Privacy Policy

1. Overview

This Privacy Policy explains what information VibeMoat (“we,” “us”) collects, how we use it, who we share it with, and the choices and rights you have. We aim to collect the minimum needed to run the Service. For privacy questions or to exercise your rights, contact support@vibemoat.com.

2. Who is responsible for your data

VibeMoat is the controller of the personal data described here. For the source code you connect, we act as a processor on your behalf and handle it only to provide the Service.

3. Information we collect

• Account data: your email address (for emailed sign-in codes).
• GitHub connection: an OAuth access token (stored encrypted at rest) and basic profile info, used only to read the repositories you choose to scan.
• Scan data: the code we read during a scan and the findings we generate. Detected secrets are redacted before any external processing.
• Billing data: handled by our payment processor; we store only a customer/subscription reference, never full card numbers.
• Usage and log data: basic technical logs (such as timestamps and error events) needed to operate and secure the Service.
• Cookies: we use only essential cookies required for authentication and security — no advertising or third-party tracking cookies.

4. How we use information

We use the information above to:

• authenticate you and provide the Service;
• read and analyze the repositories you connect and produce reports;
• process payments and manage subscriptions;
• send transactional email (sign-in codes, scan alerts, billing notices);
• operate, secure, debug, and improve the Service;
• comply with legal obligations and enforce our Terms.

5. Legal bases (EEA/UK)

Where the GDPR or UK GDPR applies, we process personal data on these bases: performance of our contract with you (to provide the Service); our legitimate interests (to secure, maintain, and improve the Service) balanced against your rights; your consent where required; and compliance with legal obligations.

6. How we use your code

We read your source code solely to perform security analysis. Code is fetched into a temporary, isolated environment, analyzed, and discarded after the scan. We never execute your code. The only external destination for code content is the AI model provider used for the review pass, and we redact detected secrets before sending anything. We do not sell your code and do not use it to train machine-learning models.

7. Service providers (subprocessors)

We share data only with service providers that make the product work, each acting on our behalf under their own terms and safeguards:

• Supabase — database, authentication, and hosting of account and scan data.
• Vercel — application hosting and content delivery.
• Stripe — payment processing and subscription management.
• Anthropic — the AI model provider for the review pass (redacted code only).
• Resend — delivery of transactional email.
• GitHub — source-code access via the OAuth connection you authorize.
• Sentry — error monitoring (used only if enabled; excludes your code).

We may disclose information if required by law, to protect our rights or users, or in connection with a merger, acquisition, or sale of assets (with continued protection of your data).

8. International data transfers

We and our providers may process data in the United States and other countries. Where data is transferred from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as Standard Contractual Clauses where required.

9. Data retention

We keep account data while your account is active. Scan reports and findings are retained so you can track changes over time; you can delete a repository (and its scans) at any time, and you can delete your entire account from Settings. After deletion we remove your data within a reasonable period, except where we must retain limited records to meet legal, tax, or security obligations. Routine backups are purged on a rolling basis.

10. Security

We apply safeguards including encryption of access tokens at rest, per-account isolation enforced by row-level security, redaction of detected secrets before external processing, signed webhooks, and rate limiting. No method of transmission or storage is 100% secure, but we work to protect your data and will notify affected users and regulators of a data breach where required by law.

11. Your privacy rights (GDPR/UK)

Subject to applicable law, you have the right to access, correct, delete, or export your personal data; to restrict or object to certain processing; and to withdraw consent. You may exercise these rights in the dashboard (managing or deleting repositories, deleting your account, or disconnecting GitHub) or by contacting us. You also have the right to lodge a complaint with your local data-protection authority.

12. California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect and how we use it, to request access to or deletion of it, to correct inaccurate information, and to not be discriminated against for exercising these rights. We do not sell or share your personal information as those terms are defined under California law, and we do not use it for cross-context behavioral advertising. To exercise your rights, contact support@vibemoat.com.

13. Children’s privacy

The Service is not directed to children and is not intended for anyone under 16. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

14. Public share links

If you enable a public summary or badge, it exposes only an overall grade and issue counts — never file paths, code, or finding details.

15. Changes to this policy

We may update this Policy from time to time. Material changes will be communicated through the Service or by email, and we will update the “Last updated” date above.

16. Contact

Privacy questions or requests? Email support@vibemoat.com.