Privacy Policy

Last updated: November 9, 2026

We provide a robust and secure data management infrastructure for application developers. Open source developers use our free Vibes DIY core to build applications, while customers leverage our value-added tools and services to create, manage, and scale their projects. Vibes DIY wants to be transparent about our use of the Personal Data that is entrusted to us.

This Privacy Policy ("Policy") describes the "Personal Data" that we collect about you, how we use it, how we share it, your rights and choices, and how you can contact us about our privacy practices. This Policy also outlines your data subject rights, including the right to object to some uses of your Personal Data by us.

Definitions

"Account" means a unique account created for You to access our Service or parts of our Service.

"Application" refers to software programs created by customers of Vibes DIY, which use Vibes DIY as part of their data management solution.

"Vibes DIY," "company," "we," "our," or "us" means the Fireproof Storage entity responsible for the collection and use of Personal Data under this Privacy Policy. It differs depending on your jurisdiction.

"Personal Data" means any information that relates to an identified or identifiable individual, and can include information that you provide to us and that we collect about you, such as when you engage with our services (e.g., device information, IP address).

"Services" means the products and services that Vibes DIY indicates are covered by this Policy, which may include Vibes DIY-provided tools, resources, and support for Application Developers. Our "Business Services" are Services provided by Vibes DIY to entities ("Customers") who directly and indirectly provide us with "End User" Personal Data in connection with those Customers' applications and activities. Our "End User Services" are those Services which Vibes DIY provides as a data processor for applications managed by Customers.

"Sub-Processor" means any natural or legal person who processes the data on behalf of the Company. It refers to third-party companies or individuals employed by the Company to facilitate the Service, to provide the Service on behalf of the Company, to perform services related to the Service or to assist the Company in analyzing how the Service is used.

"Sites" refers to Vibes DIY, accessible from https://vibes.diy, and the other websites, apps, and online services that Vibes DIY indicates are covered by this Policy. Collectively, we refer to Sites, Business Services, and End User Services as "Services."

Depending on the context, "you" means Open Source Developer, Customer, or End User.

When you use the free Vibes DIY core to build applications, we refer to you as an "Open Source Developer." When you are part of a team that writes and deploys applications using Vibes DIY value-added tools and pays monthly membership and metered costs, we refer to you as a "Customer."

When you use applications managed by Customers and have no direct commercial relationship with Vibes DIY, we refer to you as an "End User." Depending on the activity, Vibes DIY acts as a "data controller" and/or "data processor" (or service provider). If you are on a team building applications that use Vibes DIY, Vibes DIY is a data controller of your account payment, metrics, team and other data, and data processor of your application data.

The "data controller" is the entity which determines the purposes and means of the data processing taking place. The "data processor" is an entity acting on behalf and under the instructions of a controller in processing personal data.

Vibes DIY is a data controller when it determines the purposes and means of the processing taking place. These data processing activities include (1) providing the Vibes DIY products and services, (2) monitoring and maintaining the Vibes DIY platform, (3) complying with legal or regulatory obligations applicable to data protection, and (4) analyzing, developing, and improving Vibes DIY's products and services.

Vibes DIY is a data processor when it processes application data on behalf of and at the direction of a Customer. Our Customers, who are Application Developers, direct us to process data in the context of their applications, which may include personal information of End Users.

How we use information we collect

We collect personal information in connection with your visits to and use of the Service. This collection includes information that you provide in connection with the Service, information from third parties, and information that is collected automatically, such as through the use of cookies and other technologies.

We collect personal information from you. The categories of information we collect can include:

  • Registration information. We collect personal and/or business information when you register for an account on Vibes DIY. This information may include your email address, the public handle or handles you choose, and, if you sign in with a third-party account, basic profile information from that provider such as your name. We use this information to manage your account, provide you with relevant services and information, communicate with you about your account, and offer customer support.
  • User Content. After registration, you may create, upload, or transmit files, documents, videos, images, data, or information as part of your use of the Service (collectively, "User Content"). User Content and any information contained in it, including personal information you may have included, is stored and collected as part of the Service. You have full control over the information included in the User Content. See "AI and Model Use" below for how prompts and generated apps are handled.
  • Payment information. If you make a purchase or payment on the Site, such as for a subscription, we collect transactional information provided in connection with your purchase or payment. We use third-party payment processors, including Stripe, to process payments made to us. We do not retain personally identifiable financial information such as credit card numbers. All such information is provided directly by you to our third-party processor. The payment processor's use of your personal information is governed by their privacy notice. To view Stripe's privacy notice, please visit: https://stripe.com/privacy.
  • Communications. If you communicate with us through any paper or electronic form, we may collect your name, email address, mailing address, phone number, or any other personal information you choose to provide to us. We use this information to investigate and respond to your inquiries, communicate with you, enhance our services, and manage and grow our organization.
  • Inquiries and Feedback. If you contact us, we will collect the information you provide, such as your contact information and the contents of your communication with us.
  • Invitations. If you invite someone to an app by email, we use the address you enter to send them that invitation.
  • Connected accounts. If you link a third-party account (such as GitHub, Threads, Instagram, TikTok, or LinkedIn) so an app can act on it, we store the access credentials that provider issues, keep them refreshed, and use them only to make the requests that app makes on your behalf. You can disconnect a linked account at any time in Settings.

