Privacy Policy

1. Who We Are

VibeLint ("we", "us", "our") is a security scanning tool for AI-assisted codebases, operated by Rachid Elharrak ("Operator"). Our service is accessible at vibelint.dev.

For questions about this policy, contact us at hi@vibelint.dev.

2. What Data We Collect

2.1 Account data

When you create an account, we collect:

• Email address
• Name (if provided via Google OAuth)
• Authentication tokens (managed by Clerk — see Section 5)

2.2 Subscription and billing data

When you subscribe to a paid VibeLint plan, our payment processor Dodo Payments collects your payment details. We never see or store your full card number. We store only:

• Your subscription status (free or pro)
• Dodo customer ID and subscription ID (for billing management)
• Subscription start and cancellation dates

2.3 License key data

For VibeLint accounts, we store:

• A SHA-256 hash of your license key — the plain key is never stored on our servers
• The timestamp of the last time your CLI validated its license

2.4 Code Security MCP connection data

When the Code Security MCP starts successfully with a valid license, it sends a small account-linked connection record containing:

• VibeLint version number
• Package variant (Free or Pro)
• The first confirmed installation time
• The most recent connection time

This connection record contains no source code, file names, file paths, machine identifiers, or scan findings. It powers installation and connection status in the user and admin dashboards.

2.5 Scan results (optional)

If dashboard sync is enabled, VibeLint may send scan summaries (issue counts and severity levels) to your dashboard. We never receive the actual code that triggered an issue — only the detector name, severity, and file path.

Dashboard sync is opt-in and can be disabled by setting VIBELINT_NO_SYNC=1.

2.6 Website usage data

We use Vercel Analytics to collect anonymous, aggregate data about visits to vibelint.dev, including page views and referrer information. No cookies are used for analytics. No personal identifiers are collected.

2.7 Affiliate program applications

If you apply to the VibeLint Partner Program, we store the information needed to review and manage your application:

• Your full name and verified VibeLint account email
• The public social media profile links you provide
• The VibeLint plans you are interested in promoting
• Your application status and submission date

We use this information only to review your application, contact you about the partner program, and administer the relationship if approved.

For approved affiliates, we also process versioned agreement acceptance, aggregate link visits, optional consented first-party attribution, conversion and immutable commission-ledger records, masked and encrypted payout-email data, payout history, fraud-review evidence, and external tax-portal status. Affiliates never receive buyer names, emails, account IDs, or payment details. We do not store raw referral IP addresses, full user agents, full referrer URLs, card data, tax identification numbers, identity documents, or tax-form files.

3. How We Use Your Data

4. Data Retention

• Active accounts: Data is retained for as long as your account is active.
• After cancellation: Account data is deleted within 30 days of account closure on request. Billing records may be retained for up to 7 years for tax and legal compliance.
• License keys: Revoked key hashes are deleted within 90 days of revocation.
• Telemetry: Anonymous telemetry data is retained for up to 12 months in aggregate form.
• Affiliate applications: Application data is retained for the relationship lifetime plus two years, unless erased earlier or subject to a legal hold. Referral pending tokens are retained for at most 24 hours; consented referral and permitted fraud hashes expire after the 30-day window plus seven days. Daily click aggregates are retained for 25 months before monthly compaction. Conversion, ledger, payout, tax-status, and financial admin records are retained for seven years after the relevant tax year. Review evidence is retained for two years after resolution unless held legally. Payout-email ciphertext is scheduled for deletion 90 days after final settlement and closure when no hold remains.

5. Third-Party Sub-Processors

We share data with the following third-party services to operate VibeLint. Each has been assessed for GDPR compliance.

We do not sell your data to any third party. We do not use your data for advertising.

6. Your Rights

Under GDPR and similar privacy laws, you have the right to:

• Access: Request a copy of all data we hold about you
• Correction: Ask us to correct inaccurate data
• Deletion: Request that we delete your account and associated data
• Portability: Receive your data in a machine-readable format
• Objection: Object to processing based on legitimate interest
• Restriction: Ask us to pause processing while a dispute is resolved

Account deletion disables an affiliate link and removes eligible application and social-review data. Records required for refunds, disputes, settlement, tax, fraud prevention, or legal compliance are pseudonymized and retained; they are not silently deleted while money remains unsettled.

To exercise any of these rights, email hi@vibelint.dev. We will respond within 30 days.

7. Cookies

Clerk uses necessary cookies to keep you signed in. Vercel Analytics remains aggregate and cookie-free. When you arrive through an affiliate link, VibeLint counts a bot-filtered aggregate visit. With your explicit choice, VibeLint may set a first-party, HttpOnly referral cookie for up to 30 days so an eligible new account and first payment can be attributed. Declining creates no attribution. A separate signed necessary cookie remembers the consent choice.

You can withdraw referral consent or delete browser cookies at any time. Withdrawal deletes an unclaimed browser referral and blocks future attribution, but it cannot rewrite a completed financial transaction. Deleting the Clerk session cookie signs you out.

8. Security

We take reasonable technical and organizational measures to protect your data, including:

• License keys are stored only as SHA-256 hashes — the plain key never touches our servers
• All data in transit is encrypted via HTTPS/TLS
• Database access is restricted to server-side API routes using a service role key
• Row-level security is enabled on all user data tables
• Payment processing is handled entirely by Dodo Payments — we never see card numbers

To report a security vulnerability in VibeLint itself, see our Security Policy.

9. Children's Privacy

VibeLint is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at hi@vibelint.dev.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "last updated" date at the top of this page. For material changes, we will notify you by email. Continued use of VibeLint after changes constitutes acceptance of the updated policy.

11. Contact

For privacy-related questions, data requests, or to request a Data Processing Agreement (DPA) for your organization:

• Email: hi@vibelint.dev