Privacy

This draft describes the account, scan, and payment data the current VibeCheck app stores.

It is not a finished privacy policy. Nikz must review it before the site takes payment.

We store the email address you use to sign in, a hash of the magic-link token, and a hash of the session token.

The magic link expires in 30 minutes. The session cookie is named vc_session, is httpOnly, and lasts 30 days unless you sign out.

We store the origin you submit, the ownership token, consent time, scan status, score, coverage, and findings for that scan.

A finding can include a short request and response excerpt. Secrets in that excerpt are redacted before they are shown in the report.

Paid checkout is a Stripe Checkout session. Stripe processes the card. VibeCheck stores the Stripe customer id, checkout session id, and payment status, not the full card number.

A monitoring subscription also stores the Stripe subscription id and status.

The app sets the vc_session cookie so you stay signed in. It is not an advertising cookie.

This draft does not add analytics or marketing pixels. If that changes, Nikz needs to update this page first.

A public score page exists only after you turn sharing on. It shows the score out of 100, the scan date, and a rescan-needed state when the scan is stale.

It does not list findings. Turn sharing off to stop serving that page.

Placeholder: a retention and deletion schedule is not decided. Sessions and magic links expire on the timers above, and scan rows stay until a deletion process exists.

Nikz needs to set how long accounts, findings, and alerts are kept, and how a person asks for deletion, before this page is final.

Email contact@example.com from the account mailbox and describe the request. Replace that placeholder address before publication.