Privacy

VibeSafe is a passive, read-only scanner. A scan sends GET and HEAD requests to the URL you submit and to same-origin files that page already references. It does not log in, submit forms, fuzz routes, or write data. If a Supabase anon key is in the page, the scan may send one read-only GET with limit=1 to common table names. Row values are not stored. A returned row is recorded only as the table name and column names.

What we store

• The URL without its query string, the host, the time, the letter grade, and the score.
• Findings with redacted secrets: a short prefix and suffix, or a description such as the JWT role. Full secret values are not saved.
• Your email, if you submit one for the category breakdown or if Stripe Checkout collects it when you pay.
• A SHA-256 hash of the IP address, used only to rate-limit scans.
• Payment records: the Checkout session id, the email, and the plan ($9 or $29). Card numbers stay with Stripe. We do not store them.

When ActiveCampaign is configured, the email is added to list 4 with a source tag (source:site unless you arrived with a utm_source or a referring site) and action:scanned. A paid Checkout adds action:paid. The letter grade and finding count are written to the custom fields VIBESAFE_GRADE and VIBESAFE_FINDINGS when the API allows it. Addresses ending in @example.com, and requests that send the header x-vibesafe-healthcheck: 1, are not sent to ActiveCampaign.

The browser stores a first-party cookie, vibesafe_source, so the source tag still matches the campaign after you leave the landing page. A second cookie, vibesafe_v, remembers the report-page layout (a or b) when you open a link with ?v=a or ?v=b. Neither cookie is used for ads.

How long we keep it

Scan reports — the URL, grade, and redacted findings — are deleted 90 days after they are created. A daily cleanup removes them, and new scans also delete reports that are already past 90 days. Payment records are kept so a refund can still be matched to the email and plan. Email the contact address if you want a report deleted sooner, or if you want the email removed from a payment record and from the mailing list.

Contact

Deletion requests go to aneeshgajula19@gmail.com. The same address is on the contact page.