Privacy Policy, Vibe Check

This Privacy Policy explains how Vibe Check (stylized *vibeCheck*) ("Vibe Check," "we," "us," or "our"), operated by Creative Labs AI, LLC, collects, uses, discloses, and protects information in connection with the Vibe Check mobile application for iOS, our website at vibecheck.cre8ivelabs.ai, and related services (collectively, the "Service"). By using the Service, you agree to this Policy. If you do not agree, do not use the Service. The Service is intended only for users 18 years of age or older.

Vibe Check is a for-entertainment product: you upload a photo and receive a playful, AI-generated "vibe" read. It is not a real assessment of any person and does not detect, measure, or predict any person's character, personality, behavior, trustworthiness, attractiveness, intentions, or safety.

1. Information We Collect

Information you provide.

• Account information. When you register with Sign in with Apple, Google Sign-In, or email, we create an account and store your email address, your authentication provider identity, a unique user identifier (UUID), and, optionally, a name you provide. We do not receive your Apple ID or Google Account password. We also record your language preference, the version of our Terms you accepted and the time you accepted it (terms_version and terms_accepted_at), and your account creation timestamp.
• Photos you upload. To use the Service, you upload a photo that depicts a face, together with a small thumbnail of it generated on your device. Uploaded photos are facial images. They are stored in a private cloud storage bucket, in a location scoped to your account and protected by row-level security, so that they are not publicly accessible. What we keep afterwards, and for how long, is described in Section 2 under "Use, sharing, retention, and deletion of face data."
• Analysis results. For each photo you submit, our AI generates a structured description (a 26-field JSON result) consisting of facial-feature descriptors (such as face shape, jawline, and gaze) together with playful, entertainment-only "vibe" fields. We store this result in association with your account, along with operational metadata such as the AI model name, processing cost, and latency, and any error text if the analysis fails.
• Purchase records. When you make a purchase, we store a purchases ledger entry: the source of the purchase (Apple), an external transaction identifier, a description of what was purchased (for example, "vibes15_monthly" or "credits_3"), the amount, the currency, and a timestamp. Vibe Check does not collect or store your full payment card information; card data is handled directly by the App Store. All purchases are made in the iOS app through Apple In-App Purchase; we do not currently offer any other purchase mechanism.
• Account state. We store your current credit balance and, if applicable, the date through which any legacy Premium access is valid (premium_until). Credits are added to your balance when you buy them, as a subscription deposit or a one-time credit pack, and when we grant them, for example as a referral reward.
• Communications. Information you send when you contact us or submit feedback.

Information collected automatically. Standard app and usage data and diagnostic data generated as you use the Service, and backend structured logs of Service activity. Our logs are written through a logger that sanitizes and redacts sensitive values such as signed-URL tokens and user UUIDs.

• Product-analytics events (first party). The App and our website record how the Service is used, so that we can find and fix usability and reliability problems. These events are generated by our own code and sent to our own backend, not to an analytics vendor. They consist of: the screens you view and the order in which you view them; taps on in-app controls, identified by a fixed name we assign to the control (for example, the button that starts a vibe check); the coordinates of a tap, expressed as a position within the screen area rather than as anything about you or your surroundings, together with the screen dimensions needed to interpret that position; session and navigation timing, such as when a session begins and ends and how long a screen stays on screen; and basic technical context, namely the app version and build, the operating-system version, a device layout class (a screen-size category such as a compact phone layout, not a device serial number or an advertising identifier), your locale, and whether the event came from the App or the website.
• What product-analytics events never include. We do not capture screenshots of your session, and we do not record or replay your screen. These events never contain the content of your photos or thumbnails, your analysis results, keystrokes or other text you type, precise or approximate location, an advertising identifier, or any information used to track you across other companies' apps or websites.
• How product-analytics events are linked, and how to turn them off. When you are signed in, these events are linked to your account, so that we can understand a complete flow, such as where people abandon a vibe check or whether a change made the App easier to use. Collection is on by default. You can turn it off at any time in the App under Account, then Privacy, then "Share usage analytics." That choice is enforced on our servers as well as in the App, so events stop being collected rather than merely being hidden. Retention is described in Section 5.

