Privacy Policy
Last updated: 27 May 2026
This policy explains how vibecode.fun (operated by Midcurved Labs) collects, uses, and protects your personal data. We process data under the EU GDPR and the ePrivacy Directive.
1. Who we are (controller)
- Legal entity: Midcurved Labs
- Postal address: [address — see contact email below until updated]
- Contact: [email protected]
2. What we collect
- Account: email, hashed password or OAuth identifier
- Handle & profile content you publish (public by design)
- Stripe payment data when you upgrade (we never see card numbers)
- Prompt-generator inputs you submit + outputs we return
- Anonymised analytics via PostHog (EU)
3. Lawful bases (Art. 6 GDPR)
- Account & service delivery — Art. 6(1)(b) contract
- Marketing emails — Art. 6(1)(a) consent + ePrivacy Art. 13
- Product analytics (anonymised) — Art. 6(1)(f) legitimate interest
- Fraud / abuse prevention — Art. 6(1)(f)
- Tax / accounting retention — Art. 6(1)(c)
4. Sub-processors
- Supabase (US) — auth + database. DPF + SCCs.
- Vercel (US) — hosting. DPF + SCCs.
- Stripe (IE — Stripe Payments Europe) — payments. EU entity.
- PostHog (EU — Frankfurt) — analytics. EU-resident.
- Anthropic (US) — prompt-generator inference. Does not train on API inputs. DPF + SCCs.
5. International transfers (Art. 44–49)
Where data leaves the EEA we rely on the EU-US Data Privacy Framework where the processor is certified, otherwise Standard Contractual Clauses. All transit is TLS 1.3+; data at rest is encrypted.
6. Retention
- Active account: while you remain active
- Server logs: 90 days
- Payment records: 7 years (tax obligation)
- Deleted accounts: purged within 30 days of request, except suppression-list hash
7. Your rights (Art. 15–22)
You may access, correct, delete, restrict, port, or object to processing of your data, and withdraw consent at any time. Email [email protected] — we respond within 30 days (Art. 12(3)). You may also lodge a complaint with your national supervisory authority.
8. Cookies and tracking
vibecode.fun uses strictly necessary auth cookies. PostHog analytics is configured to require consent before capture. No marketing cookies, no third-party trackers without consent.
9. Children
vibecode.fun is not directed at children under 16. If you believe a child has provided us with data, contact us and we will delete it.
10. Changes
Material changes are notified at least 30 days in advance.