1. Introduction

VibeMetricsAI ("we," "us," or "our") operates the VibeMetricsAI platform, an AI-powered relationship intelligence service accessible at vibemetricsai.com (the "Service"). This Privacy Policy applies to all visitors, registered users, and subscribers who access or use any part of the Service. It describes the types of information we collect, the purposes for which we use it, how we store and protect it, with whom we may share it, and the choices you have regarding your personal data. By creating an account or using the Service, you agree to the practices described in this policy. If you do not agree, please discontinue use of the Service.

2a. Information You Provide — Account & Authentication

When you register for an account, we collect the information necessary to create and manage your account:

Email address used to create your account.
Password (stored as a cryptographic hash — we never store your plaintext password).
Google OAuth profile data if you choose to sign in with Google, including your name, email address, and profile picture URL provided by Google.
Email verification status and any verification tokens generated during the signup flow.
Account preferences and settings you configure within the platform.

2b. Information You Provide — Profile & Relationship Preferences

To personalize your experience and generate relevant AI analysis, we collect optional profile and preference information you choose to enter:

Your displayed name or username.
Relationship goals, dating preferences, and communication style preferences you configure during onboarding.
Profile details about the connections you track (e.g., names, notes, relationship labels, and context you add to match profiles in the Match Dashboard).
Custom "blueprints" or templates you save for reply generation and coaching prompts.

2c. Information You Provide — AI Conversations & Submitted Content

The core functionality of the Service requires you to submit content for AI analysis. This includes:

Chat logs and conversation text that you paste or type into the chat analysis tool.
Screenshots of conversations uploaded for analysis. These are processed ephemerally — see Section 3 for full details.
Inputs you provide to the Reply Generator and Opener Engine, including conversation snippets and contextual notes.
Inputs, scenario choices, and dialogue entries you make within Dating Simulator sessions.
Any free-text notes, observations, or commentary you add to match profiles in your Match Dashboard.
Feedback or support messages you send to us directly.

2d. Information Collected Automatically — Technical & Usage Data

When you access the Service, we and our infrastructure providers automatically collect certain technical information to operate, secure, and improve the platform:

IP address and approximate geolocation (country or region level).
Browser type, version, and user agent string.
Device type and operating system.
Pages visited, features used, and interaction patterns within the Service (e.g., which tools you open, how frequently).
Session identifiers and authentication tokens used to maintain your logged-in state.
HTTP request metadata including timestamps, referrer URLs, and response codes, retained in Cloudflare access logs.
Error logs and crash reports used for debugging and platform reliability.

2e. Information Collected Automatically — Cookies & Similar Technologies

We use cookies and similar browser storage mechanisms to authenticate your session and support platform functionality. See Section 6 for a full breakdown of cookies used and your choices.

Session cookies set by Supabase authentication to maintain your login state.
Cookie consent preference records stored in your browser's local storage.
Analytics cookies, if you have consented, used to understand aggregate usage patterns.

2f. Information From Third Parties — Billing

If you purchase a paid subscription, our payment processor Paddle handles the transaction. We receive limited billing-related data from Paddle to manage your subscription:

Subscription plan name, status (active, cancelled, past-due), and renewal dates.
Billing country and currency for tax compliance purposes.
Transaction identifiers used to reconcile billing records.
We do not receive or store your full credit card number, card verification codes, or other sensitive payment instrument details. All payment data is handled directly by Paddle under their own privacy and security standards.

2g. Information Generated by the Platform

The Service creates and stores certain derived data based on your inputs and usage:

AI-generated analysis results, including ghosting risk scores, interest level readings, sentiment summaries, and communication pattern diagnostics, associated with your account.
AI-generated reply suggestions and opener recommendations you have requested.
Match memory facts and relationship insights derived from notes and content you have added to your Match Dashboard.
Usage metrics such as the number of analyses performed, features accessed, and tokens consumed, used to enforce plan limits and track subscription usage.

