PRIVACY NOTICE

What we hold, and who else sees it

Written from what the system actually does, not from a template. Last updated 17 October 2026. This is an interim version while our lawyer reviews the final one.

Who we are. VibeFix is operated by Y.D.A.Dabeian S.A., a company registered in Panama, at Edificio Tornillo, Piso 27, Oficina 27C, Calle Nicanor de Obarrio / Ave 4ta El Tornillo, Bella Vista, Panamá. You can reach us at help@vibe-fixer.com.

1. What we store about you

• Your email address, so you can sign in and we can reach you. New accounts sign in with a code sent by email, or with Google or GitHub. Some older accounts also have a password; it is stored only as a one-way hash, never as the password itself.
• Session records, so signing in keeps you signed in. One cookie, described in section 8.
• Your checks and conversations — the address of the app you asked us to check, and the messages between you and the AI agent, including what you typed.
• The result of each check — when it ran, how long it took, what the AI agent saw, the problems it found, and the screenshots and notes that back them up.
• What the test sign-up left behind — the VibeFix test address the AI agent used, and the emails your app sent to it (for example the confirmation email). They are kept with the result so you can see the evidence.
• Payment status — which pass or plan you bought and whether it is active. Your card details stay with our payment provider.
• Connected AI tools — if you connect one, a record of the connection: which tool, for which account, when. The sign-in tokens that tool holds are stored only as one-way hashes, so we cannot read them back. Disconnecting revokes them (see section 3c).
• Usage and cost — how much the AI model was used for a check. This is aggregate accounting, not a copy of the conversation.

1a. Why we may use it

Running the check, the re-check or the account you asked for, and taking a payment, is the contract between us. Marketing email is sent only with your consent, which you can withdraw at any time. Keeping the service secure, measuring how the site works and answering your messages are our legitimate interest. Keeping payment records is a legal obligation.

2. Your app

We do not ask for your source code, and we do not connect to your repository. The AI agent opens your app on the web, the way a visitor would. It signs up once with a VibeFix test address only if you ticked “It’s my app”; if you did not, it only looks. It is instructed never to change your app, never to email your app’s users and never to ask for your own passwords. The one thing it creates is the test account it signs up with, using a password it makes up for that account.

The test account the check creates in your app, and any data in it, stay in your app. You can delete the account there at any time.

3. Who else sees it

To do the work at all, parts of your data reach these companies. This is the complete list.

• AI model providers — the AI model that does the reasoning. What the AI agent sees on your app, the emails that arrive at the test address, and your messages are sent to it as context. AI service providers may process it in other countries, including China. This is the most significant disclosure on this page and the reason it is near the top. A fix in your code is done through Anthropic’s API (Claude models), which receives your code and what the AI agent sees in your app while it works. The free check, and the fix as a backup when Anthropic’s API is unavailable, use DeepSeek’s API, which may process this data in China.
• Our hosting provider — runs the service and stores the database and your results, in the United States.
• Resend — sends our email: sign-in codes and the results you ask for, and the other emails described in section 4. It also receives the emails your app sends to our test address, so the AI agent can read the confirmation. They see the address and the message.
• Lemon Squeezy — processes payments and is the merchant of record: it sells the purchase to you. Your card details go to them, not to us. We receive your email, what you bought and the payment status. If you arrive through an affiliate's link (a link with ?aff=), Lemon Squeezy's affiliate script records that visit, using a browser identifier, and sets a cookie so a later purchase is credited to that affiliate. Visits without such a link do not load it.
• Cloudflare — DNS for this domain, and forwarding of mail sent to help@vibe-fixer.com.
• Google and GitHub sign-in — if you choose to sign in with one of them, it tells us your email address and that you signed in. We do not get your password or access to anything else in that account.
• Google (Gmail) — carries mail we send from, and replies to, our support address (section 4).
• Telegram — carries to the founder the conversations handed over from the assistant on your result page (section 3b) and replies to our emails, so he can answer them.
• Google Fonts — the typefaces on these pages are loaded from Google, which means Google sees your IP address when a page loads. Nothing else about you is sent.
• Microsoft Clarity — usage analytics on the public pages and the free check: where visitors click and scroll and how the page looked, so we can see where the site confuses people. Everything typed, email addresses and your app's details are masked before anything leaves your browser. It is never loaded on account-security pages. Microsoft processes this data under its own privacy statement. For visitors in Europe (including the UK and Switzerland), or whose country we can't tell, nothing is recorded unless you press Accept on the notice at the bottom of the page. Declining is one press and changes nothing else about the site. Your answer is kept in your browser, and you can change it at any time at https://vibe-fixer.com/?consent=reset.

We do not sell your data and we do not share it for advertising. The one analytics script on this site is Microsoft Clarity, described above.

We also keep our own short records of how the site behaves for you: the kind of device, its operating system and browser (for example "iPhone, iOS 17, inside Facebook's app"), the screen and window size, when a free check's result appeared and when its page was hidden or closed, taps on parts of the page that are not buttons, how a sign-in ended (finished, cancelled or failed), and script errors. They are summaries, never the full browser string, your IP address or anything you typed, and they are how we find a page that breaks on one kind of phone. A free check's record carries Clarity's visitor id, so we can watch that check's recording.

3a. Where it goes

The service runs in the United States, and most of the companies above process data there. AI service providers may process it in other countries, including China. So your data is processed outside your own country.

3b. The assistant on your result page

If you write to the assistant on your result page, your message, your earlier messages there and your result's headlines go to the AI model provider so it can answer. It is an AI assistant, and it says so. The founder may read the conversation and reply; he reads it in Telegram, so Telegram carries those messages to him.

