TheVibeSecurity← Back

Privacy Policy

Last updated: September 22, 2026

1. Who we are

TheVibeSecurity ("we", "us") runs a security scanner for web apps built with AI coding tools, at thevibesecurity.com. We are the data fiduciary for the personal data described here under India's Digital Personal Data Protection Act, 2023. You can reach us at support@thevibesecurity.com.

2. The short version

  • We collect only what we need: your email, the sites you want checked, the findings from those scans and, if you sign in with Google, your name, email and profile photo.
  • We do not sell your data. If we run ads, we measure sign-ups and purchases with Google Analytics, Google Ads and the Meta Pixel, as described below.
  • We never ask Google for your emails, contacts, files, calendar or any other Google data.
  • You can ask us to delete your data at any time.

3. What we collect

When you run a free preview scan

  • The site address you enter and the results of the scan. Preview results are kept for 7 days.
  • A salted, one-way hash of your IP address, used only to limit abuse. We do not store your raw IP address.

When you use a free tool that reads a live page

  • The page address you enter is fetched (and, for the rendering check, loaded in a headless browser) to show you the result. We do not store the page content or the results.
  • A record of the request with a salted, one-way hash of your IP address, used only to limit abuse. These records are deleted after two days. Our server logs may note the site's hostname when a fetch fails, for troubleshooting.
  • Our other free tools run entirely in your browser and send nothing to us.

When you sign in with Google

  • Your name, email address, whether Google has verified that email, your profile picture link, and your unique Google account ID.
  • We request only the basic sign-in scopes: openid, email and profile. Nothing else is requested or accessed.

When you sign in with an email code

  • Your email address, and a one-time code stored only as a one-way hash. The code expires after 10 minutes and is deleted once used.
  • A record of when a code was requested, with a salted, one-way hash of your IP address, used only to limit abuse. These records are deleted after two days.

When you use your account

  • A session token, stored only as a one-way hash, plus the time you signed in and your browser's user-agent string, so we can keep you signed in securely.
  • The sites you add, how you verified them, your scan history and the findings from each scan.
  • How you first found us: the campaign tags on the link you arrived from (UTM parameters and ad click IDs), the referring site and the first page you opened. Your browser keeps this locally and we save it to your account once, when you sign up.

When you connect GitHub

  • Through our GitHub App, and only for the repositories you choose: repository names, the code we need to read to scan it, and the findings. We open a fix pull request only when you ask for one. You can remove the app from GitHub at any time.

When you pay

  • The plan and period you bought, the amount, currency, tax, payment status, Razorpay's payment and order IDs, and the invoice details you give us (name, address, GSTIN and state if you have them).
  • We never see or store your card number, UPI PIN or bank login. Those go directly to the payment provider.

Automatically

  • Basic technical data such as page views, browser type and country, through Cloudflare's privacy-focused web analytics, which does not use tracking cookies.
  • Usage data such as the pages you view, how you arrived, your approximate location, device and browser type, and events such as starting a scan, signing up and buying a plan, through Google Analytics. Google Analytics uses cookies to tell visits apart and does not store full IP addresses.
  • A bot check from Cloudflare Turnstile on our forms.

4. How we use Google user data

We use the information we receive from Google only to create your account, sign you in, show your name and photo in your dashboard, and contact you about the service. We do not use it for advertising, we do not sell it, we do not transfer it to data brokers, and we do not use it to train general AI models. People at TheVibeSecurity do not read your Google data except where needed for security, to give you support you asked for, or to comply with law.

TheVibeSecurity's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. How we use other data

  • To run scans you ask for, show you the findings and email you alerts and reports you have turned on.
  • To take payments, switch on your plan and issue invoices.
  • To run, secure and improve the service, and to prevent abuse.
  • To measure which of our campaigns bring sign-ups and purchases.
  • To respond when you contact us.

Where the GDPR or UK GDPR applies, our legal bases are: performing our contract with you (accounts, scans, payments), our legitimate interests (security, abuse prevention and measuring our campaigns), legal obligations (tax and accounting records) and your consent where the law requires it.