Information from third parties. From Apple, we receive the sign-in identifier above and, for in-app purchases, purchase and transaction status (not your full payment card details). From Google, we receive the sign-in identifier when you use Google Sign-In. From Resend, our email-delivery provider, we receive delivery status for messages we send you.

We do not collect, and ask that you not provide, more sensitive information than necessary for the Service.

2. Facial Images and AI Processing

The Service works by processing photos you upload that depict faces. To generate your entertainment result, your photo is analyzed by Anthropic ("Claude") vision, which produces a playful "vibe" description as described in Section 1.

Face data we collect and store. For App Review and privacy-law clarity, the face data Vibe Check collects is limited to: (1) the facial photos you choose to upload for a vibe check; (2) derived, entertainment-only AI result text and structured descriptors generated from those photos; and (3) operational metadata needed to run the analysis, such as model name, processing status, cost, latency, and error state. We store uploaded facial photos and analysis results in Supabase, in private account-scoped database rows and storage paths protected by row-level security. We do not collect live camera frames unless you choose to capture and submit a photo, and we do not collect depth maps, TrueDepth data, ARKit face geometry, face landmarks, face templates, or any other device-generated biometric template.

We do not create a faceprint or biometric identifier. Vibe Check does not use your photos to create, and does not derive, a unique biometric identifier, faceprint, or facial-recognition template for the purpose of identifying or verifying any person. We do not use uploaded photos to recognize you or anyone else, and we do not sell or share biometric information.

How your image reaches the AI. When your photo is analyzed, we generate a short-lived signed URL to the image and send that URL, together with our prompt, to Anthropic. The signed URL is time-limited and expires (approximately 600 seconds). Anthropic references the image via the URL to perform the analysis and does not permanently store your image as part of the Service's flow.

Use, sharing, retention, and deletion of face data. We use facial photos and analysis results only to provide, secure, troubleshoot, and improve the Service, including generating and displaying your vibe check, showing your prior results, supporting optional sharing you initiate, detecting abuse, and honoring deletion requests. Face data is shared only with the service providers listed in Section 4 where needed to provide the Service, primarily Anthropic, PBC for AI vision analysis (the third-party AI provider that operates the Claude service) and Supabase for private storage and database hosting. These third parties are contractually bound to provide the same or equivalent level of data protection as this Policy, to use your face data only to provide their service to us, and they do not use your photos or results to train or improve AI models and do not sell them.

What we delete after an analysis, and what we keep. Please read this carefully, because we keep some face data by design.

• The full-resolution photo you uploaded is deleted once the analysis succeeds. As soon as your result is saved, we delete the full-resolution image from our storage. If that deletion does not succeed on the first attempt, we log the failure and the image remains until you delete the result or your account.
• If the analysis fails, the full-resolution photo is not deleted at that time. It stays in your private, account-scoped storage so the analysis can be retried or diagnosed, until you delete that result or your account.
• We keep a small thumbnail of your photo. A reduced-size thumbnail is retained alongside your result so the result can be shown in your in-app History and, if you choose to share it, on the public share page. This thumbnail is a facial image. It is kept until you delete that result or your account.

Face data is otherwise retained while your account is active and while needed to provide the Service. Deleting an individual result in the App removes that result, its stored images, and its thumbnail. When you delete your account, account deletion removes your uploaded facial photos, thumbnails, and analysis results from our systems generally within thirty (30) days, except for limited records we must retain for legal, security, fraud-prevention, dispute, or payment-record obligations as described in Section 5. Short-lived signed URLs expire separately and do not provide permanent access to images.