Usage Data

Usage Data is collected automatically when using the Service.

  • Usage Data may include information such as Your Device's Internet Protocol address (e.g. IP Address), browser type, browser version, the pages of our Service that You visit, the time and date of Your visit, the time spent on those pages, unique device identifiers and other diagnostic data.
  • When You access the Service by or through a mobile device, We may collect certain information automatically, including, but not limited to, the type of mobile device You use, Your mobile device unique ID, the IP address of Your mobile device, Your mobile operating system, the type of mobile Internet browser You use, unique device identifiers and other diagnostic data.
  • We may also collect information that Your browser sends whenever You visit our Service or when You access the Service by or through a mobile device.
  • Product analytics and session replay. We use PostHog to understand how the Service is used, including recordings of how people move through its interface ("session replay") so we can find and fix problems. In these recordings, text you type and text shown on the page are masked. Product analytics and session replay are collected only from visitors located in the United States.
  • Cookies and local storage. We use cookies and similar browser storage to keep you signed in, remember your preferences, support the analytics described above, and keep your apps' data on your device so they work offline and sync across devices.

Information from Third Party Sources

  • We may receive personal information about you from our business partners and service providers and combine this information with other data we collect from you. These third parties may include website and service operators and payment processors.
  • Single Sign-On. We use single sign-on (SSO), through our authentication provider Clerk, with accounts such as Google, Apple, GitHub, or Facebook to allow a user to authenticate their account using one set of login information. We will have access to certain information from those third parties in accordance with the authorization procedures determined by those third parties.
  • Information from Other Sources. We may obtain information from other sources and combine this information with other information we collect from or about you.

Other Uses of Personal Information

In addition to the uses described above, we may collect and use personal information for the following purposes:

  • For our business activities, including operating the Service and providing you with its features and functionality;
  • To communicate with you and respond to your requests;
  • To send you first-party product updates and communications about features and changes, which you can opt out of at any time;
  • To measure and attribute the effectiveness of our own advertising (see "Selling and sharing your personal information");
  • For analytics and research purposes;
  • To enforce our Terms of Service, resolve disputes, and protect our business interests and the interests and rights of third parties;
  • To comply with contractual and legal obligations and requirements;
  • To fulfill any other purpose for which you provide personal information; and
  • For any other lawful purpose or other purpose that you consent to.

We collect and use personal information to ensure a seamless experience when using our Service, maintain our organization's growth, and comply with legal requirements. Your privacy is important to us, and we strive to protect your personal information at all times.

AI and Model Use

The Service uses AI to help you generate applications:

  • Generation uses third-party model providers. To generate code, content, and images, your prompts — and, when you change an existing app, that app's code — are sent to third-party AI providers. These include model routing services such as OpenRouter and the model developers they route to (for example Anthropic, OpenAI, and Google), as well as specialized code and image-generation providers. These providers process your request to return a result; their handling of data is governed by their own terms and privacy notices. This also applies to apps you build that use AI features, and to prompts you enter before creating an account.
  • On Apple devices. In our iOS app, some AI features run on your device or through Apple's Private Cloud Compute before falling back to the providers above.
  • Service improvement. Vibes DIY is a shared, evolving platform. We and our automated systems review prompts, apps, and how they're used, and may change, fix, or improve your apps and the apps we help you generate, and showcase apps people make.

This section is consistent with the "AI and Model Use" section of our Terms of Service.

Connecting AI Assistants

You can connect Vibes DIY to an AI assistant, such as Claude, through our MCP connector. Once you sign in and approve the connection, the assistant can list, read, create, change, publish, and delete your apps and their data on your behalf, with exactly the access your own account has. Before it publishes an app or deletes data, the assistant asks you to confirm, where it supports doing so.

We receive the requests the assistant makes through the connector — for example the code it saves or the documents it writes — and process and record them like any other activity in your account. We do not receive or store your conversations with the assistant. You can disconnect the assistant at any time from its settings, which stops it acting on your account.

Selling and sharing your personal information

We do not sell your personal information for money.

Advertising attribution. We measure the effectiveness of our own advertising. If you arrive at the Service from an advertisement on a third-party platform — for example, by following a link that carries a Meta/Facebook click identifier (fbclid) — we send a limited set of data to Meta through its Conversions API so we can attribute the visit to that ad. That data consists of the click identifier and the IP address and browser user-agent string of your request. If you then create an account, build an app, or come back and change one, we send Meta a further attribution event for that step. To let Meta match those events to you, they also carry a one-way cryptographic hash (SHA-256) of your account identifier and, where we hold one, a one-way hash of your email address — never the address itself, and never your name, your prompts or anything you build. Because those steps can happen days after the ad click, we keep the click identifier stored against your account rather than only for the browsing session it arrived in, so that a later action can still be attributed to the ad. This happens only when you arrive with such an identifier and the relevant integration is configured for the deployment; we do not send it for ordinary visits. Under the California Consumer Privacy Act (CCPA/CPRA), this attribution activity may be considered "sharing" for cross-context behavioral advertising. We do not otherwise use third-party advertising networks to build profiles of you or to target you based on your activity within the Service. To limit this, you can avoid ad links, use your browser's or device's tracking controls, or contact us using the details below.

