Privacy Policy
Last updated: July 28, 2026
Short version: We collect only what we need to run the service — your email, subscription status, information you choose to submit through forms, and anonymous usage signals from the CLI. We never sell your data. We never scan or store your source code.
1. Who We Are
VibeLint ("we", "us", "our") is a security scanning tool for AI-assisted codebases, operated by Rachid Elharrak ("Operator"). Our service is accessible at vibelint.dev.
For questions about this policy, contact us at hi@vibelint.dev.
2. What Data We Collect
2.1 Account data
When you create an account, we collect:
- Email address
- Name (if provided via Google OAuth)
- Authentication tokens (managed by Clerk — see Section 5)
2.2 Subscription and billing data
When you subscribe to a paid VibeLint plan, our payment processor Dodo Payments collects your payment details. We never see or store your full card number. We store only:
- Your subscription status (free or pro)
- Dodo customer ID and subscription ID (for billing management)
- Subscription start and cancellation dates
2.3 Code Security device authorization data
For browser-authorized Code Security devices, we store:
- Opaque installation and device identifiers linked to your account
- A one-way hash of the durable refresh secret; the plain refresh secret is not stored in the database
- Authorization, runtime release, entitlement, refresh, and last-signal timestamps
2.4 Code Security MCP connection data
When the Code Security MCP starts successfully with device authorization, it sends a small account-linked connection record containing:
- VibeLint version number
- Package variant (Free or Pro)
- The first confirmed installation time
- The most recent connection time
This connection record contains no source code, file names, hardware identifiers, file paths, or scan findings. It uses opaque installation and device IDs to reconcile setup and powers installation and connection status in the user and admin dashboards.
2.5 Scan results (optional)
If dashboard sync is enabled, VibeLint may send scan summaries, including issue counts, severity levels, language, project label, and only the target file's basename. We never receive the actual code or the file's directory path.
Dashboard sync is opt-in and can be disabled by setting VIBELINT_NO_SYNC=1.
2.6 Website usage data
We use Vercel Analytics to collect anonymous, aggregate data about visits to vibelint.dev, including page views and referrer information. No cookies are used for analytics. No personal identifiers are collected.
2.7 Affiliate program applications
If you apply to the VibeLint Partner Program, we store the information needed to review and manage your application:
- Your full name and verified VibeLint account email
- The public social media profile links you provide
- The VibeLint plans you are interested in promoting
- Your application status and submission date
We use this information only to review your application, contact you about the partner program, and administer the relationship if approved.
For approved affiliates, we also process versioned agreement acceptance, aggregate link visits, optional consented first-party attribution, conversion and immutable commission-ledger records, masked and encrypted payout-email data, payout history, fraud-review evidence, and external tax-portal status. Affiliates never receive buyer names, emails, account IDs, or payment details. We do not store raw referral IP addresses, full user agents, full referrer URLs, card data, tax identification numbers, identity documents, or tax-form files.
3. How We Use Your Data
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Email address | Account creation and transactional emails, including receipts and setup notices | Contract performance |
| Subscription status | Controlling access to Pro features | Contract performance |
| Device and refresh-secret hash | Authorizing managed Code Security runtimes | Contract performance |
| Runtime authorization and signal times | Showing protection and connection state | Legitimate interest |
| Code MCP connection data | Showing installation and connection status | Legitimate interest |
| Scan summaries (opt-in) | Displaying results in your dashboard | Consent |
| Website analytics | Understanding traffic to improve the landing page | Legitimate interest |
| Affiliate application data | Reviewing and administering partner applications | Steps taken at your request |
| Affiliate attribution and financial records | Crediting referrals, handling refunds and disputes, and paying affiliates | Contract performance and legal obligation |
4. Data Retention
- Active accounts: Data is retained for as long as your account is active.
- After cancellation: Account data is deleted within 30 days of account closure on request. Billing records may be retained for up to 7 years for tax and legal compliance.
- Retired Code Security key audit: Revoked legacy key hashes are deleted within 90 days of the 4.0 retirement activation.
