Privacy policy

This policy describes what VibeAlarm stores when you run a free check, create an account, or pay for monitoring. Izzet Labs LLC operates the service. We do not hold a security or privacy certification, and this page is not one.

An account stores the email address you give us, a random unsubscribe token, whether alerts are on, and whether you are still on the mailing list. Sign-in is a magic link. We store a hash of that link and a hash of the session token, not the raw token. The session cookie (va_session) is httpOnly and lasts 30 days. The link itself expires after 30 minutes.

If you ask us to email a free-check report, we also store that email, the URL, the builder you picked, the consent text, and the time you agreed.

For each app you add we store the name, the public URL, and the builder. A free check reads the public site only: the homepage, TLS, security headers, known secret shapes in public JavaScript, a single read when a public Supabase or Firebase config is present, robots.txt, and sitemap.xml. The result, including the fix prompt, is stored. Anyone with the report link can open that public report.

A paid plan can replay a flow you record (visit, fill, click, expect text) after you prove you control the domain by DNS TXT, a meta tag, or a file on the site. Flow steps are stored as you entered them. The test-login email and password are encrypted with AES-256-GCM before they are saved. Screenshots from those runs are PNGs. On Vercel they go to private Vercel Blob. Locally, with no Blob token, they stay in a file on disk. A screenshot is served to the signed-in owner or to someone with a signed link.

We also store each run’s status and the findings (what passed, what failed, the evidence, and the fix prompt). When an AI key is configured, the text of a failing finding is sent to that model so it can rewrite the fix prompt. The encrypted test password is not part of that request. If no key is set, the built-in prompt is used and nothing is sent.

Stripe handles the card payment. We store the Stripe customer id, the subscription id, and the subscription status Stripe last sent us. We do not store the card number. Webhook events are recorded so a payment notice is applied once.

If you check the consent box on a free report or on account creation, we add your email to an ActiveCampaign list and tag the plan (free, paid_19, or paid_49). You can unsubscribe from the link in any VibeAlarm email. That stops the list mail and, for an account, the alerts and weekly summary. Sign-in links still send, because that is how you get back in. A failed sync is retried. It does not block signup.

Product email (sign-in, alerts, weekly summary) is sent with Resend when that provider is turned on.

The database is Neon Postgres and the app is hosted on Vercel, both in the United States. Screenshots use Vercel Blob when that token is set. A remote browser, if configured, loads the site you asked us to test. Rate-limit keys are a salted hash, not the raw network address.

We keep account, app, run, screenshot, report, and billing rows while the account or the report exists. There is no automatic purge of old check results. Email support@vibealarm.app and ask us to delete your data. We delete the rows and screenshots we control for that account. Stripe and ActiveCampaign keep their own records under their policies. We can retain a minimal record when the law requires it, such as a paid invoice.

The session cookie is how we know the browser is signed in. We do not use a third-party advertising cookie.