Privacy Policy

Effective Date: August 7, 2026

Version 3.1

1. Introduction

Welcome to Vibe Decode ("we," "our," or "us"), developed and operated by Terrance Gomez E, an individual developer. We respect your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, store, share, and safeguard your information when you use our mobile application ("the App").

This policy applies to all users of Vibe Decode, regardless of location. By using the App, you agree to the practices described in this policy. If you do not agree, please do not use the App.

2. Data We Collect

2.1 Information You Provide Directly

Data Type	Details
Account Information	Name, email address, profile photo (optional)
Date of Birth	Your birth date, used for age verification and, if you choose, to derive optional personalization context
Time of Birth	Your birth time (optional), used to refine the optional personalization context you can add
Messages & Situations	Messages you paste or type, and situations you describe in your own words, for decode analysis
Photos & Screenshots	Images you upload for message decoding via screenshot analysis
Chat Messages	Conversations with the AI chat feature
Connection Data	Names, optional zodiac signs, and relationship types of people in your galaxy
Content Reports	Reports you submit about inappropriate or harmful content

2.2 Information Collected Automatically

Data Type	Details
Device Identifiers	Device type, model, operating system, unique device identifiers
Usage Analytics	App interactions, features used, decode frequency, session duration
Crash & Performance Data	Error logs, crash reports, performance metrics
Subscription & Purchase History	Subscription plan, billing status, transaction identifiers (processed through Apple/Google)
Push Notification Tokens	Device tokens for delivering push notifications (with your consent)
Moderation Logs	Records of content moderation actions taken on reported content

3. How We Use Your Data

Purpose	Data Used	Legal Basis (GDPR)
Provide decode analysis and personalized insights	Messages, photos, birth details, connection data	Contract performance
Personalize your experience	Birth details, usage analytics, connection data	Contract performance
AI-powered content generation	Messages, birth details, chat history, relationship context	Explicit consent
Process subscriptions and payments	Purchase history, subscription status	Contract performance
Send push notifications	Push notification tokens, preferences	Consent
Error tracking and app improvement	Crash data, performance metrics, device info	Legitimate interest
Usage analytics and product improvement	Usage analytics, device identifiers	Legitimate interest
Content moderation and safety	Content reports, moderation logs	Legitimate interest
Respond to support requests	Account information, relevant usage data	Contract performance

4. How We Use AI

Vibe Decode uses OpenAI's API (a third-party AI service) to power our core AI features: message decoding, situation decoding, the AI chat feature, and deep analysis.

4.1 What Data Is Sent to OpenAI

When you use AI-powered features, the following data may be transmitted to OpenAI for processing:

Message Text: The text messages you paste or type for decode analysis
Situation Descriptions: Accounts of a relationship situation you write in your own words for decode analysis
Screenshots: Text extracted from images you upload for analysis
Birth Details: Date, optional birth time, and the zodiac-sign context you optionally provide to personalize analyses and content
Relationship Context: Relationship type and relevant context about connections
Chat Messages: Your conversations with the AI chat feature

4.2 How AI Generates Content

AI processes the data you provide to generate decode analyses, chat responses, and personalized content. The AI uses the optional personal context you provide (such as birth details) and your relationship context to tailor its responses.

Important:

All decodes, chat responses, and analyses are for entertainment and personal reflection only. They should not be considered professional relationship advice, therapy, or counseling.

4.3 AI Consent

AI data processing requires your explicit consent, which is requested before your first use of any AI-powered feature. You can revoke consent at any time through Settings > Data & Privacy. Revoking consent will disable AI-powered features but will not affect other App functionality.

4.4 Image-Based Data Processing (Screenshots)

When you use the screenshot decode feature, you may upload chat screenshots that contain personal information belonging to third parties, including:

Names and usernames of the other person in the conversation
Profile photos visible in the messaging app interface
Message content written by the other person
Phone numbers (in SMS or contact-based messaging apps)

How screenshot data is processed:

Screenshots are sent to OpenAI's Vision API for text extraction and analysis
Only the extracted text content is used for decode analysis — profile photos and visual elements are not stored
Our AI is instructed not to reproduce personal names, phone numbers, or other identifying information in its analysis output
An additional post-processing step redacts any phone numbers or email addresses from the analysis results
Uploaded screenshot images are automatically deleted within 1 hour of processing
The extracted conversation text and the analysis output (with PII redacted from the analysis) are stored as part of your decode history until you delete them or your account

By uploading screenshots, you acknowledge that you are sharing another person's communications with our AI service. We recommend informing the other party when sharing their messages for analysis.

