Privacy Policy
Effective Date: October 10, 2026
Version 3.2
Version 3.2, effective October 10, 2026. Replaces version 3.1 of August 7, 2026.
The current version of this policy is always the one published at https://vibedecode.app/privacy.
1. Introduction
Welcome to Vibe Decode ("we," "our," or "us"), developed and operated by Terrance Gomez E, an individual developer based in India. This privacy policy explains how we collect, use, store, share, and protect your information when you use our mobile application ("the App") and our website, vibedecode.app ("the Website").
This policy applies to all users of Vibe Decode, regardless of location. By using the App, you agree to the practices described in this policy. If you do not agree, please do not use the App.
2. Data We Collect
2.1 Information You Provide Directly
| Data Type | Details |
|---|---|
| Account Information | Email address, name (if you provide it or allow Apple or Google to share it), and an optional profile photo |
| Date of Birth | Required when you create an account, to check that you are 18 or older. The App also calculates your sun and moon zodiac signs from it and stores the date and the signs with your profile |
| Time of Birth | Optional. If you add it in Settings, it is used to refine the calculated signs |
| Onboarding Answers | Answers you give while setting up the App, for example your goal and how you feel about the situation |
| Messages & Situations | Messages you paste or type, and situations you describe in your own words, for analysis |
| Photos & Screenshots | Conversation screenshots you upload for analysis |
| Chat Messages | Your conversations with the AI chat feature |
| People You Save | For each person you save: a name and relationship type (for example crush, friend, coworker, or family member). Optional: a photo you choose, and a birth date, birth time, or zodiac sign you add or pick for them. If you mention a saved person's birthday or sign in the AI chat, it may be saved to that person |
| Content Reports | Reports you submit about inappropriate or harmful content |
| Feedback & Bug Reports | Feedback, bug reports, and any attachments you send from the App |
2.2 Information Collected Automatically
| Data Type | Details |
|---|---|
| Device Information | Device type, model, operating system, app version, and identifiers |
| Usage Analytics | App interactions and features used, linked to your account ID (see Section 12) |
| Crash & Performance Data | Error logs, crash reports, performance metrics |
| Subscription & Purchase History | Subscription plan, billing status, transaction identifiers (processed through Apple/Google) |
| Push Notification Tokens | Device tokens for delivering push notifications (with your permission), with your device name and time zone |
| Moderation Logs | Records of content moderation actions taken on reported content |
2.3 Information About Other People
Messages, screenshots, and situations you add usually contain information about other people, and the details of people you save are about them. We use this information only to provide the features you ask for. Please add only information you have a right to share. If you believe someone has shared your information through the App and you want it deleted, email support@vibedecode.app.
2.4 Clipboard
When you open the screen where you add a message, the App may check your clipboard on your device to offer copied text as a suggestion. Nothing from your clipboard is sent or stored unless you choose to paste it.
3. How We Use Your Data
| Purpose | Data Used | Legal Basis (GDPR) |
|---|---|---|
| Provide analyses of messages and situations, Deep Analysis, and AI chat | Messages, situations, screenshots, chat history, details of people you save, profile details (including date of birth and calculated signs) | Contract performance; explicit consent for AI processing |
| Check that you are 18 or older | Date of birth | Contract performance |
| Personalize results and content | Profile details (including calculated signs), onboarding answers, details of people you save | Contract performance |
| Process subscriptions and payments | Purchase history, subscription status | Contract performance |
| Send push notifications | Push notification tokens, preferences | Consent |
| Error tracking and app improvement | Crash data, performance metrics, device information | Legitimate interest |
| Usage analytics and product improvement | Usage analytics, device information, onboarding answers, calculated signs | Legitimate interest (you can turn it off; see Section 12) |
| Content moderation and safety | Content reports, moderation logs | Legitimate interest |
| Respond to support requests and fix problems | Account information, feedback and bug reports, relevant usage data | Contract performance |
4. How We Use AI
Vibe Decode uses OpenAI's API (a third-party AI service) to power its AI features: message analysis, situation analysis, Deep Analysis, the AI chat feature, screenshot text extraction, and moderation of AI output.
