# Privacy Policy

Last updated: 15 October 2026
Source: https://vibefilo.dev/privacy

This policy explains what personal data Vibefilo collects when you use the website at vibefilo.dev, the dashboard, the API at api.vibefilo.dev and the Vibefilo MCP server (together, the service), why we collect it, how we use and protect it, who we share it with, how long we keep it and what your rights are.

## 1. Who we are

Vibefilo runs security and GDPR checks for vibe-coded apps inside coding agents such as Claude Code, Cursor and Codex. Vibefilo is operated by Oshadha Vimukthi, an individual developer based in Sri Lanka, who is the controller of the personal data described in this policy. You can reach us at support@vibefilo.dev.

## 2. Summary

- We collect your account details, your organization and project details, and the findings your coding agent submits.
- We do not read or store your source code. Your agent runs the checks on your machine.
- We never sell personal data and never use it for advertising.
- We only use strictly necessary cookies, so there is no cookie banner.
- You can ask us to access, export or delete your data at any time by emailing support@vibefilo.dev.

## 3. What we collect

- Account data: your email address, your name and profile picture if you sign in with Google, and a password hash if you sign up with email. Passwords are handled by our authentication provider and are never visible to us.
- Organization data: the organization name, its members and roles, invitations you send, and any company details you choose to add, such as a legal name, address or data protection contact.
- Project and check data: project names, the countries and business type you set, the deployed URL you add, the checks you run, and the findings your agent submits. A finding has a rule, a severity, a title, a file path, a line number and a short evidence snippet with secret values masked.
- Agent connections: the coding agent and its version, a device name, and hashed sign-in tokens, so we can keep your agent signed in and let you revoke it.
- Usage and billing records: your credit balance, a ledger of credits used, spending limits you set, an audit log of important account actions, and, for paid top-ups, the order number, amount, currency and a receipt link. Card and billing details are handled by our payment provider and never reach us.
- Messages: what you send us when you contact support.
- Technical data: error reports from our apps (no user identity and no IP address attached), server logs kept by our hosting providers that include IP address, browser type, page requested and time, anonymous page view and page speed statistics from Vercel Web Analytics and Speed Insights (no cookies, no profile of you, and no tracking across other sites), and the cookies described below.

## 4. What your agent sends and receives

When your coding agent uses the Vibefilo MCP server, it sends us only what is needed to record a check:

- Project setup: the project name and the countries, business type and deployed URL you set.
- Findings: for each finding the rule id, severity, title, file path, line number and a short evidence snippet with secret values masked.
- Coverage: which rules were checked, and which were marked not applicable with a short reason.
- Fix results: for each fix you verify, whether each verification goal passed, with a short masked note.

In return we send your agent the rules to apply, fix guidance, your credit balance and a link to your dashboard.

## 5. Data we receive from Google

If you choose Sign in with Google, Google shares a limited set of information with us after you approve. Vibefilo requests only the basic sign-in scopes: openid, email and profile.

- What we receive: your Google account email address, your name, your profile picture and a Google account identifier.
- How we use it: to create your Vibefilo account and sign you in, to show your name and picture in the dashboard and to your teammates, and to send service emails to your address. We do not use it for anything else.
- What we do not access: Vibefilo does not read your Gmail, Drive, Calendar, contacts or any other Google service data.
- Sharing: we do not sell Google user data, share it with advertisers or transfer it to anyone, except the service providers listed in this policy that run the service for us, or where the law requires it.
- AI and machine learning: we do not use Google user data to develop, improve or train generalized AI or machine learning models.
- Human access: we do not read Google user data except to give you support you asked for, to investigate security or abuse, or to comply with the law.
- Storage: it is stored in our authentication and database provider and protected as described under Security.
- Revoking and deleting: you can revoke Vibefilo's access at any time at https://myaccount.google.com/permissions, which stops Google sign-in. To delete the data we hold, follow the steps under Your rights.

Vibefilo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. In practice this means:

- We use Google user data only to provide the sign-in and account features you see in Vibefilo.
- We transfer it only to provide those features, to comply with the law, or as part of a merger or sale of the service with notice to you.
- We do not use it for advertising, and we do not sell it.
- People do not read it unless you ask for support, it is needed for security or abuse investigations, or the law requires it.

