PRIVACY NOTICE

What we hold, and who else sees it

Written from what the system actually does, not from a template. Last updated 6 October 2026. This is an interim version while our lawyer reviews the final one.

Who we are. VibeFix is operated by Y.D.A.Dabeian S.A., a company registered in Panama, at Edificio Tornillo, Piso 27, Oficina 27C, Calle Nicanor de Obarrio / Ave 4ta El Tornillo, Bella Vista, Panamá. You can reach us at help@vibe-fixer.com.

1. What we store about you

• Your email address, so you can sign in and we can reach you.
• Your password, hashed and salted. We cannot read it and cannot tell you what it is. A reset link is the only way back in.
• Session records, so signing in keeps you signed in. One cookie, described in section 8.
• Your projects and conversations — project names, and every message between you and your AI agent, including what you typed.
• Records of each repair — when it ran, how long it took, whether it worked, and what was changed.
• Usage and cost — how many model tokens a repair consumed and what it cost us. This is aggregate accounting, not a copy of the conversation.
• Any credential you deliberately store for a project, encrypted at rest. You are never asked for one in the chat, and if you paste one there anyway the system is built to refuse it rather than use it.

1a. Why we may use it

Running the test, the fix or the account you asked for, and taking a payment, is the contract between us. Marketing email is sent only with your consent, which you can withdraw at any time. Keeping the service secure, measuring how the site works and answering your messages are our legitimate interest. Keeping payment records is a legal obligation.

2. Your code

When you connect a repository it is copied into a workspace belonging to that project alone, on our server, and repairs happen there. That copy persists between conversations so your AI agent does not start from nothing every time. Deleting the project deletes the workspace.

We do not push anything to your repository except a pull request, and only after the work is done. Your original branches are not touched.

3. Who else sees it

To do the work at all, parts of your data reach these companies. This is the complete list.

• AI model providers — the AI model that does the reasoning and writes the changes. The contents of files it reads, and your messages, are sent to it as context. Their service may operate from China. This is the most significant disclosure on this page and the reason it is near the top.
• GitHub — reading the repository you connected and opening pull requests on it. Under permissions you grant on GitHub itself, which you can narrow or revoke there.
• Our hosting provider — runs the service and stores the database and your workspaces, in the United States.
• Resend — sends our email: codes, the results you ask for, and the other emails described in section 4. They see the address and the message.
• Lemon Squeezy — processes payments. Your card details go to them, not to us. We receive your email, the plan and the payment status.
• Cloudflare — DNS for this domain, and forwarding of mail sent to help@vibe-fixer.com.
• Google (Gmail) — carries the emails we send to businesses that have not signed up (section 4b), and their replies.
• Telegram — carries to the founder the conversations handed over from the assistant on your result page (section 3b) and replies to our emails, so he can answer them.
• Google Fonts — the typefaces on these pages are loaded from Google, which means Google sees your IP address when a page loads. Nothing else about you is sent.
• Microsoft Clarity — usage analytics on the public pages and the free test: where visitors click and scroll and how the page looked, so we can see where the site confuses people. Everything typed, email addresses and your app's details are masked before anything leaves your browser. It is never loaded on account-security pages. Microsoft processes this data under its own privacy statement.

We do not sell your data and we do not share it for advertising. The one analytics script on this site is Microsoft Clarity, described above.

We also keep our own short records of how the site behaves for you: the kind of device, its operating system and browser (for example "iPhone, iOS 17, inside Facebook's app"), the screen and window size, when a free test's result appeared and when its page was hidden or closed, taps on parts of the page that are not buttons, how a sign-in ended (finished, cancelled or failed), and script errors. They are summaries, never the full browser string, your IP address or anything you typed, and they are how we find a page that breaks on one kind of phone. A free test's record carries Clarity's visitor id, so we can watch that test's recording.

3a. Where it goes

The service runs in the United States, and most of the companies above process data there. The AI model provider's service may operate from China. So your data is processed outside your own country.

3b. The assistant on your result page

If you write to the assistant on your result page, your message, your earlier messages there and your result's headlines go to the AI model provider so it can answer. It is an AI assistant, and it says so. The founder may read the conversation and reply; he reads it in Telegram, so Telegram carries those messages to him.

4. The emails we send, and your replies

Emails you need are sent because of something you did: a sign-in code, the result you asked us to email, a question your AI agent is waiting on, a fix that is ready.

Tips and offers go only to an address whose owner ticked “Email me tips and offers about my app. Unsubscribe anytime.” beside the email field. That box is never ticked for you. We keep the words you agreed to, the page and the time. Every such email has a link that stops them, and our postal address: Edificio Tornillo, Piso 27, Oficina 27C, Calle Nicanor de Obarrio / Ave 4ta El Tornillo, Bella Vista, Panamá.

