Privacy Policy

1. Who we are

This Privacy Policy explains how AIVolve LLC, an Illinois limited liability company ("AIVolve," "we," "us," or "our"), collects, uses and shares information when you visit vibecodersos.com or use the VibeCoderSOS services, including the free X-ray scan, our command-line tool, and any paid outcome, developer session or maintenance plan (together, the "Services").

For personal information covered by the EU/UK GDPR, AIVolve LLC is the "controller" of website, account and billing data. When we process personal information that sits inside your code, database or app on your behalf during a paid project, we act as your "processor" and follow your instructions.

Contact: support@aivolve.com · 1552 South Route 59 #1159, Naperville, IL 60564

2. Information we collect

Information you give us

• Contact and signup details: email address, name (if provided), the link to your app or repository, and the platform you built with (for example Lovable, Bolt, Replit, v0, Cursor or Claude Code). Our website forms collect this.
• Project information: descriptions of your app, the outcome you want, messages, call notes, and files you send us.
• Code and app materials: source code, configuration files, a pasted package.json, or a zip export that you choose to share for an X-ray or a paid project.
• Environment variable and secret names: the X-ray records the names of keys and settings your app expects (for example SUPABASE_URL or STRIPE_SECRET_KEY) so we can tell you which accounts you need. We do not ask for, and do not intentionally store, the values of secrets during an X-ray. If the X-ray spots a secret already committed in your code, we report its location and type so you can rotate it. We don't keep a copy of the value outside the temporary sandbox.
• Credentials and access for paid work: if you buy a paid outcome, you may choose to give us collaborator access to accounts you own (such as your hosting, domain or database provider) or to give us specific API keys. We use them only for that project. See Section 4.
• Payment information: payments are processed by Lemon Squeezy (acting as merchant of record) or Stripe. They collect your card details directly. We receive limited details such as your name, email, billing country, what you bought, and the transaction status. We never see or store your full card number.

Information collected automatically

• Usage and device data: pages viewed, buttons clicked, referring site, approximate location (from IP address), browser and device type. See Section 7 on cookies and analytics.
• Server logs: our hosting provider records standard request logs (IP address, time, URL, user agent) for security and reliability.
• Command-line tool: if you run our local scanner (for example npx vibecodersos xray), it analyzes your project on your own machine and sends us only a summary: the detected frameworks, dependencies, services, file counts, environment variable names, and findings. It does not upload your source code unless you explicitly choose to.

Information from third parties

• GitHub: if you connect our GitHub App, GitHub tells us your GitHub username, the repositories you selected, and gives us read-only access to the contents of those repositories. You choose which repositories we can see and can revoke access at any time in your GitHub settings.
• Payment providers: confirmation of payments, refunds and disputes.

3. How we use information

• To deliver the Services: generate your X-ray report, scope and carry out paid outcomes, run SOS developer sessions, and provide maintenance.
• To communicate with you about your report, your project, your account and purchases, and (if you agree, or as the law permits) occasional product updates. You can unsubscribe from marketing emails at any time.
• To process payments, refunds and invoices.
• To secure, maintain, debug and improve the Services, including measuring which pages and features are useful. When we use aggregated or de-identified statistics (for example, "40% of scanned apps use Supabase"), they do not identify you or reveal your code.
• To prevent fraud and abuse and to enforce our Terms of Use.
• To comply with law and respond to lawful requests.

Legal bases (EEA/UK users): performance of a contract (delivering the Services you request), legitimate interests (security, product improvement, and communicating with existing customers in ways you would reasonably expect), consent (non-essential analytics cookies and certain marketing, which you can withdraw), and legal obligation (tax and accounting records).

4. How we handle your code

We know handing over your code takes trust. Here's how we treat it:

• Least access. Our GitHub App asks for read-only access to the repositories you select. It cannot push, merge or delete. For paid work that requires changes, we will ask for any additional access separately, and wherever possible we propose changes as pull requests or branches that you approve.
• Free X-ray: temporary sandbox. Code for an X-ray is copied into an isolated, temporary processing environment. That environment, including the copy of your code and any uploaded zip file, is deleted once your report has been generated, and in any case within 24 hours. We keep the report itself (which may quote short file paths, file names, and brief code excerpts needed to explain a finding) so you can view it, until you ask us to delete it or your account is closed.
• Paid projects: limited retention. During a paid project, we keep the code, notes and artifacts needed to deliver the outcome. After we deliver, we keep project artifacts (such as your Owner's Manual, handoff document, deployment notes and change log) for 30 days so we can answer questions and honor the guarantee, then delete them, unless you have an active maintenance plan or ask us to keep them longer. Copies of your code are deleted on the same schedule. You can ask us to delete them sooner.
• Credentials. We prefer that you invite us as a collaborator to accounts you own rather than share passwords. If you give us API keys or other secrets, we store them only in an encrypted secrets manager or the provider's own settings, use them only for your project, and delete our copy when the project ends. We recommend rotating any credential you shared with us once the project is complete.
• No model training. We do not use your code, app data or project materials to train or fine-tune any AI model, and we do not allow our providers to do so.
• AI processing. We use Anthropic's Claude API to help analyze code and draft reports and documentation. Under Anthropic's commercial terms that apply to our API use as of the effective date of this policy, Anthropic does not use content sent through the API to train its models. Anthropic may retain API inputs and outputs for a limited period for safety and abuse monitoring, as described in its policies. A human AIVolve developer reviews the work on paid outcomes.
• NDA on paid work. All paid work is covered by the non-disclosure commitment in our Terms of Use: AIVolve and its staff and contractors keep your code, data and credentials confidential (for 3 years, and indefinitely for code and credentials), and you can request a countersigned NDA at support@aivolve.com.
• Who sees it. Only AIVolve personnel and contractors working on your project, all of whom are bound by confidentiality obligations. We never sell your code or share it publicly. We will only publish a sample report based on your app if you give us written permission.