4.1 What Data Is Sent to OpenAI
When you use AI-powered features, the following data may be sent to OpenAI for processing:
- Message Text: The messages you paste or type for analysis
- Situation Descriptions: The situations you describe in your own words
- Screenshots: The images you upload, so the conversation text can be extracted, and the extracted text
- Relationship Context: The name and relationship type of the person, and earlier results for that person
- Profile Context: Zodiac signs calculated from your date of birth, and birth details you add for people you save, which can be used as background context in some results
- Chat Messages: Your conversations with the AI chat feature
4.2 How AI Generates Content
AI processes the data you provide to generate analyses and chat responses. AI-generated results can be wrong. They are for personal reflection and are not professional, psychological, medical, legal, or financial advice.
4.3 AI Consent
AI data processing requires your explicit consent, which is requested before your first use of any AI-powered feature. You can revoke consent at any time in Settings > Data & Privacy. Revoking consent disables AI-powered features but does not affect other App functionality.
4.4 Screenshots
Conversation screenshots you upload may contain personal information belonging to other people, including:
- Names and usernames of the other person in the conversation
- Profile photos visible in the messaging app interface
- Message content written by the other person
- Phone numbers (in SMS or contact-based messaging apps)
How screenshots are processed:
- Screenshots are sent to OpenAI for text extraction and analysis
- Only the extracted text is used for analysis; profile photos and other visual elements are not stored
- Our AI is instructed not to reproduce personal names, phone numbers, or other identifying information in its output
- An additional step removes phone numbers and email addresses from the analysis results
- Uploaded screenshot images are automatically deleted within 1 hour of processing
- The extracted conversation text and the analysis are stored with your results, as described in Section 6
By uploading screenshots, you acknowledge that you are sharing another person's communications with our AI service. We recommend telling the other person when you share their messages for analysis.
4.5 Third-Party AI Processing
Data sent to OpenAI is processed according to OpenAI's privacy policy. Key details about OpenAI's data handling:
- Retention: OpenAI may retain API data for up to 30 days for abuse monitoring and security purposes, after which it is deleted
- Training: Your data is not used to train AI models by default under OpenAI's current API data usage policy
- Storage: We configure our API calls to minimize data retention (store: false parameter)
We do not control and are not responsible for OpenAI's data handling practices beyond our contractual agreements with them. OpenAI's retention policies may change; for current information, please review OpenAI's privacy policy.
5. Third-Party Services
We use the following third-party services to operate the App and the Website. Each service receives only the data necessary for its function. We require that all third-party service providers maintain data protection standards equivalent to those described in this policy.
| Service | Purpose | Data Shared | Privacy Policy |
|---|---|---|---|
| Supabase | Backend database, authentication, file storage | Account and profile data, content, files | supabase.com/privacy |
| OpenAI | AI analysis, chat, screenshot text extraction, moderation | The data listed in Section 4.1 | openai.com/privacy |
| Apple | Sign in with Apple, App Store billing and receipt validation, push notification delivery | Sign-in identifiers and email (which may be an Apple private relay address), purchase receipts, subscription status, push tokens | apple.com/legal/privacy |
| Google Sign-In; Google Play billing on Android | Sign-in identifiers, email address, name if you allow it, purchase receipts | policies.google.com/privacy | |
| Sentry | Error tracking & crash reporting | Crash logs, performance data, device and diagnostic information, account ID (email and IP address removed) | sentry.io/privacy |
| Expo | App updates and push notification delivery | Push notification tokens, device information | expo.dev/privacy |
| Mixpanel | In-app usage analytics | Usage events linked to your account ID, device information, onboarding answers, calculated signs | mixpanel.com/legal/privacy-policy |
| Brevo | Transactional email (for example sign-in codes and account deletion confirmations) | Email address; content of system emails | brevo.com/legal/privacypolicy |
| Vercel | Website hosting and website analytics | IP address and request data needed to deliver pages; see Section 12 | vercel.com/legal/privacy-policy |
Feedback and bug reports you submit in the App are stored in our own Supabase database (covered by the Supabase entry above) and are not sent to an external feedback service.
We do not sell your personal data. Data is disclosed to these services only for the purposes described above.