Consent obtained in the App before any photo is sent. Before your first vibe read, and separately from and in addition to your acceptance of the Terms of Use and this Privacy Policy, the App presents a dedicated in-app consent screen ("Before your first vibe read") that discloses, in plain language, that the photo you choose or capture is sent to a third-party AI service for analysis, names Anthropic (the provider of the Claude AI vision service) as that third party and Supabase as the provider of private account-scoped storage, summarizes what we keep after the analysis (described in full above), and states that your photo is not used to create a biometric identifier, is not used to train AI models, and is not sold. The screen links to this Policy. No photo is sent for AI analysis until you affirmatively agree on that screen.

Consent under biometric-privacy laws. Some U.S. states (for example, Illinois under the Biometric Information Privacy Act, as well as Texas and Washington) regulate the processing of facial or biometric data and may require your consent. Where such consent is required, your use of the photo-analysis feature, together with any consent you provide in the App, constitutes your consent to the processing described in this Section. You may withdraw that consent at any time by discontinuing use of the feature and deleting your account, after which your uploaded photos and results are deleted as described in Section 5.

3. How We Use Information

We use information to: provide, operate, maintain, and secure the Service; process the photos you upload and generate your AI "vibe" results; store and display your results to you and, where you choose to share, to the people you share them with; manage your account, credit balance, and Premium access; process and record purchases (in coordination with Apple); communicate with you about the Service; detect, investigate, and prevent fraud, abuse, and violations of our Terms, and keep the Service safe; analyze and improve the Service; and comply with legal obligations and enforce our agreements.

We use the product-analytics events described in Section 1 only to operate, secure, troubleshoot, and improve the Service, for example to find screens where people get stuck, controls that no one uses, and steps where the App fails. We do not use them for advertising, and we do not sell them.

We do not use the content of your submissions to train or improve AI models.

4. How We Disclose Information

We do not sell your personal information and do not share it for cross-context behavioral advertising. We disclose information only as follows:

• Service providers and sub-processors. With vendors who perform services for us, under contracts that limit their use of the information to providing those services and that require them to provide the same or an equivalent level of data protection as this Policy. As of the date below, these include:
• Anthropic, PBC ("Claude"), the third-party AI provider that performs the AI vision analysis; receives your image via a short-lived signed URL together with our prompt, to generate your "vibe" result. Anthropic is contractually bound to provide equivalent protection, uses the image only to return the result to us, does not use it to train or improve AI models, and does not sell it.
• Supabase, cloud hosting for our database, authentication, storage, and realtime services.
• Vercel, hosting for our web application and public share pages.
• Apple, authentication (Sign in with Apple) and in-app purchase verification on iOS. All purchases are made through Apple In-App Purchase.
• Google, authentication (Google Sign-In).
• Resend, email delivery. Resend receives your email address and the contents of the messages we send you (for example, sign-in and account emails), solely to deliver them.
• Stripe, payment processing for any purchase made outside the iOS app. We do not currently offer any such purchase flow; Stripe holds records of purchases processed before Vibe Check moved to Apple In-App Purchase as its only purchase mechanism.
• Sentry, optional backend error monitoring and diagnostics, where enabled, to help keep the Service reliable and secure.

Our mobile clients do not include any third-party analytics, tracking, or advertising SDKs, and we do not use your information for cross-context behavioral advertising. For a current list of providers, contact support-vibecheck@cre8ivelabs.ai.

• People you share results with (public sharing). If you choose to share a result, we generate a unique link to a public share page at vibecheck.cre8ivelabs.ai/share/[code]. Anyone who has that link can view the shared result without logging in. Sharing is optional and entirely at your choice; do not share a result you do not want others to be able to view or forward.
• Legal and safety. When reasonably necessary to comply with law, enforce our Terms, respond to lawful requests, or protect the rights, property, or safety of Vibe Check, our users, or the public.
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

5. Data Retention

We retain your personal information for as long as your account is active and as needed to provide the Service, then for the period necessary to comply with legal obligations, resolve disputes, prevent abuse, and enforce our agreements.

