Privacy Policy

1. Information we collect

We collect the information needed to provide VibeCheck Hub and keep your account secure.

• Account information. Name, email, and authentication identifiers issued by Microsoft Entra External ID when you sign in.
• Repository content. When you start a scan, we read the files in the repository or upload you provide. We process them to produce findings and do not retain full repository contents after a scan completes.
• Scan findings. Issue descriptions, severity, file paths, and line ranges generated by scanners, along with the status and history you set in the app.
• Usage and device data. Pages visited, actions taken, browser and operating system, IP address, and similar diagnostic information.
• Analytics data. We use Google Analytics to understand how visitors use our public pages and app: pages viewed, approximate location, device and browser type, and how you arrived at our site. Where required by law, analytics cookies are disabled unless you consent.
• Billing information. If you subscribe to a paid plan, our payment processor collects card details on our behalf. We never see or store your full payment card number.

2. How we use information

• To operate VibeCheck Hub: run scans, store findings, render dashboards, and notify you about scan results.
• To secure the service: detect abuse, investigate incidents, and protect users.
• To improve product quality: aggregated, de-identified metrics about scanner performance and feature usage.
• To communicate with you about service updates, security alerts, and (with your consent) product news.

3. Sharing with third parties

We share information only as needed to run the service:

• Microsoft Entra External ID: identity and authentication.
• GitHub: to access repositories you authorize.
• Stripe: payment processing for paid plans.
• Google Analytics: usage measurement for our website and app. Google processes this data on our behalf; see Google's privacy policy.
• Reddit: advertising measurement. If you arrive from a Reddit ad, Reddit's conversion tracking may record that a visit, signup, or purchase occurred. This does not run for visitors in regions that require consent; see Reddit's privacy policy.
• Cloud infrastructure providers: hosting, storage, and observability.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

4. Cookies and similar technologies

We use cookies and similar technologies for two purposes: essential cookies that keep you signed in and secure the service, and analytics cookies (Google Analytics) that help us understand how the site is used. Essential cookies are always active. For visitors in regions that require consent, such as the EEA, UK, and Switzerland, analytics cookies are disabled by default. Google Analytics is configured without advertising features: we do not link it to ad products and Google Signals is turned off. You can also opt out of Google Analytics in any browser with Google's opt-out tool.

5. Data retention

Scan findings are retained for as long as the associated project exists. Repository file contents are processed transiently and not stored beyond the duration of a scan. Account data is retained while your account is active and deleted on request, subject to legal obligations.

6. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information. You can exercise these rights by contacting us at the address below. To opt out of analytics, use the browser tool linked above or contact us.

7. Security

We use industry-standard safeguards including encryption in transit, encryption at rest for findings, scoped access controls, and audit logging. No system is perfectly secure; please report suspected vulnerabilities via our security page.

8. Changes to this policy

We may update this policy from time to time. Material changes will be highlighted in the app or sent to you by email.

9. Contact

Questions about this policy can be sent to support@vibecheckhub.ai.