3c. Connected AI tools

If you connect an AI tool to VibeFix (over the MCP standard, with a sign-in you approve), we store the connection and the tokens it needs to keep working. Tokens are kept only as one-way hashes, so a copy of our database does not contain a usable token. A refresh token lasts up to 30 days.

To end it, open the menu, choose “Connected AI tools” and press Disconnect. That revokes every token for that tool at once. The tool can start and read checks for your account while it is connected, and nothing else.

4. The emails we send, and your replies

Emails you need are sent because of something you did: a sign-in code, the result you asked us to email, a receipt or a re-check that finished. This is the only kind of email we send unless you opt in below.

Tips and offers go only to an address whose owner ticked “Email me tips and offers about my app. Unsubscribe anytime.” beside the email field. That box is never ticked for you. We keep the words you agreed to, the page and the time. Every such email has a link that stops them, and our postal address: Edificio Tornillo, Piso 27, Oficina 27C, Calle Nicanor de Obarrio / Ave 4ta El Tornillo, Bella Vista, Panamá.

Your replies to our emails, and anything you send to help@vibe-fixer.com, are read by a person and kept so we can answer you and follow up on what you asked.

4a. Testing apps that are not yet connected to an account

We check an app only when its owner asked for it, by starting a check and ticking that it is their app. If you leave “It’s my app” unticked, the check only looks at public pages: it does not sign up, send a form, buy anything or change anyone’s data.

4b. If we contacted you or your business first

We no longer contact businesses first. This part is for you if, before 17 October 2026, we wrote to you before you ever used VibeFix: a web agency, a launch platform, a newsletter, a creator, or the maker of an app listed publicly for people to try.

What we hold: your business's name, the contact details you published (a business email address, a contact form or a public profile), the country your business is in, the public pages we looked at, the message we sent and when, and anything you reply. If we tested your public app, we also hold what we found. If our email shows our logo, your mail program loading that image tells us the email was opened, and when. You can stop that by not loading images.

Where it came from: the contact address your business publishes on its own website. A program may read it from your site for us. We never guess addresses, never take them from other directories or lists, never buy lists, and we skip sites that ask not to have their addresses collected.

Why, and on what basis: to tell a business about a service that is relevant to it, or to show a maker what we found on their app. Our legal basis is our legitimate interest in doing that one message at a time. You can object at any time, and we will stop.

How often: one message. A web agency may get one reminder if it didn't reply. Nobody gets more than that unless they write back. We don't email or message businesses in the European Union, the United Kingdom, Switzerland or Canada; there we use only a contact or partnership form the business published.

Who else sees it: Google, whose Gmail service carries these emails; the AI model provider described in section 3, which reads a reply so it can help us draft the answer (AI service providers, including in other countries such as China); and X, Substack or the form's own provider when we wrote through them.

What we found goes to you, the maker, or to the web agency that built your site (credited on it, or named in that agency's own portfolio). If you asked for help in a public post, our public reply may link to the report. If we ever show an example to anyone else, such as a newsletter or a directory, we remove anything that would identify you or your app.

How long we keep it: if you don't reply, we delete your details 12 months after our last message. If you ask us not to contact you again, we keep only your address, the date and the reason, so we never do.

Your rights: reply “stop”, or write to help@vibe-fixer.com, and we won't contact you again on any channel. You can also ask for a copy of what we hold, have it corrected or deleted, and complain to a regulator, as described in section 7.

5. What we learn from checks

We record whether a check finished, how long it took, what kinds of problems it found, and whether a re-check showed a problem was gone. That is how the service gets better at checking the next app. These records are tied to a check identifier and describe how the work went. They are not a copy of your source code, and nothing from them is shown to another customer.

6. How long we keep it

Your account, checks, conversations and results, including the screenshots and the emails your app sent to our test address, stay until you delete them or ask us to. Deleting an account deletes the checks under it. Records of payments are kept as the law requires. Sign-in codes expire quickly and work once.

We are honest about one limit: backups and operational logs may hold copies for a period after a deletion, and those age out on their own rather than being individually purged.

7. Getting a copy, or getting it deleted

Write to help@vibe-fixer.com and ask. We will send you what we hold about you, or delete it, within thirty days. There is no form and no process to navigate — it is a small service and a person reads that address.

You also have the right to correct what we hold, to object to or restrict how we use it, to receive it in a portable form, and to withdraw any consent you gave. If you think we got it wrong, you can complain to a regulator: in Panama, ANTAI; in the European Union, the data protection authority where you live; in Israel, the Privacy Protection Authority.

We make no decisions about you with legal or similarly significant effect by automated means. A check's findings are about an app, not about a person.

8. Cookies

One cookie of ours, which holds your session so you stay signed in. It is HttpOnly, so page scripts cannot read it, and it is restricted to this site. Signing out clears it. A second one is set only in our own team's browsers, so our own test visits are kept out of our numbers; visitors never get it.

Microsoft Clarity (section 3) sets its own analytics cookies, which link the pages of one visit together, only if you press Accept. If you decline, or have not answered, it is not loaded for you in Europe, or where we can't tell your country, and no Clarity cookie is set. Visitors elsewhere may be recorded without a notice. Our own cookie that keeps you signed in is described above. One more, vf_hv, remembers which version of the front page you were shown for 30 days; it holds a single letter and no personal information. There are no advertising cookies of ours.

9. Security, and its limits

Passwords on older accounts and sign-in tokens for connected AI tools are stored hashed, sessions can be ended everywhere at once, and each check reads only the test address that belongs to it. No service can promise it will never be breached; if one affects you, we will tell you rather than hope you do not notice.

10. Children

VibeFix is not intended for anyone under 16, and we do not knowingly hold data about children.

11. Changes to this notice

If what we collect or who we send it to changes, this page changes and the date at the top changes with it. A new company in section 3 is exactly the kind of change we would rather you heard from us than discovered.