Privacy Policy

1. What We Collect

When you use VibeKit, we collect:

• Account information: email address, name, OAuth provider IDs (Google, GitHub, Apple)
• App data: code, files, environment variables (encrypted at rest), deployment history
• Agent messages: conversation history with AI agents, stored for chat continuity
• Usage data: API request counts, token usage, session timestamps
• Payment data: Stripe customer ID and subscription status (we never store raw card numbers)
• Device data: push notification tokens for iOS/Android (optional)

2. How We Use Your Data

We use your data to:

• Provide and operate the Service
• Authenticate your account and maintain sessions
• Process payments and manage subscriptions
• Send transactional emails (welcome, deploy alerts, billing)
• Improve the platform using anonymized usage metrics
• Respond to support requests

We do not sell your data to third parties. We do not use your data to train AI models.

3. Third-Party Services

VibeKit integrates with the following third parties:

• Anthropic / OpenAI, AI providers. Your messages are sent to their APIs under their privacy policies. We do not store your API keys in plaintext.
• Stripe, payment processing. Subject to Stripe's privacy policy.
• Supabase, database infrastructure. Data is stored in us-east-1 (AWS).
• Google / GitHub / Apple, optional OAuth login. We only receive your name and email from these providers.
• Composio, connected-account authorization and tool execution. Composio stores the OAuth token used to establish a connection.

4. Connected Accounts

Content returned through Connections passes through Composio and VibeKit into your agent's context, and is sent to the AI provider handling that turn. Some tools can return passwords, API keys, access tokens, private keys, or database connection strings. Before one runs, VibeKit requires a separate confirmation phrase from a later message you authored and warns that the result will enter the agent transcript and AI provider context.

We record that a sensitive tool was confirmed and executed, but do not separately log its arguments or returned value. Do not connect an account or approve credential access unless you are willing to have that content processed by an AI model.

5. Data Security

Environment variables and API keys are encrypted at rest using AES-256-GCM. All data in transit is protected by TLS. Access to production infrastructure is restricted to authorized personnel.

While we take reasonable security measures, no system is completely secure. We cannot guarantee the absolute security of your data.

6. Data Retention

We retain your data for as long as your account is active. If you delete your account, your data is removed within 30 days. Agent conversation history and app files are deleted immediately on account deletion.

7. Your Rights

You have the right to:

• Access the data we hold about you
• Export your app files and data at any time
• Delete your account and all associated data via the dashboard
• Opt out of marketing emails (transactional emails cannot be disabled)
• Request correction of inaccurate data

8. iOS App

The VibeKit iOS app may request access to your photo library (for file attachments) and send push notifications (for deploy alerts). These permissions are optional and can be revoked at any time in iOS Settings.

We do not track you across other apps or websites. We do not use advertising identifiers.

9. Children

VibeKit is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe we have inadvertently collected such data, contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes via the dashboard or email. Continued use of the Service after changes constitutes acceptance.

11. Contact

Privacy questions or data requests: [email protected]