Privacy Policy

This policy explains how the VibeNote team handles personal information in connection with its website, applications, CLI, accounts, and available sync and team services. It distinguishes local processing from information sent to online services. It does not replace the policies of your repository host, external Agent, or other services you authorize.

For organization-managed content, your organization may also determine the purpose and permissions for processing it. You can contact us about this policy at feedback@vibenoteapp.com.

Documents, attachments, and Git history are kept in local vaults on your device. Editing a local document is different from publishing or synchronizing its repository. Local files may also be accessed by other applications, system backups, or Agents to which you grant access.

When you choose remote hosting, sync, or team sharing, repository contents and history are transmitted to the configured host. Removing a document from the latest version does not necessarily remove it from earlier commits, remote backups, or collaborators’ copies.

Only information relevant to the feature used should be processed. Your document ownership is unchanged by the use of an online feature.

The desktop app integrates PostHog for events such as application startup, readiness, and command invocation. Event fields include a randomly generated installation identifier, event time, app version and release, operating system, CPU architecture, language or locale, and command identifier when applicable.

This identifier is pseudonymous, not a guarantee of anonymity. The configured collection endpoint is in the United States. The event schema does not include document text, titles, file paths, or command arguments; GeoIP enrichment is disabled. Network processing may still expose an IP address to the receiving service.

Where applicable law requires consent for analytics, we will obtain it before collection and provide a way to withdraw it. You can contact us to withdraw consent or request deletion of data associated with your installation identifier. Accepting service terms does not replace that consent.

VibeNote includes Sentry-based crash reporting. Reports can include version and build information, operating system and architecture, error type, call stacks, thread and module information, limited lifecycle breadcrumbs, and a process-run identifier. Upload depends on the distributed build’s diagnostic configuration.

Structured reports filter account fields, exception text, and absolute paths. Native crash dumps can nevertheless contain fragments of process memory, potentially including sensitive information present at the time of a crash. We therefore do not promise that every crash artifact is free of document or other personal data.

Reports may be queued locally and retried. Local queue cleanup is separate from the retention of reports already uploaded. Uploaded reports are subject to the retention and deletion rules in section 8. You may contact us with a request concerning diagnostic data.

• Cloudflare: provides website and download delivery and infrastructure for VibeNote online services, including the self-hosted email system. Relevant network, account-service, support, and infrastructure data may be processed there.
• PostHog: processes the usage events described above. See its privacy information.
• Sentry: processes diagnostic reports when upload is configured. See its privacy information.
• Your selected sign-in and repository providers: process authorization, repository content and history, and permissions according to the actions you request.
• Your selected Agent or model provider: may receive documents, prompts, and context you allow it to access. Review its own retention and training terms.

Service providers acting on our instructions must be bound by appropriate confidentiality, security, and data-protection requirements, with protection at least equivalent to our commitments in this policy. We disclose information only as necessary to provide the requested service, comply with a lawful obligation, or protect rights and security. This is not unrestricted permission to share your documents.

Account, catalog, and team information is used to provide the services you request. Technical information helps deliver and secure those services, while usage events and diagnostics help assess reliability and improve the product. Any processing requiring consent must have a separate, appropriate consent mechanism; accepting service terms is not blanket consent to optional analytics.

The website stores theme and language preferences in your browser’s local storage. The current static site does not include an advertising tracker or analytics script. Hosting and download requests still involve the technical network information described above. Clearing site storage removes saved website preferences.

• After verifying an account-deletion request, we will delete or irreversibly anonymize personal information in active account systems within 30 days, unless a specific legal obligation requires retention.
• Residual copies in backups under our control will be removed within 90 days of deletion. Until then, they will be isolated from ordinary use and accessed only for recovery or legal obligations; a restoration will reapply deletion requests.
• Usage events, uploaded crash reports, and ordinary technical logs are retained for no more than 90 days, unless a specific incident or legal obligation justifies a documented exception.
• We delete support correspondence when the request is resolved and no longer needs follow-up, and ordinarily within 12 months of closure, unless you request earlier deletion or a legal obligation applies.

Local vaults are under your control. Third-party repositories, their backups, and collaborators’ clones follow the relevant host or organization’s controls and cannot be erased through a VibeNote account deletion alone. Legally retained information is limited to the required purpose and deleted when that obligation ends.

Depending on applicable law, you may request access, correction, a copy or export, deletion, restriction, or objection to processing of personal information, and withdraw consent where processing relies on it. You may also raise concerns with the relevant privacy regulator. Withdrawal does not invalidate prior lawful processing.

You can manage local files directly and revoke third-party authorizations through the provider’s controls. Signing out does not delete an account. You may request account deletion or exercise other privacy rights through the contact address below; proportionate identity checks may be needed. Keep the local files and repository copies you need before requesting deletion.

We protect data using appropriate access controls and transport security, and limit access to what is necessary. No security measure can eliminate every risk. Git synchronization or HTTPS alone does not mean that a repository is end-to-end encrypted, and we make no such blanket claim.

Processing locations depend on the relevant service. The configured PostHog endpoint is in the United States; Cloudflare, diagnostic services, repository hosts, and external Agents may process information in other countries. Where applicable law requires specific notices, transfer safeguards, or separate consent, we will provide those notices, apply the required safeguards, and obtain consent before the relevant processing.

We take the protection of minors’ personal information seriously. When processing such information, we will obtain any parent or guardian consent required by applicable law and apply appropriate safeguards. If you believe we have processed a minor’s personal information without legally required consent, contact us so we can investigate and take appropriate action, including deletion where required.

Do not include passwords, access tokens, or unrelated sensitive information in support reports. Before sharing documents with a team or external Agent, check whether the content includes personal or confidential information you are authorized to disclose.

Material changes to data categories, purposes, or recipients will be explained through appropriate product or website notices. The date at the top of this policy identifies the latest update. Where a new use requires consent, we will seek it before that processing begins.

Service provider: the VibeNote team.

For service inquiries, account deletion, or other privacy requests, contact feedback@vibenoteapp.com.