold or shared.
• No email address, name, or profile - there is no account.
• No location data.

Deleting your data

Turning off notifications removes your device’s registration and preferences from the relay. Deleting the app removes the stored token and every local cache. Because there is no account, that leaves nothing behind tied to you. If you want a registration removed manually, email support@scalene.app.

Service providers

The relay runs on Vercel and stores the data listed above in a hosted Redis database (Upstash). Push delivery goes through Apple’s Push Notification service (APNs) for Apple devices and Firebase Cloud Messaging (Google) for Android devices. These providers process data only to operate the service.

On Android there is one more. The Firebase library that receives pushes brings Firebase Installations with it, which registers this installation with Google and gets back a Firebase installation ID. That comes with using Firebase Cloud Messaging (Google) at all rather than being something Scalenechose to collect: the app never reads that identifier, and it is never sent to the relay. Apple’s push service has no equivalent.

Children

Scalene is a developer tool and is not directed at children under 13.

Changes

If this policy changes materially, the date at the top of this page will change with it.

Contact

Questions about privacy go to support@scalene.app.