Legal
Privacy Policy
What we collect, why, and the choices you have. Short and in plain English.
Who we are
VibeShields is run from the United Arab Emirates. For anything about your data, email hello@vibeshields.com. Last updated 2 November 2026.
What we collect
- Account: your email address, and when you agreed to our terms.
- Your apps: the name and web address you add, the ownership proof result, and when and from which network (stored as a one-way hash) you gave scan permission.
- Check results: what each check found, with evidence masked. Leaked keys keep only a few characters so you can recognise them. When a database is open we note the table name and that it answered; we never store its rows.
- Ask VibeShields: the questions you type, to answer them. We don't keep the conversation after it is answered.
- Security logs: sign-ins and important actions, kept to protect your account.
Why we use it
- To run the service you asked for (our contract with you): sign-in, checks, reports, the weekly email, the badge.
- To keep VibeShields and its users safe (legitimate interests): rate limits, abuse prevention, security logs.
- To meet legal duties, such as keeping a record of scan permission.
- We do not sell your data, and we do not send marketing emails without your consent.
Companies that help us (sub-processors)
We share only what each one needs. We will update this list, with 30 days' notice of changes, before adding a new one.
- Microsoft Azure hosts the app, database and queue in the UAE North region.
- Resend (USA) sends sign-in links and weekly reports, from its Tokyo region.
- Anthropic (USA) writes AI explanations and chat answers. It receives only the type of problem and your question, never your keys, URLs, evidence or your users' data. Under its commercial terms it does not use this data to train its models.
Where your data is stored
In Microsoft Azure's UAE North region. Email and AI requests are processed in the USA (and Japan for email sending); we rely on each provider's data processing terms and standard contractual safeguards for these transfers.
How long we keep it
- Check results and findings: 180 days, then deleted automatically.
- Sign-in links: until they expire (15 minutes). Sessions: up to a week after they end.
- Your account: until you ask us to delete it. We then delete it within 30 days, except records we must keep by law, such as scan permission.
Your rights
You can ask to see, correct, export or delete your data, or object to how we use it, by emailing hello@vibeshields.com. We reply within one month. If you are unhappy with our answer, you can complain to your data protection authority.
AI
Explanations and chat answers are written by AI and labelled as such. Cached explanations are shared between customers, so they are written from the type of problem only and contain nothing from any one app.
Security and breaches
Your data is separated per account at the database level, encrypted in transit, and protected by the safety rules on our Safety page. If a breach affects your data, we will tell you and the relevant authorities as the law requires, within 72 hours of finding out where required.