4.5 Third-Party AI Processing

Data sent to OpenAI is processed according to OpenAI's privacy policy. Key details about OpenAI's data handling:

Retention: OpenAI may retain API data for up to 30 days for abuse monitoring and security purposes, after which it is deleted
Training: Your data is not used to train AI models by default under OpenAI's current API data usage policy
Storage: We configure our API calls to minimize data retention (store: false parameter)

We do not control and are not responsible for OpenAI's data handling practices beyond our contractual agreements with them. OpenAI's retention policies are subject to change; for the most current information, please review OpenAI's privacy policy.

5. Third-Party Services

We use the following third-party services to operate the App. Each service receives only the data necessary for its function. We require that all third-party service providers maintain data protection standards equivalent to those described in this policy.

Service	Purpose	Data Shared	Privacy Policy
Supabase	Backend database, authentication, storage	All user profile data, auth tokens, content, files	supabase.com/privacy
OpenAI	AI-powered content generation	Messages, birth details, chat history, relationship context	openai.com/privacy
Apple App Store & Google Play	Subscription billing & receipt validation	Purchase receipts, subscription status	apple.com/legal/privacy
Sentry	Error tracking & crash reporting	Crash logs, performance data, device & diagnostic info (email and IP address removed)	sentry.io/privacy
Expo	App infrastructure & push notifications	Push notification tokens, device info	expo.dev/privacy
Mixpanel	Analytics & usage metrics	Usage events, device identifiers, session data	mixpanel.com/legal/privacy-policy
Brevo	Transactional email delivery (e.g. sign-in codes and account emails)	Email address; content of system emails	brevo.com/legal/privacypolicy

In-app feedback and bug reports you submit are stored in our own Supabase database (covered by the Supabase entry above) and are not sent to any external feedback vendor.

We do not sell your personal data to any third party. Data is shared with these services solely for the purposes described above.

6. Data Retention

We retain your data for the following periods:

Data Type	Retention Period
Account information (name, email)	Until account deletion
Birth details (date, time)	Until account deletion
Decoded messages	Auto-purged by plan: Free after 7 days, Plus after 90 days, Pro until account deletion (or manual clearing on any plan)
Message screenshots	Deleted within ~1 hour of processing, only the extracted text is retained
Chat messages (AI chat feature)	Until account deletion or manual clearing by user
Connection data (galaxy)	Until account deletion or manual removal by user
Content reports	90 days after resolution, then anonymized
Moderation logs	12 months, then deleted
Subscription & purchase history	Your in-app purchase records are deleted when you delete your account. Transaction records held by Apple/Google and in our accounting records are retained as required by law (typically up to 7 years for financial/tax purposes)
Usage analytics	24 months, then aggregated/anonymized
Crash & performance data	90 days
Device identifiers	Until account deletion
Push notification tokens	Until account deletion or token expiry

7. Data Storage and Security

All data is stored securely on Supabase (hosted on AWS infrastructure)
Data is encrypted in transit using TLS/SSL
Data at rest is encrypted using industry-standard AES-256 encryption
We implement industry-standard security measures including access controls and monitoring
Access to user data is restricted to authorized personnel on a need-to-know basis

8. International Data Transfers

Your data may be transferred to and processed in countries other than your country of residence, including the United States, where our third-party service providers operate. We ensure appropriate safeguards are in place for such transfers, including Standard Contractual Clauses (SCCs) where required by GDPR.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

9.1 Rights for All Users

Access: Request a copy of your personal data (available via Settings > Data & Privacy > Export My Data)
Correction: Update or correct your personal information through the App
Deletion: Delete your account and all associated data (Settings > Data & Privacy > Delete Account)
Withdraw Consent: Revoke AI data processing consent at any time (Settings > Data & Privacy)
Opt-out: Unsubscribe from push notifications and marketing communications

9.2 Additional Rights for EEA/UK Users (GDPR Articles 15-22)

Right of Access (Art. 15): Obtain confirmation of processing and a copy of your data
Right to Rectification (Art. 16): Correct inaccurate personal data
Right to Erasure (Art. 17): Request deletion of your personal data ("right to be forgotten")
Right to Restrict Processing (Art. 18): Request limitation of processing in certain circumstances
Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format
Right to Object (Art. 21): Object to processing based on legitimate interests
Right Not to be Subject to Automated Decision-Making (Art. 22): AI-generated content is for entertainment only and does not constitute automated decision-making with legal or significant effects
Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection authority (supervisory authority)

Data Controller: Terrance Gomez E (individual developer of Vibe Decode)
Privacy & Data Requests: support@vibedecode.app

