Skip to content

Vibe Editor

Privacy Policy

Effective date and last updated: October 16, 2026. This policy explains what information is collected through the Vibe Editor website, account system, licensing system, downloads, updates, the encrypted desktop backup, site Google grants, and support tools, why it is used, how it is shared and retained, and which privacy rights may apply in Israel, the European Union, the United Kingdom, and the United States.

1. Who we are

Vibe Editor provides a website, account system, licensing flow, downloads, updates, and related support tools for the Vibe Editor desktop application. For privacy questions, requests, or complaints, contact us at ayala8064@gmail.com.

We may ask you to verify your identity before responding to privacy requests so that we do not disclose or change account information for the wrong person.

2. Scope of this policy

This policy applies to this website, account and licensing services, downloads, update checks, login flows, bug-reporting features, and the optional end-to-end encrypted desktop backup kept in your secrets vault.

This policy does not replace the privacy policies of Supabase, Google, GitHub, payment providers, hosting providers, or other third parties when you use their services directly.

The desktop application may interact directly with GitHub from your computer. GitHub repositories, commits, source code, issues, local files, and locally stored tokens are not collected in readable form by this website unless you intentionally include them in a support request, bug report, or screenshot. A user who explicitly turns on the encrypted backup may upload client-side encrypted copies as described below.

3. Information we collect

  • Account and identity data: email address, display name if provided, basic authentication data managed through Supabase Auth, and login method such as email/password, magic link, or Google.
  • License and account status: plan type, whether the account is active, admin role if applicable, privacy-policy acceptance time, account creation and update times, and last_seen_at for account and license management.
  • Desktop app connection data: when the app checks a license, the server receives a bearer token, stores only a token_hash, and may update last_seen_at for the account and app session. App version and platform may be sent in request headers to return the right update, but they are not currently stored as separate profile fields.
  • Bug reports: title, description, status, reporter user ID, and optional screenshot if you upload one. Bug reports may be visible to signed-in users in the reporting interface, so you should not include secrets, access tokens, private code, credentials, or sensitive personal data.
  • Downloads and updates: when downloading an installer or checking for updates, the service may route you to GitHub Releases or a Supabase Edge Function that identifies the appropriate download. GitHub, Supabase, and hosting providers may process technical request data such as IP address, user agent, and request time under their own policies.
  • Technical and security data: logs, request metadata, device/browser information, authentication events, and diagnostic information needed for security, troubleshooting, fraud prevention, and service reliability.
  • Optional encrypted desktop backup: if you turn it on, the desktop app uploads ciphertext containing chat history, settings, project metadata, repositories, and application keys. It is encrypted on your device, before upload, with a key derived from your secrets vault (the same secrets password that protects your connected accounts). We store the encrypted objects, snapshot size/hash/time, a one-way fingerprint of the encryption key, and the ID of the computer that made the snapshot. We do not receive or store your secrets password, recovery key, master key, or any plaintext backup contents.

4. Information we do not collect for advertising or profiling

  • We do not sell personal information.
  • We do not share personal information for cross-context behavioral advertising.
  • We do not use advertising cookies, marketing pixels, analytics beacons, or third-party profiling scripts on this website.
  • We do not store readable GitHub access tokens in the website database. If the encrypted backup is turned on, such secrets can exist only inside device-encrypted ciphertext that the service cannot decrypt.
  • We do not process readable source code or repository content through this website unless you choose to send it in a bug report or support message. Backup storage receives only ciphertext produced on your device.
  • We do not make automated decisions that produce legal or similarly significant effects about users.

5. Why we use information

  • To create accounts, authenticate users, maintain sessions, and prevent unauthorized access.
  • To check license eligibility, operate the desktop app connection, and manage plan or account status.
  • To provide downloads and software updates that match your platform.
  • To receive, display, investigate, and track bug reports.
  • To provide an optional encrypted backup, cross-device restore, and snapshot conflict protection.
  • To protect the service, detect misuse, troubleshoot errors, maintain logs, and respond to user requests.
  • To comply with legal obligations, preserve evidence, and defend legal rights where necessary.

7. Cookies, localStorage, and sessionStorage

The website uses essential and functional browser storage only. Supabase login tokens and the local chat cache are stored in sessionStorage for the current tab; closing the tab may require signing in again. Existing localStorage copies are migrated when accessed. Interface preferences and a chat visitor identifier remain in localStorage so saved history can be retrieved from Supabase.

The website does not use advertising cookies, marketing measurement cookies, or cross-site tracking technologies.

You can clear cookies and browser storage through your browser settings. Doing so may sign you out or affect how the website works.

8. Sharing information with providers and third parties

We share information only when needed to operate the service, when you choose to use an integrated provider, or when legally required. Providers are expected to process information for service purposes and under appropriate contractual and security requirements where required by law.

  • Supabase for authentication, database, storage, Edge Functions, and backend infrastructure.
  • Google when you choose to sign in through its OAuth provider.
  • GitHub Releases for installer files and software updates.
  • Hosting, security, email, and technical infrastructure providers needed to run the service.
  • Courts, regulators, law enforcement, or legal advisers where required by law or necessary to protect legal rights.