You may delete your account at any time within the App: Account, then Delete Account. If you no longer have the App installed, email support-vibecheck@cre8ivelabs.ai from the address on your account and we will process the deletion for you. When you delete your account, the deletion cascades and removes your account, your analyses and results, your uploaded images and thumbnails (deleted from storage), and your purchase records, generally within thirty (30) days, except for limited records we are required to retain by law or that are retained by Apple for its own tax, accounting, or fraud-prevention purposes.

Product-analytics events are retained on a shorter schedule. Individual event records are deleted within ninety (90) days. The aggregated statistics we derive from them, such as counts of views and taps per screen, control, and day, do not identify you and are retained for up to twenty-five (25) months so that we can compare behavior across releases. When you delete your account, product-analytics events are unlinked from it, so the remaining records carry no account identifier, and they then expire on the schedule above.

Signed URLs to your images are always time-limited: the signed URL used to send an image to the AI expires in approximately 600 seconds, and the signed URL used to cache a shared image on the public share page expires in approximately one (1) hour.

6. Your Privacy Rights

6.1 Your rights. Depending on where you live, you may have rights to access or obtain a copy of your personal information; correct it; delete it; obtain portability; opt out of the sale or sharing of personal information or of targeted advertising; and appeal a denied request. We do not sell your personal information or use it for cross-context behavioral advertising, and we do not discriminate against you for exercising these rights.

6.2 How to exercise rights, and appeals. Use the in-App controls (including account and data deletion) or email support-vibecheck@cre8ivelabs.ai. We verify requests through your account and respond within the time required by applicable law. If we decline a request, you may appeal by emailing support-vibecheck@cre8ivelabs.ai with the subject line "Privacy Request Appeal," and we will respond in writing, generally within 45 to 60 days, including the reasons for our decision.

6.3 California residents. Under the CCPA as amended by the CPRA, in the preceding 12 months we have collected and disclosed for a business purpose the following categories of personal information:

Category	Collected	Disclosed for a business purpose to
Identifiers (email, user UUID, device and account identifiers)	Yes	Service providers (Supabase, Vercel, Resend); Apple or Google for authentication
Customer records (Cal. Civ. Code 1798.80(e))	Yes	Service providers (Supabase, Vercel)
Commercial information (purchase and transaction data)	Yes	Apple (all purchases are Apple In-App Purchase); service providers
Internet or network activity (usage, diagnostics, in-app and website product-analytics events)	Yes	Service providers (Supabase, Vercel)
Biometric or visual information (uploaded facial photos and AI analysis results)	Yes	Anthropic (for image analysis); infrastructure providers (Supabase, Vercel). Results are disclosed publicly only where you choose to share a result.
Inferences (the AI-generated "vibe" output)	Yes	Anthropic (which generates it); infrastructure providers (Supabase, Vercel). Disclosed publicly only where you choose to share a result.

We do not sell personal information and have no actual knowledge of selling the personal information of consumers under 16 (and the Service is limited to users 18 and older). You may use an authorized agent and may be asked to verify your identity.

6.4 Other U.S. state residents. If you reside in Virginia, Colorado, Connecticut, Texas, Florida, or another state with a comprehensive privacy law, you have the rights in Section 6.1 to the extent your state's law provides, including the right to appeal. We do not sell your personal information, do not use it for targeted advertising, and do not engage in profiling that produces legal or similarly significant effects. Where your state's biometric-privacy law applies to the facial images you upload, we process them only as described in Section 2.

6.5 EEA, UK, and Switzerland. Where the GDPR or UK GDPR applies, our legal bases are: performance of our contract (to provide the Service, including generating and storing your results); your consent (for the processing of facial images to generate results); our legitimate interests (security, abuse prevention, and improvement of the Service); and compliance with legal obligations. You have rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with your supervisory authority. International transfers are protected by appropriate safeguards such as Standard Contractual Clauses. Creative Labs AI, LLC is the controller of your personal information; if you are in the EEA or UK, you may contact us at support-vibecheck@cre8ivelabs.ai regarding your rights or the controller of record.

