Privacy Policy

The data controller is the operator of VibeSwap, based in Israel. You can reach us about privacy through the support page (choose "Privacy request").

Account data: your name, email address and a scrambled (hashed) version of your password. If you sign in with Google, we receive your name, email address and whether Google verified it. We don't receive your Google password or your contacts.

Content you add: your apps (name, tagline, link, emoji, category), your sites and ad slots, and contact details you choose to make public.

Usage and token data: token balance and history, which ads were shown and clicked in which slot, and when. API keys are stored only as a hash.

Mailing list: your email address, language and the date you subscribed.

Support messages: what you send us through the support page.

Visitors of sites that embed our slot: to count each view and click once and to stop fraud, we compute a one-way hash of the visitor's IP address, browser user agent and the date. We don't store the raw IP address and the slot doesn't set cookies on members' sites. Our hosting provider may keep standard server logs, including IP addresses, for a short time for security.

To run your account and the service, count views and clicks, and give out tokens (to perform our agreement with you).

To prevent fraud, abuse and security problems, and to improve the service (our legitimate interests).

To send the daily email, only if you subscribed (your consent, which you can withdraw at any time).

To show your app and public contact details to others, as you asked (agreement and consent).

To comply with the law and handle legal claims (legal obligation and legitimate interests).

We don't sell your personal data, don't use it for advertising profiles, and don't make decisions about you based only on automated processing that have legal or similarly significant effects.

Service providers who process data for us under contract: Vercel (hosting, servers in Dublin, Ireland), Turso (database, Ireland), Google (sign-in, only if you use it), and Resend (sending the daily email).

Other members and the public see what you choose to publish: your app, its stats, and contact details if you allow contact. Nothing else about your account is public.

Authorities or others if the law requires it, or to protect rights, safety and the service. A buyer or successor if the service is sold or merged, under this policy.

Our data is stored mainly in the EU (Ireland). Some providers may process data in other countries, including the United States. Israel has an EU adequacy decision. Where data leaves the EU or Israel, we rely on adequacy decisions or standard contractual clauses.

Account data and content: while your account exists. When you ask us to delete your account, we delete or anonymize it within 30 days, except what the law requires us to keep.

View and click records: as long as needed for token accounting and fraud checks, then deleted or kept only as totals.

Mailing list: until you unsubscribe. Support messages: up to 24 months.

You may ask to see your data, correct it, delete it, get a copy in a portable format, restrict or object to its use, and withdraw consent. Under Israeli law you also have the right to review and correct information held about you in a database.

Send requests through the support page. We may ask you to confirm your identity and will answer within 30 days.

You can unsubscribe from the daily email with the link in every email.

You may complain to the Israeli Privacy Protection Authority, or in the EU or UK to your local data protection authority.

We use HTTPS, hashed passwords and API keys, signed session cookies and access limits. No system is perfectly secure, so please use a unique password and keep your API keys secret. If a breach affects you, we'll tell you and the authorities as the law requires.

The service is not meant for anyone under 16. We don't knowingly collect data from children. If you think a child gave us data, contact us and we'll delete it.

We'll update this policy when our practices change, and change the date at the top. We'll tell members about significant changes on the site or by email.