9. International transfers

The service relies on cloud providers and technical infrastructure, so information may be stored or processed in Israel, the United States, the European Union, the United Kingdom, or other countries.

Where the GDPR or similar laws apply, we rely on appropriate transfer mechanisms such as adequacy decisions, Standard Contractual Clauses, data-processing agreements, security measures, and access restrictions. Transfers from Israel are handled according to applicable Israeli privacy rules and for the purposes described in this policy.

10. Retention and deletion

You can request deletion of your account and related information by contacting ayala8064@gmail.com. Deletion may be limited where information is needed for security, fraud prevention, billing, legal compliance, legal proceedings, or protection of rights.

  • Account information is kept while the account is active or as long as needed for service operation, security, support, billing, misuse prevention, or legal compliance.
  • App sessions are kept until they are revoked, deleted, or cleaned up through periodic retention processes. Raw app tokens are not stored after token_hash is created.
  • Bug reports and screenshots are kept while needed to investigate the issue, document the product, maintain security, or protect legal rights.
  • The encrypted backup keeps a bounded history: up to 20 complete state snapshots and up to 3 repository snapshots per project. You can delete the backup from the desktop app at any time, and resetting your secrets vault deletes it, since it can no longer be decrypted. Backups made with the earlier administrator-only Cloud Vault are deleted once they have been moved into the secrets vault. Deleted encrypted objects may remain briefly in provider backups before routine expiry.
  • Deleted information may remain for a limited time in backups or logs before routine deletion, unless retention is legally required.

11. Security

We use administrative, technical, and organizational measures intended to protect personal information, including Supabase RLS, private Storage, access permissions, hashed app tokens and one-time grants, separated admin permissions, and authentication controls.

The encrypted backup uses client-side AES-256-GCM encryption with a key derived (HKDF-SHA-256) from your secrets vault's randomly generated master key, which is itself wrapped by your secrets password (PBKDF2-HMAC-SHA-512) and by a separate recovery key. Reading or writing backup data requires an open secrets-vault session with a signed proof for every request, and deleting the backup requires your secrets password again. Vibe Editor and Supabase do not possess the secret needed to decrypt the backup.

No system is completely secure. Do not send secrets, access tokens, passwords, private keys, private source code, or sensitive personal information through bug reports or screenshots.

12. Your rights by region

To exercise rights, contact ayala8064@gmail.com. We will respond within the time required by applicable law. If a request is complex, infeasible, or subject to legal exceptions, we will explain that where required. We will not discriminate against you for exercising legally protected privacy rights.

  • Israel: under the Protection of Privacy Law, 5741-1981, data-security regulations, and Amendment 13 where applicable, you may have rights to inspect personal information, request correction or deletion of information that is inaccurate, incomplete, unclear, or outdated, and receive clear information about collection purposes, recipients, and whether providing information is legally required.
  • European Union, EEA, and United Kingdom: where the GDPR or UK GDPR applies, you may have rights of access, rectification, erasure, restriction, portability, objection, withdrawal of consent, information about international transfers, and the right to complain to a supervisory authority.
  • United States: state privacy laws such as the CCPA/CPRA in California and similar laws may provide rights to know, access, correct, delete, receive information about data categories, limit use or disclosure of sensitive personal information, and opt out of sale, sharing for cross-context behavioral advertising, targeted advertising, or significant profiling. Vibe Editor does not sell personal information and does not use it for targeted advertising.

13. Children and minors

The service is not intended for children under 13 and is not intended for anyone who cannot provide valid consent under applicable law without parent or guardian approval.

If we learn that information was collected from a child contrary to this policy or applicable law, we will take steps to delete it or obtain appropriate consent where required.

14. Changes to this policy

We may update this policy from time to time to reflect product, provider, security, or legal changes. If we make a material change, we will update the effective date and, where appropriate, provide notice on the website, in the application, or by email.

15. Contact

For privacy questions, requests, or complaints, contact ayala8064@gmail.com. You may also contact the Israel Privacy Protection Authority or another competent supervisory authority where applicable law gives you that right.

16. Google access in chat and published sites

Google connectors in the ordinary connector vault remain end-to-end encrypted. When the vault is unlocked or a supported Google account is connected, the browser synchronizes its refresh token to our server. The server keeps a separate encrypted copy available to published sites owned by the same user, including while the desktop app is closed. The service can decrypt this copy; the ordinary vault's end-to-end encryption claim does not apply to it. Apps Script is excluded from this synchronization.

Each site receives a separate server-side key, installed as a Cloudflare Worker secret or an encrypted Vercel environment variable rather than in browser code. The service verifies the key and account ownership before calling Google. Compatible chat tools require an authenticated account, signed proof of an unlocked vault, and explicit selection of the connected Google account. Supported operations include sharing accessible Drive files with specified recipients. Disconnecting the Google connector prevents further use. Google processes requests under its own terms and the account's granted permissions.