6. Data Retention
We retain your data for the following periods:
| Data Type | Retention Period |
|---|---|
| Account information, profile photo | Until account deletion |
| Date of birth, time of birth, calculated signs | Until account deletion |
| Onboarding answers | Until account deletion |
| Message and situation results (including extracted screenshot text) | Deleted automatically by plan: Free after 7 days, Plus after 90 days, Pro until account deletion. You can also delete results yourself on any plan |
| Deep Analysis results | Deleted together with the result they belong to |
| Screenshot images | Deleted within about 1 hour of processing; only the extracted text is kept |
| Chat messages (AI chat feature) | Until account deletion, or until you delete them |
| People you save, including their photos and birth details | Until account deletion, or until you remove them |
| Feedback and bug reports | Until we no longer need them to fix the problem. Attachments are not removed automatically when you delete your account; email us to have them deleted |
| Content reports | 90 days after resolution, then anonymized |
| Moderation logs | 12 months, then deleted |
| Subscription & purchase history | Your in-app purchase records are deleted when you delete your account. Transaction records held by Apple/Google and in our accounting records are retained as required by law (typically up to 7 years for financial and tax purposes) |
| Usage analytics | 24 months, then aggregated or anonymized |
| Crash & performance data | 90 days |
| Push notification tokens | Until account deletion or token expiry |
7. Data Storage and Security
- App data is stored on Supabase (hosted on AWS infrastructure)
- Data is encrypted in transit using TLS
- Data at rest is encrypted using industry-standard AES-256 encryption
- Access to user data is restricted to the developer, on a need-to-know basis
- Photos of people you save are stored privately. Your own profile photo, if you add one, is stored at a web address that is not published anywhere but can be opened by anyone who has the address
8. International Data Transfers
Your data may be transferred to and processed in countries other than your country of residence, including the United States, where our third-party service providers operate. We rely on appropriate safeguards for such transfers, including Standard Contractual Clauses (SCCs) where required by GDPR.
9. Your Rights
Depending on your location, you may have the following rights regarding your personal data:
9.1 Rights for All Users
- Access: Request a copy of your personal data (available in Settings > Data & Privacy > Export My Data)
- Correction: Update or correct your personal information in the App
- Deletion: Delete your account and its data (Settings > Data & Privacy > Delete Account); see Section 11 for what is deleted and what is kept
- Withdraw Consent: Revoke AI data processing consent at any time (Settings > Data & Privacy)
- Opt-out: Turn off in-app analytics (Section 12) and push notifications
9.2 Additional Rights for EEA/UK Users (GDPR Articles 15-22)
- Right of Access (Art. 15): Obtain confirmation of processing and a copy of your data
- Right to Rectification (Art. 16): Correct inaccurate personal data
- Right to Erasure (Art. 17): Request deletion of your personal data
- Right to Restrict Processing (Art. 18): Request limitation of processing in certain circumstances
- Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format
- Right to Object (Art. 21): Object to processing based on legitimate interests
- Automated Decision-Making (Art. 22): AI-generated results are suggestions for your own reflection. They do not make decisions about you with legal or similarly significant effects
- Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection authority
Data Controller and Grievance Officer: Terrance Gomez E, individual developer of Vibe Decode, India
Privacy & Data Requests and Grievances: support@vibedecode.app. We acknowledge requests promptly and resolve them within 30 days.
9.3 Additional Rights for California Residents (CCPA/CPRA)
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):
- Right to Know: Request what personal information we collect, use, and disclose, including the categories of personal information, the sources, the business purposes, and the categories of recipients
- Right to Delete: Request deletion of your personal information, subject to certain exceptions
- Right to Opt-Out of Sale/Sharing: We do not sell or share your personal information as those terms are defined by CCPA/CPRA. You can still turn off in-app analytics at any time (Section 12), confirm your preference on our Do Not Sell or Share page, or email support@vibedecode.app
- Right to Non-Discrimination: We will not discriminate against you for exercising any of your rights; you will receive equal service and pricing
- Right to Correct: Request correction of inaccurate personal information we hold about you
- Right to Limit Use of Sensitive Data: You may limit the use of sensitive personal information to purposes necessary for providing our services
9.4 Categories of Personal Information (CCPA Disclosure)
The following table lists the categories of personal information we collect, as defined by CCPA, and how they are disclosed:
| Category | Examples | Disclosure |
|---|---|---|
| Identifiers | Name, email address, account ID, device identifiers | Disclosed to our service providers (for example Supabase, Mixpanel) to operate the App; not sold or shared |
| Personal Records | Name, email, date of birth | Not sold or shared |
| Internet/Network Activity | App usage data, features used | Disclosed to our analytics service provider (Mixpanel); not sold or shared |
| Geolocation | The App does not collect device location. Our website analytics record an approximate location (country, region, city) derived from your IP address | Not sold or shared |
| Inferences | Analysis results, interest levels for messages, zodiac signs calculated from birth dates | Not sold or shared |
| Sensitive Personal Information | Contents of messages you add for analysis (which may reveal personal matters) | Disclosed to our AI service provider (OpenAI) to provide the feature, with your consent; not sold or shared |
9.5 Do Not Sell or Share
- In the App: Turn off Share usage analytics in Settings > Data & Privacy. The App treats this as your Do Not Sell or Share request
- On the Website: If your browser sends a Global Privacy Control (GPC) signal, the Website does not load its analytics
- By Email: Send a request to support@vibedecode.app
Our analytics and crash-reporting providers (Mixpanel, Sentry) act as our service providers. They process data only on our behalf, which is not a "sale" or "share" under CCPA. AI processing of your messages by OpenAI is controlled separately through the AI consent you grant in the App, which you can withdraw at any time in Settings > Data & Privacy.
