Privacy Policy

Veridux Labs is the controller of the Service's database: it decides why and how the data is processed. For any privacy question or request: contact@vibe-coding.academy.

The service providers listed in section 6 process data for us and on our instructions. Lemon Squeezy, which sells the subscription as merchant of record, and Google, when you sign in with a Google account, also act as independent parties under their own privacy policies.

We only collect what the Service needs. Depending on how you use it:

• Account: email address, password (stored hashed by Supabase Auth; we never see it), and your full name if you give it when signing up. If you sign in with Google, Google gives us your name, email and profile picture. You can also sign in with a link sent to your email.
• Learning: lessons you completed, learning events (lesson started, step completed, hint, solution viewed, reset, completed), quiz results and completion certificates. A certificate shows the name you entered, the course, the score and the date, and anyone with its link or verification code can see it.
• Subscription and payment: you give your payment details directly to Lemon Squeezy, and we never receive your card number. We keep the subscription record: email, Lemon Squeezy customer, order and subscription IDs, plan, status and renewal dates, plus the event message as Lemon Squeezy sends it, which can include your name, email, card brand and the card's last four digits.
• Newsletter and waitlist: email address, where you signed up and the date.
• Content you send: messages to ViBot and prompts in Studio; code or sessions you paste for a check; apps you publish in Studio, and data that visitors to your published app save in it; feedback (name, email, message, rating and the page it was sent from); lesson feedback (thumbs up or down and free text); creator submissions (name, email, bio, links and content details); and emails you send us.
• GitHub connection (only if you choose to connect): an access token with the public_repo scope, used to push your project to the repository you choose.
• Technical and usage data: IP address, browser and device type, screen size, language, pages visited, where you came from, campaign parameters (utm_*, gclid), scroll depth, performance metrics and page errors. Most of this is collected by the analytics tools in section 6 and in the hosting provider's server logs. We also store our own funnel events (paywall view, click, checkout start, lesson start and completion) with a random browser ID, the page (without URL parameters), the language, and your user ID if you are signed in; no IP address and no email. For ViBot and checks we also keep usage data: model, token counts, response time and lesson ID, linked to your user ID or to a hashed identifier. To enforce usage limits for signed-out users we store a keyed hash of the IP address, not the address itself.
• Data stored only in your browser, such as lesson progress and Studio projects, is described in the Cookie Policy. It is not sent to us, unless you are signed in and the Service syncs progress to your account.

We do not ask for special-category data (such as health data, beliefs or biometrics). Do not include such data, passwords, API keys or other people's personal data in messages, code or sessions you send. For code and session checks we try to remove known secrets (such as API keys) before sending to the AI provider, but the filter is not perfect.

You are under no legal obligation to give us data. Giving it depends on your choice and consent, but without some data we cannot provide certain features (for example, you cannot open an account without an email address).

We do not sell personal data and do not use it for personalised advertising. We do not make automated decisions that have a legal or similarly significant effect on you.

When you send a message to ViBot, a prompt in Studio, code or a session for a check, or a request to the Blueprint generator, the content is sent to a language-model provider to produce a response: Anthropic (Claude models) or Google (Gemini models), depending on the model selected. The providers process it under their commercial API terms.

We do not store the content of ViBot and Studio messages on our servers; we keep only the usage data in section 2. In a standard check, your code or session is not kept after the response is returned. In a background audit, the input is stored encrypted until the audit runs and is deleted right after, or after 24 hours at most; the result is kept for 30 days, and you can delete it sooner.

We use essential cookies (sign-in, language, security), local storage for progress and preferences, Google Analytics and StatCounter analytics cookies, a Veridux Analytics identifier, and a random browser ID for our own funnel events. The Google Analytics, StatCounter and Veridux Analytics cookies load only if you click "Accept all" in the cookie banner; if you choose "Essential only" they are not loaded at all. Veridux Analytics also does not count a browser that sends a Do Not Track signal. The full list, and how to change your choice, are in the Cookie Policy.

Cookie Policy

We share data only to provide the Service, and only with these parties:

An app you choose to publish in Studio, and a completion certificate, are public at their own address.

We will also disclose data where the law, a court order or a competent authority requires it, or to protect our rights and users' safety. If the business is transferred (for example in a merger or sale), the data will move to the new owner subject to this policy, and we will tell you.

Most of our service providers are outside Israel, mainly in the United States and the European Union, so data is stored and processed there. We transfer data abroad under the Protection of Privacy (Transfer of Data to Databases Abroad) Regulations, 5761-2001, relying on the providers' contractual data-protection commitments (such as standard contractual clauses or the Data Privacy Framework, where they apply).

We take reasonable measures to protect data, in line with the Protection of Privacy (Data Security) Regulations, 5777-2017: traffic is encrypted (HTTPS); database access is limited by row-level security rules, so each user sees only their own data; server keys are never exposed to the browser; background audit input and GitHub tokens are stored encrypted; IP addresses used for usage limits are stored only as a keyed hash; and access to data is limited to those who need it to run the Service.

No system is completely secure. If a serious security incident happens, we will report it to the Privacy Protection Authority and to the people affected, as the law requires.

Under the Protection of Privacy Law you may:

• inspect the data about you held in our database;
• ask us to correct or delete data that is inaccurate, incomplete, unclear or out of date;
• ask us to delete your account and the data linked to it;
• ask us not to send you marketing, and unsubscribe from the newsletter at any time (every email has an unsubscribe link);
• withdraw consent you gave, without affecting processing done before.

To exercise a right, email contact@vibe-coding.academy, ideally from your account email address. We may ask you to verify your identity before we hand over or delete data. We will reply within 30 days. If we refuse a request, we will explain why, and you may appeal as the law allows.

Some actions are available to you directly: deleting check results, disconnecting GitHub in Studio, cancelling a subscription through the link in Lemon Squeezy's emails, and unsubscribing from the newsletter.

Deleting your account does not delete records we must keep by law (such as payment records), and it does not delete data stored only in your browser; you can clear that yourself in your browser settings.

If you believe we have infringed your privacy, you can contact the Privacy Protection Authority at the Israeli Ministry of Justice. We would appreciate the chance to resolve it with you first.

If the GDPR (or UK GDPR) applies to you, you also have these rights: access, rectification, erasure, restriction of processing, objection to processing based on legitimate interest, data portability, and withdrawal of consent. You may also complain to the data protection authority in your country. The basis for each kind of processing is in section 3. You can exercise these rights at the same address: contact@vibe-coding.academy.

Under the Terms, the Service is intended for people aged 18 or over, or for minors with the consent and supervision of a parent or guardian. The site has a content track for teenagers, which minors can view without an account.

Children under 13 may not open an account or give us personal data. In EU countries with a higher age of consent (up to 16), a parent's consent is needed for any processing based on consent. If we learn we have received a child's data without that consent, we will delete it. A parent who thinks their child has given us data is welcome to contact us.

We send the newsletter or marketing messages only if you signed up for them, in line with section 30A of the Israeli Communications (Telecommunications and Broadcasting) Law, 5742-1982. Every email has an unsubscribe link. Service emails about your account or subscription (such as a receipt or a cancellation confirmation) are sent even without a newsletter signup.

We may update this policy. We will announce material changes on the site, and email registered users, at least 14 days before they take effect. A non-material change, such as a wording fix or an update to the provider list without a change in purposes, takes effect when published, and the date at the top of this page is updated.

Privacy questions and requests: contact@vibe-coding.academy. We usually reply within 1–2 business days.

Cookie PolicyTerms of ServiceContact