6. Where your data is stored and who processes it

We use a small number of service providers that process data on our behalf:

  • Google Cloud Platform: our application servers and database, in the asia-south1 region (Mumbai, India).
  • Cloudflare: website hosting, content delivery, DNS, bot protection (Turnstile) and cookie-free web analytics.
  • Razorpay: all payments, in Indian rupees and in US dollars. Razorpay receives your payment details, email and the amount.
  • GitHub: if you install our GitHub App, GitHub gives us access to the repositories you select.
  • Zoho ZeptoMail: sending sign-in codes, alerts and service emails to your email address.
  • Google OAuth: signing you in with your Google account.
  • Google Analytics 4 and Google Ads: measuring how visitors use the site and, if we run Google ads, which ads lead to sign-ups and purchases.
  • Meta Pixel: if we run Meta ads, we send Meta a "CompleteRegistration" event when you create an account and a "Purchase" event with the amount and currency when you buy a plan. We do not send Meta your sites or findings.

We do not sell personal data and we do not share it with anyone else, except where the law requires it or, with notice to you, as part of a merger or sale of the business.

Transfers from the EEA, UK and other countries

We operate from India and our servers are in India, so using the service means your data is transferred to India. India does not have an EU or UK adequacy decision. We rely on the transfer being necessary to perform the contract you enter into with us when you ask for a scan or an account (Article 49(1)(b) GDPR and UK GDPR). Our providers listed above may process data in other countries, including the United States, under their own data processing terms, which include the EU Standard Contractual Clauses and the UK Addendum where those apply.

7. Cookies and browser storage

  • vs_session: keeps you signed in. Essential, HttpOnly, lasts up to 30 days or until you sign out.
  • vs_oauth: a short-lived cookie (about 10 minutes) that protects the Google sign-in flow.
  • _ga and _ga_*: set by Google Analytics to recognise a returning browser and count visits. They last up to two years unless you clear them.
  • _gcl_* and _fbp: set by Google Ads and the Meta Pixel, only if we run ads, to link an ad click to a later sign-up or purchase. They last up to 90 days.
  • vs_attribution (local storage): the campaign tags, referrer and first page from your first visit, kept in your browser for up to 90 days.
  • Cloudflare Turnstile may set its own cookies. You can block any of these in your browser; sign-in needs vs_session and vs_oauth to work.

8. How long we keep data

  • Free preview scans: 7 days.
  • Sign-in codes: 10 minutes. Records of code requests: two days.
  • Records of free tool requests: two days.
  • Sessions: 30 days, or until you sign out.
  • Account data, sites, scans and findings: stored in our database until you delete the site or your account. There is no separate expiry, so deleting is how you remove them.
  • Payments, tax invoices and the invoice details on them: kept after your account is deleted, without a link to your account, for as long as Indian tax and accounting law requires.
  • Security and audit logs: kept to investigate abuse. When your account is deleted these keep an internal account ID only.
  • Pre-launch waitlist entries (email and site address), if you joined before the scanner opened: kept until you ask us to delete them.
  • Analytics data in Google Analytics: up to 14 months.

9. Security

Data is encrypted in transit. Session tokens and IP addresses are stored only as one-way hashes. Our database is not open to the internet and is reachable only by our own service. No system is perfectly secure, but we take reasonable safeguards and will tell you and the authorities if a breach affects your personal data, as the law requires.

10. Your rights: access, export and deletion

  • Delete a site: from the site's page in your dashboard. Its scans and findings are deleted with it.
  • Delete your account: from Dashboard → Settings. Your profile, sites, scans, findings, connected repositories and sessions are deleted immediately. Payment records are kept as described above.
  • Export your data: email us from the address on your account and we will send you a copy of your account data, sites and findings in a common machine-readable format within 30 days.

Under India's Digital Personal Data Protection Act, 2023 you can also:

  • ask what personal data we hold about you;
  • ask us to correct or complete it;
  • withdraw consent at any time, which will not affect earlier processing;
  • nominate someone to exercise your rights on your behalf; and
  • make a complaint about how we handle your data.

If the GDPR or UK GDPR applies to you, you also have the rights of access, rectification, erasure, restriction, portability and objection, and you can complain to your local data protection authority.

Email support@thevibesecurity.com and we will respond within 30 days. If we have not resolved your complaint, you may approach the Data Protection Board of India.

11. Children

TheVibeSecurity is for people aged 18 and over. We do not knowingly collect data from children.

12. Changes to this policy

If we make a material change, especially to how we use Google user data, we will update the date above and tell you by email or with a notice on the site before it takes effect.

13. Contact and grievances

TheVibeSecurity, India · support@thevibesecurity.com