5. How we share information

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined under California law. We share information only:

• With service providers (subprocessors) who help us run the Services, under contracts that limit their use of your data to providing services to us. See the list below.
• With third parties you direct us to, for example when we deploy your app to a hosting account you own, or connect your domain at your registrar.
• For legal reasons: to comply with law, respond to valid legal process, or protect the rights, safety and property of you, us or others.
• In a business transfer: if AIVolve or VibeCoderSOS is involved in a merger, acquisition or sale of assets, subject to this policy's protections.

Subprocessors

We will update this list when we add or change subprocessors. Accounts that you own with providers like Netlify, Railway, Supabase, Vercel or your domain registrar are governed by your own agreement with that provider, not by this policy.

6. Referral and affiliate relationships

We have referral or affiliate relationships with some providers we may recommend, including Netlify, Railway and Namecheap, and we may add others. If you sign up for or buy from one of these providers through our link, they may pay us a commission or credit. This doesn't change the price you pay.

When you click a referral link, that provider may set its own cookies to attribute the referral to us. That is governed by the provider's privacy policy. We recommend hosts based on what fits your app. If a referral link is involved, we'll label it, and you are always free to use any provider you prefer, including one we have no relationship with.

7. Cookies and analytics

Our site uses a small number of cookies and similar technologies (such as local storage):

• Strictly necessary: needed for security, spam protection on forms, and remembering your choices. These can't be switched off.
• Analytics (planned): we plan to use PostHog to understand how visitors use the site, for example which pages lead to signups. PostHog may set a cookie or local-storage identifier. If you submit a form, we may link your analytics activity to your email so we can understand our signup funnel. We configure analytics to avoid capturing sensitive form contents. Where the law requires it (for example in the EEA and UK), we will ask for your consent before setting analytics cookies.
• Third-party: fonts are served by Google Fonts and page styling by a third-party CDN, which receive your IP address when your browser loads them. Referral partners may set cookies when you click their links (Section 6).

We do not use advertising cookies or sell data to ad networks. You can block or delete cookies in your browser settings. We honor Global Privacy Control (GPC) signals as an opt-out of any analytics that is not strictly necessary.

8. How long we keep information

• X-ray code and uploads: deleted once your report is generated, and in any case within 24 hours.
• X-ray reports: until you ask us to delete them or close your account, or 12 months after your last activity, whichever comes first.
• Paid project code and artifacts: 30 days after delivery, or longer while you have an active maintenance plan or if you ask us to keep them.
• Shared credentials: deleted at the end of the project or maintenance plan.
• Signup and contact data: until you unsubscribe or ask us to delete it, or 24 months of inactivity.
• Billing records: as long as tax and accounting laws require (often up to 7 years).
• Server logs and analytics: per our providers' standard retention, typically up to 365 days.

9. Your rights and choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you and get a copy in a portable format;
• Correct inaccurate information;
• Delete your information, including your code, reports and project artifacts;
• Object to or restrict certain processing, and withdraw consent where we rely on it;
• Opt out of marketing emails (use the unsubscribe link or email us), and of any "sale" or "sharing" of personal information (we don't do either);
• Not be discriminated against for exercising these rights.

To make a request, email support@aivolve.com. We may need to verify your identity, and we will respond within the time the law requires (generally 30 days under GDPR, 45 days under California law). You can use an authorized agent where the law allows. If you're in the EEA or UK, you also have the right to complain to your local data protection authority.

You can also revoke our GitHub access at any time from your GitHub settings (Settings → Applications → Installed GitHub Apps), and remove our collaborator access from any account you own.

10. Security

We use reasonable technical and organizational measures to protect your information, including encryption in transit (HTTPS), least-privilege and read-only access by default, isolated temporary environments for scans, encrypted storage for any credentials, access limited to personnel who need it, and multi-factor authentication on our own accounts. No method of transmission or storage is completely secure, so we can't guarantee absolute security. If we learn of a breach affecting your personal information, we will notify you and any regulators as the law requires.

11. International transfers

AIVolve is based in the United States, and our providers may process data in the United States and other countries. When we transfer personal information from the EEA, UK or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or our providers' participation in the EU-U.S. Data Privacy Framework, where applicable.

12. Children

The Services are for businesses and individuals aged 18 or older. They are not directed to children, and we do not knowingly collect personal information from anyone under 16 (or 13 in the United States). If you believe a child has given us personal information, contact us and we will delete it.

13. Changes to this policy

We may update this policy as the Services evolve, for example when PostHog analytics goes live or we add a subprocessor. We'll post the new version here with an updated "Last updated" date. If a change is material, we will tell you by email or with a notice on the site before it takes effect.

14. Contact us

Questions or requests about privacy? Contact:

AIVolve LLC (operator of VibeCoderSOS)
1552 South Route 59 #1159, Naperville, IL 60564
Email: support@aivolve.com