How we share personal information

We may share your personal information in the following situations. For more information on your choices regarding your information, see "Your Rights and Choices."

  • We may share your personal information with third-party service providers or sub-processors who help us deliver or improve our Site or services. These third parties are subject to reasonable confidentiality terms and may only use the information to provide services to us. They currently include:
    • Hosting, storage, and delivery: Cloudflare.
    • Database: Neon.
    • Authentication: Clerk.
    • Payments and billing: Stripe and Autumn.
    • AI model inference: OpenRouter and the model providers it routes to, and specialized code and image-generation providers (see "AI and Model Use").
    • Product analytics and session replay: PostHog (United States visitors only).
    • Email delivery: Resend, for account, invitation, and activity email.
    • Push notifications: Apple, for notifications delivered to our iOS app.
    • Customer relationship management: HubSpot. When you create an account, we record your email address, name, handles, plan, the apps you have made, your most recent activity, and how you found us, so we can understand and support our users.
    • Internal team notifications: Discord. When a new account is created, our team's private workspace receives a notice with the account's identifier, name, username, email addresses, and sign-up time.
    • Advertising attribution: Meta, as described in "Selling and sharing your personal information."
  • Third parties may receive your information if required by law, subpoena, or if we reasonably believe that such action is necessary to (a) comply with the law and law enforcement requests; (b) enforce our Terms of Service or other agreements or protect the security or integrity of Vibes DIY services, including preventing harm or financial loss and addressing fraud or illegal activity; and/or (c) protect the rights, property, or personal safety of Vibes DIY, our customers, visitors, or others.
  • We may share information with other companies and brands owned or controlled by Vibes DIY or under common ownership as Vibes DIY. These companies will use your personal information in the same way as we can under this Privacy Policy.
  • We may transfer any information we collect in the event we sell or transfer all or a portion of our business or assets (including in connection with a merger, acquisition, reorganization, financing, or sale of assets, or in the event of bankruptcy or insolvency). In such transactions, your information may be one of the transferred assets, and we will require any acquirer to honor this Policy or provide notice of any material change.

Data Retention

We retain Personal Data for as long as necessary to provide the Service, maintain your account, comply with our legal obligations, resolve disputes, and enforce our agreements. When Personal Data is no longer needed for these purposes, we will delete or de-identify it. As a data processor, we retain application data on behalf of, and according to the instructions of, the relevant Customer.

You can delete individual documents at any time. Deleting an app from your list takes it offline but does not erase it from our servers; to permanently delete an app and its data, delete the handle that owns it in Settings, which permanently deletes that handle and every app under it. Because apps sync data to the devices of the people who use them, copies already delivered to another person's device stay on that device; deleting or removing access stops new data from reaching them. To delete your account and its remaining server-side data, contact us using the details below.

Security

We use commercially reasonable administrative, technical, and organizational measures designed to protect Personal Data against unauthorized access, loss, misuse, or alteration. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. Please also review the Security section of our Terms of Service regarding your responsibility to back up and protect Your Content.

Your Rights and Choices

Depending on where you live, you may have some or all of the following rights regarding your Personal Data:

  • Access — request a copy of the Personal Data we hold about you.
  • Correction — request that we correct inaccurate or incomplete data.
  • Deletion / Erasure — request that we delete your Personal Data, subject to legal exceptions.
  • Objection and Restriction — object to or ask us to restrict certain processing.
  • Portability — request a copy of certain data in a portable format.
  • Opt-out — opt out of non-essential product communications.

To exercise any of these rights, contact us using the details in "How to Contact Us." We will respond within the timeframes required by applicable law and will not discriminate against you for exercising your rights.

California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the rights described above, including the right to know what Personal Data we collect, to request deletion, and to correct inaccurate information. We do not sell your personal information for money. As described under "Selling and sharing your personal information," we may "share" a limited set of identifiers with Meta for advertising attribution; you may exercise your choices regarding that sharing, including the right to opt out and the use of an authorized agent, by contacting us below.

European Privacy Rights (GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process your Personal Data on the legal bases of performance of a contract, our legitimate interests, your consent, and/or compliance with legal obligations. You have the rights described above and the right to lodge a complaint with your local supervisory authority. Where we rely on consent, you may withdraw it at any time.

International Data Transfers

We are based in the United States and may process and store Personal Data in the United States and other countries. Where required, we use appropriate safeguards (such as Standard Contractual Clauses) for transfers of Personal Data out of the EEA, the UK, or Switzerland.

Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect Personal Data from children under 13. If you believe a child has provided us with Personal Data, please contact us and we will take steps to delete it.

Changes to This Policy

We may update this Policy from time to time. Material changes will be posted on this page with an updated "Last updated" date and, where appropriate, communicated by email or in-product notice.

How to Contact Us

If you have questions about this Policy or our privacy practices, or wish to exercise your rights, contact us at:

Copyright © 2026 Vibes DIY