## 6. What we do not collect

Vibefilo does not read, scan or store your source code. Your coding agent runs the checks on your machine. Only the findings listed above are sent to us. Secret values are masked before they are sent, and anything that still looks like a secret is masked again on our servers before it is stored.

## 7. Why we use your data

- To provide the service: sign you in, run checks, show findings, track fixes and manage credits. Legal basis: performing our contract with you.
- To keep the service secure and working: prevent abuse, fix errors and rate limit requests. Legal basis: our legitimate interest in running a safe and reliable service.
- To send service emails such as sign-in confirmation, password reset, team invitations and low credit balance notices. Legal basis: performing our contract with you.
- To meet legal and accounting obligations. Legal basis: legal obligation.

We do not sell personal data and we do not use it for advertising. We do not make decisions about you by automated means that have legal or similarly significant effects.

## 8. Who we share data with

We use a small number of service providers (processors) that handle data on our behalf:

- Supabase: database, authentication and file storage.
- Google: sign-in, only if you choose Sign in with Google.
- Brevo: transactional email.
- Sentry: error monitoring, configured without user identity or IP address.
- Vercel: hosting for the website and API.
- Lemon Squeezy: payment processing and sales tax for paid top-ups, acting as the seller (merchant of record). It handles your card and billing details; we only receive the order, the amount, and a receipt link.

Members of your organization can see the projects, findings and usage of that organization. We may also disclose data if the law requires it. We do not sell or rent personal data.

## 9. Where data is stored and international transfers

Our database, authentication and API currently run in Mumbai, India. The website is delivered through our hosting provider's global network. Some of our providers are based in, or operate from, other countries, including the United States and the European Union.

Where personal data of people in the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on the standard contractual clauses approved by the European Commission or an equivalent safeguard.

## 10. Cookies

We only use strictly necessary cookies: your sign-in session, the organization you last selected, and interface preferences such as the sidebar state and whether you have dismissed the setup checklist. We do not use advertising or analytics cookies, so there is no cookie banner. Our page view and speed statistics work without cookies. If that changes, we will ask for your consent first.

## 11. How long we keep data

- Account and organization data: while your account is open. After you ask us to delete your account, we delete it within 30 days.
- Projects, runs and findings: until you or your organization deletes them, or the account is closed.
- Agent sign-in tokens: stored only as hashes, and removed when you revoke them, when they expire or when the account is deleted. Device sign-in codes expire after 10 minutes.
- Credit ledger and billing records: for the period that accounting and tax law require, which we expect to be no more than 7 years. After you delete an organization, these records are kept without any link to the organization, your name or your email address.
- Support messages: until your request is resolved and for up to 2 years afterwards.
- Error reports: up to 90 days.
- Server logs (IP address, browser type, page requested and time): up to 7 days, kept by our hosting and database providers.
- Backups: deleted data can remain in our database provider's backups for up to 7 days, and is then overwritten.

## 12. Your rights and how to delete your data

Under the GDPR and similar laws you can ask us to access, correct, export or delete your personal data, restrict or object to its use, and withdraw consent where we rely on it. You also have the right to complain to your data protection authority.

- Delete a project or your whole organization yourself: open Settings, then Organization, then Danger zone. This removes its projects, findings and usage data.
- Delete your user account or exercise any other right: email support@vibefilo.dev from the address on your account. We remove your personal data within 30 days, except what we must keep by law. A deletion request also removes the Google sign-in data we hold.
- Stop Google sign-in: revoke Vibefilo at https://myaccount.google.com/permissions.

We answer within 30 days, and tell you if we need more time.

## 13. Security

We protect data with encryption in transit, row level security on our database so each organization only sees its own data, hashed sign-in tokens and API keys, masked evidence, rate limiting and least-privilege access. No system is perfectly secure, so if something affects your data we will tell you as the law requires.

## 14. Children

Vibefilo is built for developers and is not directed at anyone under 16.

## 15. Changes to this policy

If we make a material change we will update the date at the top and tell account holders by email or in the dashboard at least 14 days before it takes effect, unless the law requires it sooner.

## 16. Contact

- Controller and data protection contact: Oshadha Vimukthi, trading as Vibefilo, Sri Lanka.
- Email: support@vibefilo.dev.
- Website: https://vibefilo.dev.

Questions about privacy or this policy? Write to us at the email above and we will answer within 30 days.