Privacy Policy

Effective date: June 9, 2026

VibeKit ("we", "us", "our") operates the VibeKit platform — the website at vibekit.bot, the Telegram bot, the iOS application, the web dashboard at app.vibekit.bot, and published npm packages (collectively, the "Service"). This policy explains what data we collect, how we use it, who we share it with, and your rights.

By using the Service you also agree to our Terms of Service.

1. Information We Collect

2. How We Use Your Data

3. Data Storage & Security

Data is stored on AWS infrastructure in us-east-2 (Ohio). All connections to the Service use HTTPS/TLS.

BYOK credentials and environment variables are encrypted at rest with AES-256-GCM. Each user's data is encrypted with a per-user key derived from a master key via HKDF-SHA256 with the account UUID as salt — master-key compromise alone does not expose any single user's data. Plaintext credentials are only held in process memory at request time and are never written to logs, telemetry, analytics, or backups. We redact known secret formats (sk-, sk-ant-, sk-proj-, GitHub tokens, JWTs, and others) from any text that gets logged.

Each app runs in its own AWS Fargate task with an isolated workspace. Per-tenant shell access is sandboxed by a bwrap wrapper at the OS layer. Database access is gated by Postgres row-level security so users only read and write their own rows.

4. Third-Party AI Services

VibeKit routes your AI requests to third-party providers. The routing depends on whether you've configured BYOK:

4a. Two routing paths

4b. What data is sent to AI providers

We do not send your email, payment information, password, BYOK credentials, or any other account secret to AI providers.

4c. Who data may be sent to

Anthropic and OpenAI do not train models on API data, on either the BYOK or platform-credit route. OpenRouter, the aggregator we use for the non-BYOK route, may use prompts and responses to improve their product under the data-discount setting we've enabled (see Section 4a above); they have stated this is not used for model training. Data sent to AI providers is never used for advertising.

4d. Your consent

Before first use of the AI agent, you're asked to acknowledge data sharing with third-party AI services. You can withdraw consent by removing your BYOK credentials and discontinuing use of the agent.

4e. Other third-party services

5. Cookies and Analytics

The marketing pages on vibekit.bot use Google Analytics (GA4) to measure aggregate traffic. The dashboard and iOS app do not use third-party analytics. We use a small number of first-party cookies for session management and one (vk_referral) to attribute referral signups.

Google signals (Advertising Features). Our GA4 property has Google signals enabled on the marketing pages. For visitors who are signed in to a Google account and have consented to ads personalization, Google may associate their visit with Google's own account information — which can include location, search history, YouTube history, and data from sites that partner with Google — to give us cross-device and aggregate demographic/interest reporting. We only ever see this in aggregate (e.g. age brackets, gender, interest categories); we never receive data that identifies an individual, and we do not use it for ad targeting. We adhere to Google's Advertising Features policy. You can review or turn off this association at any time via Google Ads Settings and My Activity, or opt out of Google Analytics entirely with the Google Analytics opt-out browser add-on.

6. Data Retention

Agent transcripts and app data are retained while your account is active. You can delete an app (and its transcripts, files, env vars, and Fargate task) from the dashboard at any time. Account deletion removes all associated data within 30 days, except aggregated billing records we are required to retain for tax or accounting purposes. Audit-log entries (security events) are retained for 12 months.

7. Your Rights

Depending on where you live, you may have rights under the GDPR (EEA/UK), CCPA/CPRA (California), or similar laws. You can:

8. International Transfers

VibeKit infrastructure is in the United States (AWS us-east-2). If you access the Service from outside the US, your data will be transferred to and processed in the US. We rely on AWS's GDPR-compliant data-processing terms and Standard Contractual Clauses where applicable.

9. Children's Privacy

The Service is not intended for users under 13. We do not knowingly collect data from children under 13. If you believe we have collected data from a child, contact [email protected] and we will delete it.

10. Changes

We may update this policy. Material changes will be communicated through the platform with at least 30 days' notice for paying users where reasonable.

11. Contact

Privacy questions: [email protected]. General support: [email protected].

Terms of Service · ← Back to VibeKit