Privacy
Vibestash is a vault for ideas. This notice says what it keeps about you, why, where it goes and how to take it away. Questions or requests: hello@vibestash.fyi.
What Vibestash keeps
- Your account: email address, name, and a password that Supabase keeps hashed. Vibestash itself never sees or stores the password.
- Your vault: ideas, notes, scores, assumptions, evidence, research, build briefs, your builder profile, categories and tags, and a history of changes saying which person or connected app made each one.
- Connections: the apps you connect (such as Claude or ChatGPT), personal access tokens (kept only as a hash), and public GitHub repositories you link to an idea.
- Usage: what each AI call cost, to keep a monthly spending cap, and how many deep research reports an account has run.
- Request logs: IP address, browser, the address requested and errors, kept by Google Cloud for 30 days for security and fixing faults.
There are no ads, trackers, analytics or third-party scripts. Two cookies keep you signed in (bb_at for about two hours, bb_rt for 30 days); both are strictly necessary, so no consent banner is shown. Ideas typed while offline wait in your browser’s local storage until they can be sent.
How it is kept safe
- Everything is stored in the EU and encrypted at rest; every connection is encrypted (HTTPS).
- Each vault is walled off from every other in the database itself (row-level security), so one account can never read another’s ideas.
- Passwords are handled by Supabase Auth and never seen by Vibestash; access tokens are kept only as a hash; sign-in cookies can’t be read by scripts on the page.
- Secrets such as API keys live in Google Secret Manager, never in the code.
Why, and on what basis
- Running the vault you signed up for: storing, scoring and researching your ideas (contract).
- Sending sign-in emails: confirming the address and resetting the password (contract).
- Keeping the service secure and working: logs, spending caps, abuse limits (legitimate interest).
Vibestash does not sell your data, use it for advertising, or train AI models on it. There is no automated decision with legal or similar effect: scores and reports are suggestions you can change.
AI providers
When a new idea is captured, its text goes to Anthropic (Claude) once, to fill in its pitch, problem and audience. Beyond that, idea text goes to an AI provider only when you ask: Rescore, Build brief or Deep research. Deep research goes through OpenRouter, which also sends search questions made from the idea to Exa web search. These providers work under commercial terms that forbid training on the text; OpenRouter is told to use only providers that don’t collect data. Providers may keep requests for a short time, at most 30 days, for safety and abuse checks. Research that your own assistant does in its own chat follows that assistant’s terms, not these.
Subprocessors
These companies process data on Vibestash’s behalf.
| Company | What for | Data | Where |
|---|---|---|---|
| Google Cloud | Runs the web app, the API and the connector (Cloud Run); keeps secrets and request logs | Everything in transit; request logs with IP address and browser | Belgium (europe-west1) |
| Supabase | Database and sign-in | The whole vault; email, name and a hashed password | Frankfurt, Germany (eu-central-1) |
| Mailjet | Sends sign-in emails: confirm the address, reset the password | Email address and name | European Union |
| Anthropic | Fills in new ideas, scores them and writes build briefs (Claude) | Idea text, notes and the builder profile | United States |
| OpenRouter | Runs deep research: passes the request to Claude and to Exa web search | Idea text and search questions made from it | United States |
| Exa | Web search for deep research, through OpenRouter | Search questions made from the idea | United States |
| Paddle | Sells deep research reports as the merchant of record: takes payment, charges VAT, sends receipts | Email address, country and payment details (Vibestash never sees card details) | United Kingdom |
| Cloudflare | DNS for vibestash.fyi; forwards mail sent to hello@vibestash.fyi | Emails sent to that address | Global network |
The vault itself stays in the EU. Where a provider is outside the European Economic Area, transfers rely on the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses. Vibestash reads public repository activity from GitHub when you link a repository; it sends GitHub nothing about you. New subprocessors are listed here before they receive any data.
How long
Your vault is kept until you delete it. Deleting it on the You page removes every idea, note, score, brief, token and the change history at once, then deletes your sign-in account. Copies in provider backups and logs expire on their own within 30 days.
Your rights
You can see, correct, export and delete your data yourself: edit anything in the vault, export it as JSON or Markdown, or delete the vault, all from the You page. You can also ask for a copy, a correction, deletion, or a restriction, or object to processing, by writing to hello@vibestash.fyi; you will get an answer within one month. If you think your data is handled wrongly, you can complain to the data protection authority where you live.
Children
Vibestash is not meant for anyone under 16.
Changes
If this notice changes in a way that matters, account holders get an email before the change takes effect. The date at the top shows the latest version.