Privacy Policy

vibecheck is a security scanning tool for GitHub repositories, operated by IgnisTech. This policy explains what data we collect when you use vibecheck, how we use it, who we share it with, and your rights over it.

The short version: we collect the minimum necessary to run the service. We never sell your data. Your source code is cloned temporarily for scanning and immediately discarded — it is never stored in our database.

Account data

When you sign in with GitHub we receive and store:

• ·Your GitHub user ID and username (login)
• ·An encrypted copy of your GitHub OAuth access token — encrypted with AES-256-GCM, stored only to perform future scans on your behalf

We do not receive or store your GitHub email address, password, or any personal profile information beyond your username.

Scan data

When you scan a repository we store:

• ·Repository metadata: name, default branch, visibility (public/private)
• ·Scan findings: file paths, line numbers, rule names, severity levels, and tool-generated descriptions
• ·AI-generated explanations and suggested fixes produced during the triage pass
• ·Scan status and timestamps

Source code is not stored. We perform a shallow clone of your repository into a temporary directory on the worker process, run the scanners, then delete the clone. No source code ever enters our database.

Billing data

Payments are processed by Stripe. We store only your Stripe customer ID and subscription ID — never card numbers, bank details, or full billing addresses. Stripe's privacy policy governs how Stripe handles your payment information.

Technical data

Our hosting infrastructure (Railway) may log standard web server data including IP addresses, request timestamps, and HTTP status codes for operational purposes. We do not use this data for tracking or profiling.

• ·To authenticate you via GitHub OAuth
• ·To clone repositories and run security scans on your behalf
• ·To display scan results, history, and finding details in the dashboard
• ·To manage your subscription and process payments via Stripe
• ·To send transactional emails related to billing (Stripe handles these directly)

We do not use your data for advertising, profiling, or any purpose beyond operating vibecheck.

We do not sell, rent, or share your data with any other third parties.

• ·Account data and scan findings are retained for as long as your account is active
• ·If you delete your account (by contacting us), all associated data is permanently deleted within 30 days
• ·Stripe retains billing records as required by financial regulations — contact Stripe directly to manage this data
• ·Repository clones are discarded immediately after each scan completes or fails

Depending on your location you may have the right to:

• ·Access — request a copy of the data we hold about you
• ·Correction — ask us to correct inaccurate data
• ·Deletion — request that we delete your account and all associated data
• ·Portability — receive your data in a machine-readable format
• ·Objection — object to processing in certain circumstances

To exercise any of these rights, email privacy.vibecheck.it@outlook.com. We will respond within 30 days.

We take reasonable technical measures to protect your data:

• ·GitHub access tokens are encrypted at rest with AES-256-GCM — a database breach alone does not expose your tokens
• ·All traffic is encrypted in transit via HTTPS/TLS
• ·Sessions use signed JWTs stored in httpOnly cookies
• ·Database access is restricted to our application services

No security measure is perfect. If you discover a vulnerability, please disclose it responsibly to privacy.vibecheck.it@outlook.com.

We use two cookies:

• ·vc_session — your signed session token, httpOnly, expires after 14 days
• ·gh_oauth_state — CSRF protection during GitHub sign-in, httpOnly, expires after 10 minutes

We do not use tracking cookies, analytics cookies, or advertising cookies.

We will update this policy when our data practices change. Significant changes will be communicated by updating the effective date above. Continued use of vibecheck after changes constitutes acceptance.

Questions, data requests, or concerns: privacy.vibecheck.it@outlook.com