Privacy Policy

1. Information you provide

When you create an account we collect your email address and a hashed password. Authentication is handled by Supabase on our behalf.

When you create a project or connect a provider, we store the configuration you enter (project name, platform, framework, and the provider you choose to link).

2. Connected provider data

If you connect a provider such as Google Analytics 4, Firebase, Meta Ads, or Google Search Console, you authorize us to read reporting data from that account using credentials you grant. We store access/refresh tokens encrypted at rest and use them only to fetch the metrics shown in your dashboard.

We request the minimum scopes needed to read reporting data. You can disconnect a provider at any time, which stops further reads.

3. First-party (owned) events

If you install our tracking snippet, your app sends us events about activity on the properties you operate. Before storage, incoming event properties are filtered server-side against a strict allowlist so that fields outside that allowlist are dropped and never persisted.

We additionally derive coarse signals from the network request: an approximate country (from Cloudflare's edge), a bot-likelihood score, and the referring site's hostname (without path or query). We do not store full IP addresses or request URLs.

You are the controller of the end-user data you send us; you are responsible for having a lawful basis and your own privacy notice covering it.

4. How we use information

We use the data we collect to:

• operate your account and dashboard;
• compute metrics, rollups, and automated insights;
• send you product and account notifications you opt into (e.g. Telegram digests or email alerts);
• secure the service and prevent abuse (rate limiting, bot scoring).

We do not sell your data or your end-users' data.

5. Sub-processors

We rely on a small set of infrastructure providers to run the service:

• Supabase — authentication and Postgres database;
• Cloudflare — hosting, edge delivery, and bot/geo signals;
• Resend — transactional email (account and alert emails);
• Telegram — only if you choose to link a chat for notifications.

Provider data is fetched directly from the analytics/ad platforms you connect (Google, Meta).

6. Data retention

Account and project configuration are retained for as long as your account is active. We retain raw owned events and the metric snapshots derived from them while your account is active and as needed to operate and improve the service; raw events are continuously aggregated into the metrics and insights that power your dashboard. We do not guarantee a fixed deletion window at this time. You can request deletion of your data at any time by contacting us (see your rights below), and we may retain limited information where required to meet a legal obligation.

7. Security

Provider tokens are encrypted at rest. API keys are stored only as salted hashes and shown to you once at creation. Access to your data in the dashboard is enforced by row-level security scoped to your account.

8. Your rights

Depending on where you live, you may have rights to access, correct, export, or delete your personal data. To exercise them, contact us using the address below and we will respond within the time required by applicable law.

9. Changes

We may update this policy as the product evolves. Material changes will be reflected by updating the effective date at the top of this page.

10. Google API Services Limited Use

When you connect Google Analytics 4, Firebase, or Google Search Console, VibesAnalytics's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We request the following Google access only to power features you see in your dashboard:

• Google Analytics 4 — read-only access to your reporting data (sessions, users, events, conversions, and revenue), and, when you ask us to set up analytics, creating a Google Analytics property and data stream on your behalf;
• Firebase — read-only access to your linked Firebase/Google Analytics property to display mobile app metrics;
• Google Search Console — access to your search performance data (clicks, impressions, queries, and average position) and, when you ask us to, verifying ownership of and registering a site and submitting sitemaps on your behalf;
• your Google account email address, used only to show and manage which Google account is connected.

We use this Google user data solely to provide and improve these user-facing features. We do not use it for advertising, and we do not transfer it to others except as necessary to provide or improve these features, to comply with applicable law, or as part of a merger or acquisition. We do not allow humans to read your Google user data unless we have your affirmative consent to view specific data, it is necessary for security purposes or to comply with applicable law, or the data is aggregated and anonymized for internal operations.

11. Contact

Questions about this policy can be sent to privacy@vibesanalytics.com.