7. Security

We use administrative, technical, and physical safeguards designed to protect your information, including encryption in transit, private storage buckets protected by row-level security, per-user access scoping, short-lived signed URLs for image access, and logging that redacts sensitive values such as signed-URL tokens and identifiers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for safeguarding access to your device and your Apple ID, Google Account, or email credentials.

8. Cookies, Analytics, and Do Not Track

On vibecheck.cre8ivelabs.ai we use only the cookies and similar technologies necessary for the website and share pages to function and to keep you signed in, which you can control through your browser settings. The website also stores a first-party session identifier in your browser's session storage, so that the product-analytics events described in Section 1 can be grouped into a single visit; it is cleared when you close the tab and is never used for advertising.

Our analytics are our own. Our mobile clients do not include any third-party analytics, tracking, or advertising SDKs, and we do not use your information for cross-context behavioral advertising. The product analytics described in Section 1 are first-party: they are collected by code we write, sent to our own backend, and stored in our own database. No analytics, attribution, or advertising SDK is embedded in the App, no advertising identifier is read, and no product-analytics data is shared with an analytics or advertising company. We may use a backend error-monitoring provider (such as Sentry) to capture diagnostic logs to keep the Service reliable and secure.

Turning usage analytics off. Product analytics are on by default. You can turn them off at any time in the App under Account, then Privacy, then "Share usage analytics." The setting is enforced on our servers as well as in the App.

Do Not Track: the Service does not currently respond to browser "Do Not Track" signals, because there is no common industry standard for interpreting them. To learn whether the third-party services we use honor DNT, review their privacy policies.

9. Children

The Service is for adults 18 and older. We do not knowingly collect personal information from anyone under 18, and you may not upload photos depicting anyone under 18. If we learn we have collected information from a person under 18, we will suspend the account and delete the information.

10. International Users

We are based in the United States and process information there and in jurisdictions where our service providers operate. By using the Service, you understand that your information, including the photos you upload, may be transferred to and processed in the United States and other countries, which may have different data-protection laws than your own.

11. Account and Data Deletion

You can delete your account at any time within the App: Account, then Delete Account. If you no longer have the App installed, email support-vibecheck@cre8ivelabs.ai from the address on your account and we will process the deletion for you. You can also delete an individual result from your in-app History, which removes that result along with its stored image and thumbnail. Account deletion cascades to your account, analyses, results, uploaded images and thumbnails (removed from storage), and purchase records, and generally completes within thirty (30) days, except for limited information retained as described in Section 5 (including records required by law or retained by Apple). Product-analytics events are unlinked from your account at deletion and then expire on the schedule in Section 5. Once you initiate deletion, your account can no longer be used and you will lose access to any remaining credits and Premium features. Deleting your account does not cancel your subscription. To avoid additional charges, cancel any active subscription through your Apple account first (Settings, then [your name], then Subscriptions; the App's Account screen links there directly), as described in our Terms.

12. Changes to This Policy

We may update this Policy from time to time. We will revise the "Last updated" date below and, where changes are material, provide notice through the Service or by other reasonable means. Your continued use after the effective date constitutes acceptance. This Policy is provided in English; any translation is for convenience only, and the English version controls in the event of any conflict.

13. Contact and Data Controller

Data Controller. The controller of your personal information is Creative Labs AI, LLC. If you are in the EEA or UK, Creative Labs AI, LLC is the controller, and you may contact us at support-vibecheck@cre8ivelabs.ai regarding your rights.

Vibe Check Creative Labs AI, LLC Email: support-vibecheck@cre8ivelabs.ai

---

Last updated: 2026-08-11