- Telemetry: Anonymous telemetry data is retained for up to 12 months in aggregate form.
- Affiliate applications: Application data is retained for the relationship lifetime plus two years, unless erased earlier or subject to a legal hold. Referral pending tokens are retained for at most 24 hours; consented referral and permitted fraud hashes expire after the 30-day window plus seven days. Daily click aggregates are retained for 25 months before monthly compaction. Conversion, ledger, payout, tax-status, and financial admin records are retained for seven years after the relevant tax year. Review evidence is retained for two years after resolution unless held legally. Payout-email ciphertext is scheduled for deletion 90 days after final settlement and closure when no hold remains.
5. Third-Party Sub-Processors
We share data with the following third-party services to operate VibeLint. Each has been assessed for GDPR compliance.
| Service | Purpose | Data shared |
|---|---|---|
| Clerk (clerk.com) | Authentication (sign up, sign in, sessions) | Email, name, OAuth tokens |
| Supabase (supabase.com) | Database — stores account, device authorization, runtime, and affiliate application data | Email, subscription status, opaque device IDs, secret hashes, partner application details |
| Dodo Payments (dodopayments.com) | Payment processing and subscriptions | Email, billing details |
| PayPal and Wise | Manual affiliate payout transfer | Affiliate payout email, transfer amount, and reference |
| Resend (resend.com) | Transactional affiliate and account email | Recipient email and message content |
| External accountant-approved tax portal | Tax-document collection and verification | Information submitted directly by the affiliate; VibeLint stores only status and an opaque reference |
| Vercel (vercel.com) | Hosting the web application and API | Request logs (IP, user agent) |
We do not sell your data to any third party. We do not use your data for advertising.
6. Your Rights
Under GDPR and similar privacy laws, you have the right to:
- Access: Request a copy of all data we hold about you
- Correction: Ask us to correct inaccurate data
- Deletion: Request that we delete your account and associated data
- Portability: Receive your data in a machine-readable format
- Objection: Object to processing based on legitimate interest
- Restriction: Ask us to pause processing while a dispute is resolved
Account deletion disables an affiliate link and removes eligible application and social-review data. Records required for refunds, disputes, settlement, tax, fraud prevention, or legal compliance are pseudonymized and retained; they are not silently deleted while money remains unsettled.
To exercise any of these rights, email hi@vibelint.dev. We will respond within 30 days.
7. Cookies
Clerk uses necessary cookies to keep you signed in. Vercel Analytics remains aggregate and cookie-free. When you arrive through an affiliate link, VibeLint counts a bot-filtered aggregate visit. With your explicit choice, VibeLint may set a first-party, HttpOnly referral cookie for up to 30 days so an eligible new account and first payment can be attributed. Declining creates no attribution. A separate signed necessary cookie remembers the consent choice.
You can withdraw referral consent or delete browser cookies at any time. Withdrawal deletes an unclaimed browser referral and blocks future attribution, but it cannot rewrite a completed financial transaction. Deleting the Clerk session cookie signs you out.
8. Security
We take reasonable technical and organizational measures to protect your data, including:
- Durable Code Security refresh secrets are represented in the database only by one-way hashes
- Device refresh secrets are stored locally using Windows Credential Manager, macOS Keychain, or a private Linux credential file
- All data in transit is encrypted via HTTPS/TLS
- Database access is restricted to server-side API routes using a service role key
- Row-level security is enabled on all user data tables
- Payment processing is handled entirely by Dodo Payments — we never see card numbers
To report a security vulnerability in VibeLint itself, see our Security Policy.
9. Children's Privacy
VibeLint is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at hi@vibelint.dev.
10. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the "last updated" date at the top of this page. For material changes, we will notify you by email. Continued use of VibeLint after changes constitutes acceptance of the updated policy.
11. Contact
For privacy-related questions, data requests, or to request a Data Processing Agreement (DPA) for your organization:
- Email: hi@vibelint.dev