Privacy Policy

1. Who we are

Well Spent Style, LLC dba Vibecheck AI · 1717 N Street NW, STE 1 · Washington, DC 20036

Contact: help@letsvibecheck.ai

2. What we collect and why

For a detailed breakdown of specific data points, storage locations, and retention periods, see the Data Practices Details section below.

3. What we do NOT collect

• The contents of your source code files (we detect file existence and count patterns from config files, but never read, store, or transmit source code)
• Your terminal commands or output
• Your Git history or commit messages
• Screenshots or screen recordings
• Keystrokes or clipboard data
• Your precise location (no GPS). Note: your IP address may be received by our analytics provider (PostHog) as part of standard web requests, but we do not use it to determine your location
• Payment information (if we add paid features, payment data will be handled by a third-party payment processor — we will never store your full card number)

4. Third-party services

We use third-party service providers to operate Vibecheck. These include:

We may add or change service providers. Adding a new provider within an existing category (e.g., switching analytics tools) is a non-material change — we’ll update the Data Practices Details section but won’t require re-acceptance. Adding a new category of service (e.g., payment processing) is a material change and will follow the 30-day notice process.

Each provider’s privacy policy is linked in the Data Practices Details appendix.

5. Cookies and local storage

• sb-* cookies: Supabase authentication session (essential, no opt-out)
• ph_* cookies: PostHog analytics (opt out via VS Code vibeCoach.analyticsEnabled setting)
• sessionStorage: Temporary OAuth state, cleared after login completes
• localStorage: PostHog anonymous ID, onboarding progress
• ~/.vibecoach/learning-store.json: Lesson progress stored locally on your machine

6. How to opt out

• Extension analytics: Set vibeCoach.analyticsEnabled to false in VS Code settings. Takes effect immediately — no restart needed.
• Website analytics: Use your browser’s Do Not Track setting or a privacy extension (e.g., uBlock Origin) to block PostHog. A dedicated website opt-out toggle is planned for a future release.
• Marketing emails: Click “Unsubscribe” in any email footer, or email help@letsvibecheck.ai.
• Account deletion: Email help@letsvibecheck.ai. We’ll delete your account and associated data within 30 days. Local data in ~/.vibecoach/ must be deleted by you.

7. Your rights

• Access: Request a copy of your data.
• Deletion: Request we delete your data. We respond within 30 days.
• Correction: Request we fix inaccurate data.
• Portability: Request your data in a machine-readable format.
• Opt out: Of analytics and marketing emails at any time.
• Object: To processing based on legitimate interest.
• Non-discrimination: We won’t penalize you for exercising your rights.

To exercise any right, email help@letsvibecheck.ai.

8. Legal basis for processing (GDPR)

• Contract: Delivering the product (account, lessons, setup tools)
• Legitimate interest: Analytics, error tracking, product improvement
• Consent: Marketing emails, optional analytics

9. California residents (CCPA)

• We do not sell your personal information.
• We do not use personal information for cross-context behavioral advertising.
• You have the right to know, delete, and opt out. Contact help@letsvibecheck.ai.

10. International data transfers

All data is stored in the US (Supabase, PostHog, Sentry).

For EU users: transfers rely on Standard Contractual Clauses via our sub-processors.

11. Children’s privacy

Vibecheck is not intended for anyone under 16. We do not knowingly collect data from anyone under 16.

If we discover we have, we’ll delete it promptly. Contact help@letsvibecheck.ai.

12. Legal disclosures and business transfers

We may disclose your data if required by law, subpoena, court order, or government request. We will notify you before disclosing your data unless legally prohibited from doing so.

If Vibecheck is acquired, merged, or sells substantially all its assets, your data may be transferred. We’ll notify you via email before your data becomes subject to a different privacy policy.

13. Data security

• All data encrypted in transit (TLS) and at rest.
• OAuth tokens encrypted with AES-256-GCM; encryption keys never touch our server.
• Auth handoff tokens auto-deleted after 5 minutes.
• Row-level security on all database tables.
• If we discover a data breach, we’ll notify relevant regulatory authorities within 72 hours (as required by GDPR) and affected users without undue delay.

14. Data retention

• Account data: Kept while account is active + 30 days after deletion request.
• Activity events (Supabase): 90-day auto-cleanup.
• Error logs (Sentry): 90 days.
• Analytics events (PostHog): Up to 24 months.
• Consent records: As long as required for legal compliance.
• Auth handoffs: 5 minutes (auto-deleted).

Specific retention periods for each data point are listed in the Data Practices Details appendix.

15. Changes to this policy

We maintain a version history of this policy (tracked in our source code repository).

16. Supplemental notices

We may provide additional privacy notices for specific products or features (e.g., a mobile app, a browser extension marketplace listing, or a team administration panel). These supplemental notices are in addition to — not replacements for — this policy. If a supplemental notice conflicts with this policy, the supplemental notice applies for that specific product or feature.

17. Contact

help@letsvibecheck.ai

Well Spent Style, LLC dba Vibecheck AI · 1717 N Street NW, STE 1 · Washington, DC 20036