PRIVACY NOTICE

What we hold, and who else sees it

Written from what the system actually does, not from a template. Last updated 22 August 2026.

1. What we store about you

• Your email address, so you can sign in and we can reach you.
• Your password, hashed and salted. We cannot read it and cannot tell you what it is. A reset link is the only way back in.
• Session records, so signing in keeps you signed in. One cookie, described in section 7.
• Your projects and conversations — project names, and every message between you and your engineer, including what you typed.
• Records of each repair — when it ran, how long it took, whether it worked, and what was changed.
• Usage and cost — how many model tokens a repair consumed and what it cost us. This is aggregate accounting, not a copy of the conversation.
• Any credential you deliberately store for a project, encrypted at rest. You are never asked for one in the chat, and if you paste one there anyway the system is built to refuse it rather than use it.

2. Your code

When you connect a repository it is copied into a workspace belonging to that project alone, on our server, and repairs happen there. That copy persists between conversations so your engineer does not start from nothing every time. Deleting the project deletes the workspace.

We do not push anything to your repository except a pull request, and only after the work is done. Your original branches are not touched.

3. Who else sees it

To do the work at all, parts of your data reach these companies. This is the complete list.

• DeepSeek — the AI model that does the reasoning and writes the changes. The contents of files it reads, and your messages, are sent to it as context. Their service operates from China. This is the most significant disclosure on this page and the reason it is near the top.
• GitHub — reading the repository you connected and opening pull requests on it. Under permissions you grant on GitHub itself, which you can narrow or revoke there.
• Fly.io — hosts the service and stores the database and your workspaces.
• Resend — sends transactional email, such as a password reset. They see the address and the message.
• Cloudflare — DNS for this domain, and forwarding of mail sent to help@vibe-fixer.com.
• Google Fonts — the typefaces on these pages are loaded from Google, which means Google sees your IP address when a page loads. Nothing else about you is sent.

We do not sell your data, we do not share it for advertising, and there is no analytics or tracking script on this site.

4. What we learn from repairs

We record whether a repair succeeded, how long it took, which instructions the engineer had available, and whether you had to correct it. That is how the service gets better at repairing the next app. These records are tied to a project identifier and describe how the work went — they are not a copy of your source code, and nothing from them is shown to another customer.

5. How long we keep it

Your account, projects, conversations, and workspaces stay until you delete them or ask us to. Deleting an account deletes the projects under it. Password reset links expire after an hour and work once. Records of repairs and their cost are kept while the account exists, because they are how we account for what the service spent.

We are honest about one limit: backups and operational logs may hold copies for a period after a deletion, and those age out on their own rather than being individually purged.

6. Getting a copy, or getting it deleted

Write to help@vibe-fixer.com and ask. We will send you what we hold about you, or delete it, within thirty days. There is no form and no process to navigate — it is a small service and a person reads that address.

7. Cookies

One cookie, which holds your session so you stay signed in. It is HttpOnly, so page scripts cannot read it, and it is restricted to this site. Signing out clears it. There are no advertising, analytics, or third-party cookies, which is why this site has never asked you to accept anything.

8. Security, and its limits

Each project runs in its own isolated workspace under its own system user, credentials are encrypted at rest, passwords are hashed and salted, and sessions can be ended everywhere at once by changing your password. No service can promise it will never be breached; if one affects you, we will tell you rather than hope you do not notice.

9. Children

VibeFix is not intended for anyone under 16, and we do not knowingly hold data about children.

10. Changes to this notice

If what we collect or who we send it to changes, this page changes and the date at the top changes with it. A new company in section 3 is exactly the kind of change we would rather you heard from us than discovered.