3. Screenshot & Image Processing

VibeMetricsAI allows you to upload screenshots and images of conversations for AI analysis. The following describes exactly how this content is handled:

Processing method: Uploaded images are transmitted securely over HTTPS to our Cloudflare Worker edge functions. They are loaded into memory, passed to an AI vision model for optical character recognition (OCR) and content analysis, and the resulting text and analysis are returned to you.
Zero persistence: Raw image files are never written to disk, saved to Cloudflare R2 object storage, or stored in our database. The image data exists only in the transient memory of the processing runtime for the duration of the request.
Retention: Once the API request completes and the analysis result is returned, the image data is discarded. There is no backup, cache, or secondary copy of your uploaded images on our infrastructure.
AI model transmission: The image or extracted text may be transmitted to a third-party AI inference provider as part of the analysis request. This transmission is subject to the inference provider's data handling policies (see Section 7).
Extracted text: Text extracted from your screenshots through OCR may be included in the AI analysis result stored with your account, if you choose to save the result. The original image is not stored.
Your responsibility: You are responsible for ensuring you have the right to upload and process any images you submit, including obtaining consent from any individuals whose private messages appear in the screenshots.

4. AI Processing & Inference

The AI-powered features of VibeMetricsAI are delivered through large language model (LLM) and vision model inference. The following explains how your content is processed by these systems:

AI providers: We use third-party AI inference APIs to power chat analysis, reply generation, coaching advice, and dating simulator sessions. The identity of inference providers may change over time as we evaluate and upgrade model capabilities.
Prompt construction: When you submit content for analysis, our platform constructs a structured prompt that includes your submitted text (and/or extracted image content) along with system-level instructions. This combined prompt is sent to the inference API.
Response generation: The AI model processes the prompt and returns a generated response, which our platform formats and presents to you as the analysis result, reply suggestion, or coaching output.
No training on your data: We do not use your submitted conversations, chat logs, screenshots, or personal content to train, fine-tune, or improve our own AI models. VibeMetricsAI does not operate its own model training infrastructure.
Third-party inference provider data handling: Inference providers may process your prompt data in accordance with their own terms and privacy policies. We select providers that offer appropriate data protection commitments, including options for data not to be used for model training. Refer to Section 7 for more detail.
AI limitations: AI outputs are probabilistic and may be inaccurate, biased, or contextually inappropriate. Outputs are for informational and entertainment purposes only and must not be treated as professional advice. See our AI Disclaimer for full detail.

5. How We Use Your Information

We use the information we collect only for the following legitimate purposes:

Service delivery: Authenticating your account, processing your submitted content through AI analysis, generating outputs (analysis results, replies, coaching advice, simulator sessions), and displaying results within the platform.
Account management: Managing your subscription status, enforcing usage limits, sending essential account-related communications (email verification, password reset, billing alerts), and maintaining your stored data.
Match Dashboard & Memory: Storing and organizing the notes, metrics, and AI insights you have created about your connections, so you can access and update them across sessions.
Platform security: Detecting and preventing fraud, abuse, unauthorized access, prompt injection attacks, rate limit circumvention, and other misuse of the platform.
Usage analytics: Understanding aggregate, anonymized patterns of how features are used to improve the product and prioritize development.
Legal compliance: Meeting obligations under applicable law, responding to lawful requests from authorities, and enforcing our Terms of Service.
Support: Responding to questions, bug reports, and account issues you submit to us.
Billing: Processing subscription purchases and managing billing records in coordination with Paddle.

6. Cookies & Similar Technologies

We use cookies and browser storage to operate the Service. The following categories are in use:

Essential / Authentication cookies: Set by our Supabase authentication layer to maintain your logged-in session. Without these cookies, you cannot access authenticated areas of the platform. These are always active and do not require your consent.
Security cookies: Used for CSRF protection and fraud prevention mechanisms built into the Cloudflare edge layer. Always active.
Preference cookies: Store your settings such as cookie consent status, saved in browser local storage. Always active.
Analytics cookies (optional, consent-required): If you accept analytics cookies through the cookie consent banner, we may use privacy-respecting analytics tools to collect aggregate, anonymized data about page visits and feature usage. You can withdraw this consent at any time via the Cookie Preferences page.
Marketing cookies: We do not currently deploy marketing or advertising cookies. This may be updated in the future, and any change will be reflected in an updated policy with prior notice.
Cookie controls: You can manage cookie settings through your browser. Blocking all cookies will prevent the authentication system from working and will prevent you from accessing your account. You can also update your analytics consent preferences at any time via /cookie-preferences.

