Privacy

• Your account. An email address, and either a password or the fact that you signed in with Google. Authentication is handled by Supabase on Vibe's behalf.
• What you tell Vibe. The repository you connect, the live address you give it if you have one, corrections you make to what Vibe concluded, and answers to questions Vibe asks during an audit.
• A record of what happened. Which analyses ran, when, whether they succeeded, and how much AI processing they used. This is what makes the product auditable to you.

When you connect a repository, Vibe reads its file structure and a small number of project files in order to work out what the product is. It does not keep a copy. What is stored is what Vibe concluded, plus the paths where it saw the evidence for each conclusion — so you can check its reasoning without Vibe holding your source code.

Vibe never reads the contents of files that hold secrets — environment files, keys, certificates and credential files. It may notice that such a file exists, because that is itself a fact about the project, but it does not open it.

Vibe never runs your code as part of understanding it. When a change needs to be checked, that happens in an isolated, throwaway environment that carries none of your credentials and none of Vibe's.

If you give Vibe a public address, it makes ordinary web requests to it — the same kind a visitor's browser makes — and looks only at pages on that same site. It does not sign in, does not run the page's scripts, and does not follow links to other domains.

Vibe does not keep the pages it fetched. No HTML, no page source, no full page text, no cookies, and no query strings — which routinely carry tokens and email addresses. What is stored is what Vibe concluded and a short label for where it saw it.

Vibe uses a third-party AI provider (currently Anthropic) to turn the evidence it gathered into conclusions. The evidence Vibe assembled is sent to that provider for the length of the request. The model is given no tools, no web access and no access to your repository or to Vibe's database — it only ever sees the bounded evidence Vibe put in front of it.

Vibe does not request, store or display the model's internal reasoning. It stores the validated conclusion, a short explanation, and references to the evidence behind it. The record of usage keeps token counts and cost — never the text sent to the model, and never the text it returned.

Running Vibe involves other companies. As things currently stand these are Supabase (database and sign-in), Vercel (hosting and change checking), Anthropic (AI processing), GitHub (reading the repository you connect), Sentry (error monitoring, configured not to send identifying data), and Meta (advertising measurement on Vibe's public pages). This list will be reviewed and formalised before public launch.

Vibe advertises, and its public pages — this one, the home page, sign-in and sign-up — carry Meta's pixel so that a visit can be attributed to the ad that produced it. It reports that a page was viewed, and the address of that page. Nothing is passed to it about you: not your email address, not your account, not what you connected.

It is not present once you are signed in. Everything under your dashboard is outside its reach entirely — the tag is not loaded there — so the projects you work on are never part of what Meta sees. It also runs only on the live product, never on development or preview builds.

And it does not load at all unless you have switched marketing on. Not loaded and asked not to fire: the tag is absent from the page.

Two cookies are necessary and are not a choice: the one that keeps you signed in, and the one that records the decision you make below, so you are not asked again on every visit. Neither is shared with anyone.

Everything else is off until you switch it on:

• Preferences. Which product you last opened, so your dashboard goes there instead of asking. It stays in your browser.
• Analytics. Vercel Web Analytics and Speed Insights — how many people reach a page and how quickly it loads. Vibe sees totals, not people.
• Marketing. Meta's pixel, described in the section above.

Refusing is one click, in the same row and the same weight as accepting, and it is what happens if you close the banner without answering — nothing optional loads until you say so. You can change any of it later under Settings → General, where withdrawing is the same single click as giving.

Different records are kept for different lengths of time, because they answer different questions.

• The step-by-step log of a run — every action an analysis or an agent took while it was working — is kept for 90 days and then deleted. A job inside Vibe's database removes expired records once a day.
• The record of what happened — which analyses ran, when, and whether they succeeded — is kept for 18 months, so that a question asked late still has a year of history behind it. Removed by the same daily job.
• Billing and payment records are kept for as long as the law requires — under German commercial and tax law that is up to ten years. Vibe cannot delete these on request, and does not delete them when you close your account: it removes your identity from them instead, so the figures survive and your name does not.
• What Vibe concluded about your product — your audits, analyses and plans — is kept for as long as the project exists, and goes when you delete the project or your account. It is not kept on a timer, because an analysis that is a year old is still the most recent thing Vibe knows about a project nobody has re-run.

You can delete your account from Settings inside Vibe. That removes your sign-in, your projects and what Vibe concluded about them. Three things it does not do, and the screen says all three before you confirm: it does not uninstall the Vibe GitHub App, which you remove yourself in your GitHub settings; a subscription is cancelled immediately with no refund of the time already paid for; and the billing records above stay, without your name on them.

You choose which repositories Vibe can see, through GitHub's own installation screen, and you can change or remove that access at any time from your GitHub settings. You can disconnect a repository from a project inside Vibe. Giving Vibe a live address is optional — Vibe can work from your code alone.

Cookies and the two measurement tags are decided in the banner on your first visit and changed at any time under Settings → General. Deleting your account and everything Vibe holds about it is a control on that same page.

For anything else, the contact address is one of the items still to be added above. Until it exists, ask through whichever channel you are already in touch with us on.

This notice will change as the product does. The date at the top is when it last changed. See also the terms.