Privacy

VibeVigil stores the account email, a password hash if you set one, the sites you add, and the scans we run. Session tokens are random and stored only as a hash. Magic-link tokens are stored only as a hash and expire after 30 minutes.

A scan stores the URL, timing, HTTP status, passed checks, and findings. When a secret pattern matches, we keep a short masked preview and the file URL. We do not keep the full secret. The Supabase check reports table names. Row contents are read only long enough to see whether any row came back, then discarded.

Public scan reports are unlisted. Anyone with the link can open that report. Dashboard scans are visible to the account that ran them.

If Stripe is connected, Stripe stores the card and we store the customer id, subscription id, and plan name. If Resend is connected, Resend delivers email. If those are not configured, billing stays off and email is written to the server log.

Rate-limit records keep an IP address or email key for a short window, then a scheduled job deletes them.

If you join the email list, we store that address and where it came from: the site, X, a directory, or a campaign link. Account events we keep are sign-up, a scan you ran, and a paid checkout. We do not sell this list.

A first-party cookie remembers a campaign link for 30 days so signup and the email list can store that source. Daily visitor counts are a hash of the IP and browser for that day. We do not store the raw IP in that count.

On Vercel, Vercel Analytics may count page views. It is built to avoid marketing cookies.