7. Third-Party Services & Integrations

The following third-party services are integrated into the VibeMetricsAI platform. Each processes certain data as described:

Supabase (supabase.com): Provides our authentication infrastructure, including email/password login, Google OAuth, email verification, and session management. Supabase stores account credentials and authentication tokens on our behalf. Data is stored in Supabase-managed PostgreSQL databases subject to Supabase's security and privacy standards.
Cloudflare (cloudflare.com): Powers our edge computing infrastructure via Cloudflare Workers and Pages. All traffic to VibeMetricsAI routes through Cloudflare's global network. Cloudflare processes HTTP request metadata, IP addresses, and request payloads as part of normal edge request routing and DDoS protection. Cloudflare's data processing is governed by their privacy policy and GDPR Data Processing Addendum.
AI Inference Providers: We transmit prompt data (including submitted conversation text and image-extracted text) to one or more third-party AI model providers via their APIs for the purpose of generating analysis outputs. We use providers that offer data processing agreements and, where available, opt-out of data retention for model training. The names of current inference providers are available upon request by contacting support@vibemetricsai.com.
Paddle (paddle.com): Processes subscription payments and manages billing on our behalf. Paddle acts as a Merchant of Record for our paid plans, collecting payment details, handling tax compliance, and issuing receipts directly to users. Paddle's privacy policy governs the handling of your payment information.
Google OAuth: If you choose to sign in with Google, Google shares your name, email address, and profile picture with us as part of the authentication process. We use this data only to create and identify your account. We do not receive your Google password or access to your broader Google account data.

8. Data Sharing

We do not sell, rent, or trade your personal data to third parties. We may share information only in the following limited circumstances:

Service providers: We share data with the trusted infrastructure providers described in Section 7 (Supabase, Cloudflare, Paddle, AI inference providers) solely to the extent necessary to deliver the Service. These providers are contractually bound to process data only according to our instructions.
Legal obligations: We may disclose personal data if required to do so by applicable law, court order, subpoena, or lawful request from a government authority. We will, where legally permitted, notify you before disclosing your data in response to such a request.
Safety and fraud prevention: We may share information with law enforcement or other parties where we believe in good faith that disclosure is necessary to prevent serious harm, fraud, or illegal activity involving the Service or its users.
Business transfers: In the event of a merger, acquisition, asset sale, or reorganization, your personal data may be transferred to the acquiring entity. You will be notified of any such transfer and the privacy practices of the successor entity via a policy update.
With your consent: We may share your information for any other purpose with your explicit prior consent.
Aggregate, anonymized data: We may share non-personally-identifiable, aggregated usage statistics and analytics data with third parties for research, industry reporting, or product improvement purposes. This data cannot be used to identify individual users.

9a. Data Retention — Account & Profile Data

We retain different categories of data for different periods based on operational necessity and legal requirements:

Account credentials and profile data: Retained for the lifetime of your account. When you delete your account, your email address, password hash, and profile information are permanently deleted from our primary database within 30 days.
Match Dashboard data (notes, profiles, saved facts, and metrics): Retained for the lifetime of your account. Deleted on account deletion.
AI analysis results you have saved: Retained for the lifetime of your account. You can delete individual results from within the platform at any time. All saved results are deleted upon account deletion.
Billing records: Paddle retains transaction records for the period required by applicable tax and accounting laws (typically 7 years), which is outside our direct control. Our internal billing metadata (subscription plan, status, renewal dates) is retained for the lifetime of the account and deleted within 30 days of account closure.

9b. Data Retention — Uploaded Content & Logs

The following retention periods apply to ephemeral content and system-generated logs:

Uploaded screenshots and images: Not retained. As described in Section 3, images are processed in-memory and immediately discarded. Retention time is zero.
Submitted chat text (for analysis): Text submitted for analysis is used to construct the AI prompt. If you do not save the resulting analysis, the submitted text is not retained beyond the session. If you save an analysis result, the text excerpt associated with that result may be stored as part of the result record.
Server and access logs: Infrastructure access logs maintained by Cloudflare are retained for up to 30 days for security and debugging purposes, after which they are automatically purged.
Authentication logs: Login event logs retained by Supabase for up to 90 days for security auditing purposes.
Backups: Database backups may retain your data for up to an additional 30 days beyond the deletion of the primary record, after which backup copies are also purged.

