Privacy

• Your account. An email address, and either a password or the fact that you signed in with Google. Authentication is handled by Supabase on Vibe's behalf.
• What you tell Vibe. The repository you connect, the live address you give it if you have one, corrections you make to what Vibe concluded, and answers to questions Vibe asks during an audit.
• A record of what happened. Which analyses ran, when, whether they succeeded, and how much AI processing they used. This is what makes the product auditable to you.

When you connect a repository, Vibe reads its file structure and a small number of project files in order to work out what the product is. It does not keep a copy. What is stored is what Vibe concluded, plus the paths where it saw the evidence for each conclusion — so you can check its reasoning without Vibe holding your source code.

Vibe never reads the contents of files that hold secrets — environment files, keys, certificates and credential files. It may notice that such a file exists, because that is itself a fact about the project, but it does not open it.

Vibe never runs your code as part of understanding it. When a change needs to be checked, that happens in an isolated, throwaway environment that carries none of your credentials and none of Vibe's.

If you give Vibe a public address, it makes ordinary web requests to it — the same kind a visitor's browser makes — and looks only at pages on that same site. It does not sign in, does not run the page's scripts, and does not follow links to other domains.

Vibe does not keep the pages it fetched. No HTML, no page source, no full page text, no cookies, and no query strings — which routinely carry tokens and email addresses. What is stored is what Vibe concluded and a short label for where it saw it.

Vibe uses a third-party AI provider (currently Anthropic) to turn the evidence it gathered into conclusions. The evidence Vibe assembled is sent to that provider for the length of the request. The model is given no tools, no web access and no access to your repository or to Vibe's database — it only ever sees the bounded evidence Vibe put in front of it.

Vibe does not request, store or display the model's internal reasoning. It stores the validated conclusion, a short explanation, and references to the evidence behind it. The record of usage keeps token counts and cost — never the text sent to the model, and never the text it returned.

Running Vibe involves other companies. As things currently stand these are Supabase (database and sign-in), Vercel (hosting and change checking), Anthropic (AI processing), GitHub (reading the repository you connect), and Sentry (error monitoring, configured not to send identifying data). This list will be reviewed and formalised before public launch.

You choose which repositories Vibe can see, through GitHub's own installation screen, and you can change or remove that access at any time from your GitHub settings. You can disconnect a repository from a project inside Vibe. Giving Vibe a live address is optional — Vibe can work from your code alone.

For anything else, including deleting your account and what Vibe holds about it, the contact address is one of the items still to be added above. Until it exists, ask through whichever channel you are already in touch with us on.

This notice will change as the product does. The date at the top is when it last changed. See also the terms.