Privacy policy

1. Who we are

vibe-code.nl is an initiative of Scrum Facilitators, Computerweg 37, Amersfoort, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 81416385. We are responsible for processing your personal data as described in this policy. Questions? Get in touch via the contact form.

2. What data we process

• Your account: name, email address and your password. We never store your password in readable form, only as an encrypted hash. If you sign in with Google, Google gives us your name and email address. If you sign in with TikTok, TikTok only gives us a fixed code for your TikTok account and your display name; you enter your email address yourself, at the latest when you put an app online. We never post anything to TikTok or read your videos or other data.
• What you build: your instructions to the AI, the responses, images you attach, the code and files of your apps, previous versions, and a screenshot and icon of your app for your overview. If you give the address of an existing website, we store what the AI takes from it in your app (such as text, logo and photos).
• Credits and payments: your purchases, your credit balance and the usage per instruction. You enter your payment details (such as your account or card number) with Stripe; we do not see them.
• Published apps and the gallery: the name and address of apps you put online, the hosting usage per app (to monitor the usage limits), and if you share an app in the gallery: the description and your first name.
• Inviting others: who invited you, or who you invited. The person who invited you only sees your first name, when you signed up and whether the reward has been paid out.
• Your own database: if you connect a database to your app, we store its address in encrypted form. You manage the data in that database yourself.
• Courses: your enrolments, payments and which lessons you have completed.
• Contact and reports: messages you send via the contact form, and reports about apps in the gallery.
• Technical data: such as your IP address, needed to keep the site secure and to prevent abuse. With your consent, we measure how the site is used; see cookies.

3. Why we do this

• To provide the service (performance of the contract): your account, building and publishing your apps, your credits and your courses.
• To email you about your account: a welcome email, a link if you forget your password, a confirmation when you buy credits and a message when a published app approaches or exceeds its usage limit. We do not send newsletters unless you ask for them yourself.
• Legal obligation: we keep invoices and payment details for as long as tax law requires.
• Legitimate interest: securing the site, preventing abuse and fraud, handling reports about apps and improving the service.
• Consent: statistics with Microsoft Clarity and measuring ads with the TikTok pixel and Google Ads. You can withdraw this consent at any time.

4. AI and your data

Building is done with Claude, the AI from Anthropic. Your instructions, attached images and the code of your app are sent to Anthropic for this purpose. Under Anthropic's terms for business customers, Anthropic does not use that data to train its AI. So do not put sensitive personal data, passwords or other secrets in your instructions.

The AI can search the internet for facts and free-to-use photos for your app. Only search terms are sent to the search service, not your personal data. If you give the address of an existing website, your app's working environment visits that website to look at it, just as a regular visitor would.

5. Who we share data with

We never sell your data. We use the following service providers, who only process your data on our behalf:

• Vercel: hosting of the site, the working environments in which your apps are built, and the published apps.
• Anthropic: the AI that builds your apps and comes up with names and next steps.
• Stripe: payments.
• Resend: sending emails about your account.
• Google: if you sign in with Google, and with your consent to measure which ads work (Google Ads).
• Microsoft Clarity: statistics, only with your consent.
• TikTok: if you sign in with TikTok, and with your consent to measure which ads bring in visitors and signups. If you are logged in, your email address and account ID are only sent as an unreadable hash (SHA-256).
• Prisma: only if you choose a fast database for your app yourself.
• Our hosting and database provider: for storing the data described in this policy.

6. Outside Europe

Some of these service providers are based in the United States or process data there. This only happens with the safeguards required by the GDPR, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

7. How long we keep data

• Your account, apps and conversations: for as long as your account exists. If you delete an app, its code, versions and conversation are deleted.
• Data about payments and credits: 7 years, because tax law requires it.
• Password reset links: they work for one hour and are unusable after that.
• Messages via the contact form and reports about apps: for as long as needed to handle them, and no longer than 2 years.

8. Your rights

You have the right to access your data, have it corrected or deleted, object to processing, have processing restricted and take your data with you. You can always download the code of your apps yourself, and you can delete your account yourself under Your account. Want to exercise another right? Send a message via the contact form. We respond within one month.

If you disagree with how we handle your data, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

9. Data in your apps

If an app you build collects data from others, for example via a contact form or in your own database, you are responsible for that. Tell the visitors of your app what you do with their data.

10. Visitors to published apps

So that you can see how many people view your app, we count the page views of published apps. We do not use cookies for this and do not store IP addresses. To count a visitor only once per day, we create an encrypted code from the IP address, the browser, the app and the date; this code cannot be reversed and we delete it after one day. All that remains are daily counts.

11. Security and changes

We protect your data with appropriate measures, such as encrypted connections, encrypted storage of passwords and database addresses, and separate, isolated working environments for each app.

If we change this policy, you will see this from the date at the top. We will let you know about important changes.