9.3 Additional Rights for California Residents (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

Right to Know: Request what personal information we collect, use, share, or sell, including the categories of personal information, the sources, the business purposes, and the categories of third parties with whom we share it
Right to Delete: Request deletion of your personal information, subject to certain exceptions
Right to Opt-Out of Sale/Sharing: We do not sell or share your personal information as those terms are defined by CCPA/CPRA, so there is nothing to opt out of. We honor the Global Privacy Control (GPC) signal on our website regardless, and you may confirm your preference any time via our Do Not Sell or Share page or by emailing support@vibedecode.app
Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights, you will receive equal service and pricing
Right to Correct: Request correction of inaccurate personal information we hold about you
Right to Limit Use of Sensitive Data: You may limit the use of sensitive personal information to purposes necessary for providing our services

9.4 Categories of Personal Information (CCPA Disclosure)

The following table lists the categories of personal information we collect, as defined by CCPA, and whether they are sold or shared with third parties:

Category	Examples	Sold/Shared
Identifiers	Name, email address, device identifiers	Processed by our analytics service provider (Mixpanel) on our behalf, not sold or shared
Personal Records	Name, email, date of birth	Not sold or shared
Internet/Network Activity	App usage data, session data, features used	Processed by our analytics service provider (Mixpanel) on our behalf, not sold or shared
Geolocation	Not collected. We do not collect device location or any other geolocation data	Not applicable
Inferences	Decode analyses, interest and pattern insights	Not sold or shared
Sensitive Personal Information	Messages shared for decoding (may reveal personal beliefs/relationships)	Shared with AI provider (OpenAI) with separate consent

9.5 How to Exercise Your "Do Not Sell" Right

On the Website: Visit our Do Not Sell page, or use a browser that sends a Global Privacy Control (GPC) signal, we honor it automatically
By Email: Send a request to support@vibedecode.app

Our analytics and crash-reporting providers (Mixpanel, Sentry) act as our service providers, they process data only on our behalf, never for their own purposes, which is not a "sale" or "share" under CCPA. AI processing of your messages (by OpenAI) is controlled separately through the AI consent you grant in the app, which you can withdraw any time in Settings > Data & Privacy.

To exercise any other CCPA rights, contact us at support@vibedecode.app or use the in-app controls in Settings > Data & Privacy. We will respond within 45 days as required by law.

10. Children's Privacy

Vibe Decode is not intended for users under 18 years of age. We do not knowingly collect, use, or share personal information from anyone under 18.

We implement age verification during account creation. If we discover that a user under 18 has created an account or provided personal data, we will promptly delete the account and all associated data.

If you are a parent or guardian and believe your child under 18 has provided us with personal data, please contact us at support@vibedecode.app so we can take appropriate action.

11. Account Deletion

You can delete your account at any time through Settings > Data & Privacy > Delete Account. You may also request account deletion by emailing support@vibedecode.app or visiting vibedecode.app/delete-account. When you delete your account, the following occurs:

Immediately deleted: Profile information (name, email, profile photo), birth details (date, time), all connections (galaxy data), all decoded messages and screenshots, all AI chat history, push notification tokens, AI consent records
Deleted within 30 days: Usage analytics and device identifiers. When you delete your account we send an erasure request to our analytics provider (Mixpanel) so your data is deleted within 30 days. Crash-diagnostic data (Sentry) has your email address and IP address removed before it is saved and is associated only with a pseudonymous identifier; it expires automatically on the provider's retention schedule.
Retained as required by law: Financial and transaction records required for tax, accounting, or fraud-prevention compliance (typically up to 7 years). These are held by the app stores (Apple/Google) and in our accounting records; your in-app purchase records are deleted with your account. Content moderation records related to safety investigations are also retained.
Anonymized: Aggregated, non-identifiable analytics data may be retained for product improvement

Account deletion is permanent and irreversible. You will lose access to your subscription (active subscriptions should be cancelled separately through Apple App Store or Google Play Store).

12. Tracking Technologies

We use device identifiers and analytics SDKs (Mixpanel) to understand how users interact with the App. We do not use traditional browser cookies. We do not engage in cross-app tracking or share your data with advertising networks. On iOS, we do not use Apple's App Tracking Transparency framework because we do not track users across other companies' apps or websites. Our analytics are used solely for internal product improvement and are not linked with data from other companies' apps or websites for advertising purposes.

Our analytics provider (Mixpanel) acts as our service provider. If your browser sends a Global Privacy Control (GPC) signal on our website, we honor it automatically.

13. Changes to This Policy

We may update this privacy policy from time to time. When we make material changes, we will:

Update the "Effective Date" and version number at the top of this policy
Notify you through the App via an in-app notification
For significant changes, request your renewed consent where required by law

Continued use of the App after changes take effect constitutes acceptance of the revised policy.

14. Contact Us

If you have questions, concerns, or requests regarding this privacy policy or your personal data:

Privacy inquiries: support@vibedecode.app
General support: https://vibedecode.app/support

We will respond to all privacy-related requests within 30 days (or sooner as required by applicable law).