To exercise any other CCPA rights, contact us at support@vibedecode.app or use the in-app controls in Settings > Data & Privacy. We will respond within 45 days as required by law.
10. Children's Privacy
Vibe Decode is for adults 18 and over. It is not intended for anyone under 18, and we do not knowingly collect, use, or share personal information from anyone under 18.
The App includes an age check when you create an account: you enter your date of birth, and the App does not let you continue if you are under 18. If we learn that a user under 18 has created an account or provided personal data, we will promptly delete the account and its data.
If you are a parent or guardian and believe your child under 18 has provided us with personal data, please contact us at support@vibedecode.app so we can take appropriate action.
11. Account Deletion
You can delete your account at any time in Settings > Data & Privacy > Delete Account. You may also request account deletion by emailing support@vibedecode.app or visiting vibedecode.app/delete-account. When you delete your account, the following happens:
- Deleted immediately: Your account and profile (name, email, profile photo, date of birth, time of birth, calculated signs, onboarding answers), the people you save (including their photos and birth details), all message and situation results and Deep Analysis results, screenshots and extracted text, AI chat history, push notification tokens, and AI consent records
- Deleted within 30 days: Usage analytics. When you delete your account we send an erasure request to our analytics provider (Mixpanel) so your data is deleted within 30 days. Crash-diagnostic data (Sentry) has your email address and IP address removed before it is saved and expires on the provider's retention schedule
- Kept until you ask: Attachments to feedback or bug reports you sent. Email support@vibedecode.app to have them deleted
- Retained as required by law: Financial and transaction records required for tax, accounting, or fraud-prevention compliance (typically up to 7 years). These are held by the app stores (Apple/Google) and in our accounting records; your in-app purchase records are deleted with your account. Content moderation records related to safety investigations are also retained
- Anonymized: Aggregated, non-identifiable analytics data may be retained for product improvement
Account deletion is permanent and irreversible. Deleting your account does not cancel a subscription; cancel it separately through the Apple App Store or Google Play.
12. Analytics and Tracking
In the App: We use Mixpanel to understand how the App is used. Analytics are on by default and linked to your account ID. Events can include the screens and features you use, your plan, your onboarding answers, and your calculated signs. You can turn analytics off at any time with Share usage analytics in Settings > Data & Privacy. We do not track you across other companies' apps or websites, we do not use advertising networks, and we do not use Apple's App Tracking Transparency framework because we do not track users in that sense.
On the Website: The Website is hosted by Vercel, which processes your IP address and request data to deliver pages. Our home page uses Vercel Web Analytics, which sets no cookies. It counts visits using a hash of request data that is discarded within 24 hours, and records the page, referrer, approximate location (country, region, city), browser, operating system, and device type. If your browser sends a Global Privacy Control signal, the Website does not load this analytics script.
Do Not Track: We do not track you across other websites, so we do not change how the Website works when your browser sends a Do Not Track signal. We honor Global Privacy Control as described above.
13. Changes to This Policy
We may update this privacy policy from time to time. When we do, we will update the version number and effective date at the top of this page. For material changes, we will also tell you by email or in the App before the change takes effect, and ask for your consent again where the law requires it. If a copy of this policy shown inside the App differs from this page, this page is the current version.
14. Contact Us
If you have questions, concerns, or requests regarding this privacy policy or your personal data:
- Privacy inquiries and grievances: support@vibedecode.app
- General support: https://vibedecode.app/support
We will respond to all privacy-related requests within 30 days (or sooner where applicable law requires).