What we collect
Reading the site does not create an account. Pages do not embed advertising pixels or social trackers. The theme button stores your light or dark choice in localStorage on your device. That is not a cookie, and it is not sent to us.
Newsletter
The newsletter is sent with Buttondown. When you sign up, Buttondown stores your email address, the date you subscribed, and basic delivery data such as opens and clicks. You must confirm your address before you receive anything. Every edition has a one-click unsubscribe link, and you can ask us to delete your address at any time. We do not sell or share the list. See the Buttondown privacy policy.
Analytics
We use GoatCounter to count page views. It sets no cookies and does not track you across sites. For each view it records the page path, the referring page, the browser and operating system, screen size, and an approximate country. It does not store your IP address or build a profile of you. A short-lived hash is used only to avoid counting the same visit twice. See the GoatCounter privacy policy. Blocking the script with a content blocker does not affect how the site works.
Repo scanner
The scanner runs in your browser. When you scan a repo, your browser requests the file list and file contents directly from GitHub (api.github.com and raw.githubusercontent.com), so GitHub sees that request like any other visit. The repo URL and the results are not sent to VibeLocked and are not stored. The scanner only reads public repos and never asks for a token or a login.
Live App Scanner
The Live App Scanner sends the URL you enter to our scanning service on Cloudflare Workers, which visits that public URL the way a stranger's browser would and sends back the results. We do not keep the URL or the findings after the scan finishes, except as listed here:
- Rate limit: your IP address is kept in Cloudflare Workers KV for about 10 minutes to enforce the free limit of 5 scans per 10 minutes, then it expires.
- Peer comparison: the score is added to an anonymous bucket for the detected tech stack (for example "Next.js plus Supabase"). The bucket holds scores only, with no URL or IP.
- Changes since last scan: your last result is saved in your own browser's session storage so you can see what changed. It is not sent to us.
- Cloudflare may keep its own short request logs as part of running the service.
Ownership verification and owner keys
If you prove you own an app, we store the hostname, the verification token, and the time, in Workers KV. Unused tokens expire after 24 hours. When verification succeeds, your browser receives a private owner key, saved in its localStorage. We keep only a SHA-256 hash of that key, not the key itself, and the record expires after 7 days. Re-verifying replaces the key. Clearing your browser storage removes your copy.
Emails you give us in the scanner
We plan to let you unlock a full scan report by entering your email. This is not switched on yet. When it is, we will store your email address, the time, and the consent text you agreed to in Workers KV, and use it only to unlock that report. We will add you to the newsletter only if you tick the separate newsletter box. You can ask us to delete your email at any time.
Payments (VibeLocked Pro)
Pro is not on sale yet. When it is, payments will be handled by Stripe Managed Payments. Sold through Link, LLC (Link, a Stripe company) is the merchant of record for these orders. Stripe and Link collect your name, email, billing address or country, and payment details, and handle tax, receipts, fraud screening, and disputes. We never see your full card number. Stripe shares with us what we need to run your subscription: your email, the plan, its status, and a customer and subscription ID, which we store in Workers KV. Pro settings, monitored app URLs, and scan history are stored in Workers KV so we can rescan your apps and send the alerts you switched on. See the Stripe privacy policy and the Link privacy policy.
Deleting your data
Email hello@vibelocked.com and we will delete what we hold about you, apart from records we must keep by law. Stripe and Link keep their own transaction records as merchant of record, and you can also ask Link directly to delete your Link account and payment data.
Email you send us
If you write to hello@vibelocked.com or sponsors@vibelocked.com, we use the message to reply and, for sponsor mail, to discuss a placement. We do not sell that correspondence.
Hosting logs
The site is hosted as static files on GitHub Pages. GitHub may keep ordinary request logs, including IP addresses, as part of serving the files. VibeLocked does not add its own logging on top. The scanning service runs on Cloudflare Workers, covered above.
Links
Guides link to official vendor documentation. Those sites have their own policies. Sponsor and affiliate links, when a placement exists, will be labeled on the page. There are no paid or affiliate links on the site right now.
Children
The site is written for people building software. It is not directed at children.
Changes
If this policy changes, the page will change with it. The meaningful version is the one published at this URL.
Contact
Privacy questions: hello@vibelocked.com.