10. Your Privacy Rights

Depending on your jurisdiction, you may have the following rights with respect to your personal data. To exercise any of these rights, contact us at support@vibemetricsai.com:

Right of Access: You have the right to request a copy of the personal data we hold about you and information about how we use it.
Right to Correction: You have the right to request correction of inaccurate or incomplete personal data we hold about you. You can update most profile information directly within your account settings.
Right to Deletion: You have the right to request deletion of your personal data. You can delete your account at any time through your account settings, which triggers permanent deletion of your account and associated data within 30 days. You can also contact support@vibemetricsai.com to request deletion of specific data.
Right to Data Portability: You have the right to request a machine-readable export of your personal data in a structured, commonly used format.
Right to Restriction: You have the right to request that we restrict the processing of your personal data in certain circumstances (e.g., while a dispute about accuracy is resolved).
Right to Object: You have the right to object to the processing of your personal data where processing is based on legitimate interests, including the right to object to analytics tracking.
Right to Withdraw Consent: Where processing is based on your consent (e.g., analytics cookies), you may withdraw consent at any time without affecting the lawfulness of prior processing.
Response time: We will respond to all verified rights requests within 30 days. We may need to verify your identity before processing a request. If we are unable to fulfill a request, we will explain why.

11. Security

We implement industry-standard technical and organizational security measures designed to protect your personal data against unauthorized access, alteration, disclosure, and destruction. Current security practices include:

All data in transit is encrypted using TLS 1.2 or higher.
Passwords are stored as cryptographic hashes using a strong hashing algorithm (bcrypt or equivalent). We never store plaintext passwords.
Authentication session tokens are generated securely and expire after a defined inactivity period.
Access to production systems and databases is restricted to authorized personnel and protected by multi-factor authentication.
Our Cloudflare edge layer provides DDoS mitigation, web application firewall (WAF) rules, and bot protection.
We conduct periodic review of our security practices and address identified vulnerabilities in a timely manner.
Important limitation: No system connected to the internet can be guaranteed to be 100% secure. While we implement strong safeguards, we cannot guarantee absolute security against all possible threats. In the event of a security incident that materially affects your data, we will notify you as required by applicable law.

12. Children's Privacy

VibeMetricsAI is intended for users aged 18 and older. We do not knowingly collect personal data from individuals under the age of 18. If you are under 18, you must not use the Service or create an account. If we become aware that we have inadvertently collected personal data from a person under 18, we will take prompt steps to delete that information and close the associated account. If you believe we may have collected data from a minor, please contact us immediately at support@vibemetricsai.com.

13. International Data Processing

VibeMetricsAI operates globally using cloud infrastructure providers (Cloudflare, Supabase) whose servers and data centers may be located in the United States and other countries. If you access the Service from outside the United States, your data may be transferred to, stored in, or processed in the United States or other jurisdictions that may have different data protection laws than your country of residence. By using the Service, you acknowledge and consent to such transfers. Where required by applicable law (such as the EU GDPR), we rely on appropriate legal transfer mechanisms including Standard Contractual Clauses to govern international data transfers. For more information, please contact support@vibemetricsai.com.

14. Changes to This Policy

We reserve the right to update this Privacy Policy at any time to reflect changes in our practices, the features of the Service, or applicable law. When we make material changes, we will update the "Last updated" date at the top of this policy and notify you by one or more of the following means: an in-app notification when you next log in, or an email to your registered address if the change materially affects your rights or how we handle your data. We encourage you to review this policy periodically. Your continued use of the Service after the effective date of an updated policy constitutes your acceptance of the revised terms. If you disagree with a change, you should discontinue use and may request account deletion.

15. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your privacy rights, or want to report a privacy concern, please contact us at support@vibemetricsai.com. We aim to respond to all privacy inquiries within 30 days. Please include your account email address and a clear description of your request so we can assist you efficiently.