Your replies to our emails, and anything you send to help@vibe-fixer.com, are read by a person and kept so we can answer you and follow up on what you asked.

4a. Testing apps that are listed publicly

We test apps their makers listed publicly, and businesses' public websites, to show them what we found. Such a test only looks: it is built never to sign up, send a form or message, buy anything or change anyone's data. Tests before 5 October 2026 could create one account with a VibeFix test address. We keep the result and the page or profile where the maker can be reached.

4b. If we contacted you or your business first

This part is for you if we wrote to you before you ever used VibeFix: a web agency, a launch platform, a newsletter, a creator, or the maker of an app listed publicly for people to try.

What we hold: your business's name, the contact details you published (a business email address, a contact form or a public profile), the country your business is in, the public pages we looked at, the message we sent and when, and anything you reply. If we tested your public app, we also hold what we found. If our email shows our logo, your mail program loading that image tells us the email was opened, and when. You can stop that by not loading images.

Where it came from: your own public website, contact page, directory listing or profile. We copy each address by hand. We do not buy lists, and we do not use programs that collect addresses.

Why, and on what basis: to tell a business about a service that is relevant to it, or to show a maker what we found on their app. Our legal basis is our legitimate interest in doing that one message at a time. You can object at any time, and we will stop.

How often: one message. A web agency may get one reminder if it didn't reply. Nobody gets more than that unless they write back. We don't email or message businesses in the European Union, the United Kingdom, Switzerland or Canada; there we use only a contact or partnership form the business published.

Who else sees it: Google, whose Gmail service carries these emails; the AI model provider described in section 3, which reads a reply so it can help us draft the answer (its service may operate from China); and X, Substack or the form's own provider when we wrote through them.

What we found goes to you, the maker, or to the web agency that built and credits your site. If you asked for help in a public post, our public reply may link to the report. If we ever show an example to anyone else, such as a newsletter or a directory, we remove anything that would identify you or your app.

How long we keep it: if you don't reply, we delete your details 12 months after our last message. If you ask us not to contact you again, we keep only your address, the date and the reason, so we never do.

Your rights: reply “stop”, or write to help@vibe-fixer.com, and we won't contact you again on any channel. You can also ask for a copy of what we hold, have it corrected or deleted, and complain to a regulator, as described in section 7.

5. What we learn from repairs

We record whether a repair succeeded, how long it took, which instructions the AI agent had available, and whether you had to correct it. That is how the service gets better at repairing the next app. These records are tied to a project identifier and describe how the work went — they are not a copy of your source code, and nothing from them is shown to another customer.

6. How long we keep it

Your account, projects, conversations, and workspaces stay until you delete them or ask us to. Deleting an account deletes the projects under it. Password reset links expire after an hour and work once. Records of repairs and their cost are kept while the account exists, because they are how we account for what the service spent.

We are honest about one limit: backups and operational logs may hold copies for a period after a deletion, and those age out on their own rather than being individually purged.

7. Getting a copy, or getting it deleted

Write to help@vibe-fixer.com and ask. We will send you what we hold about you, or delete it, within thirty days. There is no form and no process to navigate — it is a small service and a person reads that address.

You also have the right to correct what we hold, to object to or restrict how we use it, to receive it in a portable form, and to withdraw any consent you gave. If you think we got it wrong, you can complain to a regulator: in Panama, ANTAI; in the European Union, the data protection authority where you live; in Israel, the Privacy Protection Authority.

We make no decisions about you with legal or similarly significant effect by automated means. A test's findings are about an app, not about a person.

8. Cookies

One cookie of ours, which holds your session so you stay signed in. It is HttpOnly, so page scripts cannot read it, and it is restricted to this site. Signing out clears it. A second one is set only in our own team's browsers, so our own test visits are kept out of our numbers; visitors never get it.

Microsoft Clarity (section 3) may set its own analytics cookies, which link the pages of one visit together. For visitors in the European Economic Area, the United Kingdom and Switzerland, Clarity sets no cookies at all and treats each page on its own. There are no advertising cookies of ours.

9. Security, and its limits

Each project runs in its own isolated workspace under its own system user, credentials are encrypted at rest, passwords are hashed and salted, and sessions can be ended everywhere at once by changing your password. No service can promise it will never be breached; if one affects you, we will tell you rather than hope you do not notice.

10. Children

VibeFix is not intended for anyone under 16, and we do not knowingly hold data about children.

11. Changes to this notice

If what we collect or who we send it to changes, this page changes and the date at the top changes with it. A new company in section 3 is exactly the kind of change we would rather you heard from us than discovered.