Anvil Icon

Anvil Privacy Policy

Last Updated: October 9, 2026

Overview

Anvil is a mobile application that provides a convenient interface for managing your Laravel Forge servers. This privacy policy explains what information we collect, how we use it, and the choices you have.

Information We Collect

Information You Provide

Laravel Forge API Key

  • You provide your Laravel Forge API key to authenticate with the Laravel Forge service
  • This key is stored securely on your device using encrypted storage (iOS Keychain / Android Keystore)
  • The key is only transmitted to Laravel Forge servers (https://forge.laravel.com/api) to authenticate your requests

Account Information

  • Your email address and name (retrieved from Laravel Forge)
  • Organization information (ID, name, membership status)
  • This information is fetched from Laravel Forge based on your API key

App Security Settings

  • PIN code (if you enable app lock)
  • Biometric authentication preferences
  • These are stored locally on your device only and never transmitted

Information Collected Automatically

Subscription Information

We use RevenueCat to manage subscriptions. RevenueCat collects:

  • Purchase and subscription status
  • Subscription type (monthly, annual)
  • Trial period status
  • App Store / Google Play transaction data

For RevenueCat's privacy practices, see: https://www.revenuecat.com/privacy

Biometric Capability

  • We check if your device supports biometric authentication (Face ID, fingerprint)
  • This check is performed locally and the result is never transmitted

Information We Do NOT Collect

  • Location data
  • Photos or camera access
  • Contacts
  • Advertising IDs

Diagnostics and Local Monitoring

When Sentry is configured in a production build, crash and error diagnostics are sent to Sentry. An optional Google Analytics integration exists in the codebase but is not called by current screens. RevenueCat uses an anonymous installation identity for subscriptions.

Monitor names, URLs, and check history are stored locally in AsyncStorage and persist across Forge sign-out. Command history and saved deployment groups use SecureStore. Monitor checks contact your configured URLs directly while the app is active; there is no Anvil monitoring backend. Individual monitors can be deleted in the app.

How We Use Your Information

We use the information we collect to:

  • Authenticate your requests to Laravel Forge
  • Display your servers, sites, and other Forge resources
  • Execute management commands on your behalf (deployments, server operations, etc.)
  • Manage your app subscription status
  • Secure access to the app with PIN or biometric authentication

Data Storage and Security

Local Storage

  • Your API key and security settings are stored using platform-native encrypted storage
  • Server and site data is cached in memory temporarily (cleared when you close the app)
  • Forge resources, subscriptions, and optional diagnostics remain with the respective services described below

Network Security

  • Forge API and subscription requests use HTTPS. Monitor requests use your configured URL, including HTTP if selected.
  • The app communicates with:
    • Laravel Forge API (https://forge.laravel.com/api)
    • RevenueCat (for subscription management)
    • Sentry, when configured (for production error diagnostics)
    • Your configured uptime monitor URLs

Third-Party Services

Laravel Forge

Your use of Anvil is subject to Laravel Forge's terms and privacy policy. We act as a client to their API on your behalf.

Privacy Policy: https://forge.laravel.com/privacy

RevenueCat

We use RevenueCat for subscription and purchase management.

Privacy Policy: https://www.revenuecat.com/privacy

Sentry (Optional)

When configured, Sentry receives production error and crash diagnostics. See Sentry’s privacy policy.

Apple App Store / Google Play Store

Purchases are processed through the respective app stores, subject to their privacy policies.

Data Sharing

We do not sell, rent, or share your personal information with third parties except:

  • Laravel Forge: To provide the app's core functionality
  • RevenueCat: To manage subscriptions
  • Sentry, when configured: To diagnose production errors
  • Legal Requirements: If required by law or to protect our rights

Your Rights and Choices

Access and Control

  • You can remove your API key at any time through the app
  • Sign out before uninstalling to remove the saved Forge token and lock settings; iOS Keychain values can persist across reinstalls
  • You can disable biometric authentication in the app settings

Data Deletion

  • Monitor history is local; Forge, RevenueCat, and optional Sentry records are held by those services
  • Android uninstall removes app-local data. iOS Keychain values can persist; sign out first and revoke your Forge token in Forge if needed
  • To delete data from Laravel Forge, contact Laravel Forge directly
  • To delete subscription data from RevenueCat, contact us

Children's Privacy

Anvil is not intended for use by children under 13. We do not knowingly collect information from children under 13.

Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any material changes by updating the "Last Updated" date.

Contact Us

If you have questions about this privacy policy or our privacy practices, please contact us at:

anthony@rappasoft.com

Permissions Explained

Android Permissions

  • INTERNET: Required to communicate with Laravel Forge API
  • USE_BIOMETRIC / USE_FINGERPRINT: For optional biometric app lock
  • VIBRATE: For haptic feedback
  • Notifications: For optional local monitor alerts

iOS Permissions

  • Face ID: For optional biometric app lock (only if you enable it)
  • Notifications: For optional local monitor alerts
View Terms of Service