Privacy

• Code you choose to review. When you activate Unvibe on a selection, that snippet and the limited surrounding context you approve is sent to generate an explanation. Before anything leaves your computer it is scanned on-device for secrets, and detected credentials block or warn first.
• Repository metadata such as file paths, structure, and git diffs, only when you explicitly review those scopes. Unvibe does not read your repository in the background.
• Learning records: which snippets you reviewed, comprehension results, concepts, and streaks.
• Account data: your email for sign-in and an authentication token.

• It does not read your repository without an explicit action from you.
• It does not build its own model-training dataset from your private code.
• It does not log the contents of your private code in analytics.
• It does not perform screen recording, OCR capture, or keylogging.

Every remote request is scanned on your computer for known credential patterns: API keys, tokens, private keys, plus high-entropy strings and KEY= style assignments. A hit blocks the request and shows you the file and line so you can redact it or add it to a .unvibeignore file. Files like .env, keys, node_modules, and build output are excluded by default, and .gitignore is honored.

Explanations are generated by a configured cloud AI provider, so the filtered snippet you approve is sent over an encrypted connection. Cloud analysis begins only after an explicit review action. During the beta, explanations are generated by Google Gemini through its paid API, which Google states is not used to train its models. If you add your own provider key in the app (such as OpenRouter or Anthropic), requests go to that provider under its terms instead. Full payload preview and per-repository controls are still being completed. A fully local, no-cloud mode is not available yet.

Learning data lives on your computer and, when you are signed in, syncs to our backend where row-level security is designed to restrict direct reads to your account. Your auth token is encrypted at rest using the operating system keychain, and data is encrypted in transit. Backend at-rest and backup settings must be verified for the selected staging/production infrastructure. You can access and delete your data. See data controls and account deletion. We use no advertising trackers.

unvibe.site uses Mixpanel and PostHog to understand how visitors use the site, including page views, clicks, and session replays with form inputs masked. We use this to fix confusing pages, not to sell or share your data. The desktop app does not send this kind of analytics. If you join a list or request a download email, we store your name and email to contact you about Unvibe.

• Google Gemini generates explanations from the filtered snippet.
• Vercel hosts the website and API.
• Supabase stores accounts and synced learning records.
• Stripe processes payments. Unvibe never sees your full card number.
• Resend delivers sign-in and product emails.
• GitHub hosts the installer downloads.
• Mixpanel and PostHog measure website usage.

Unvibe is not directed at children under 13, and we do not knowingly collect their personal information. If you believe a child has given us data, email us and we will delete it.

We will update this page when the product changes how it handles data, and note the date at the top. Questions or requests go to support@unvibe.site.

Unvibe private beta is Mac (Apple silicon) and Windows x64. Linux is not available yet. We claim no security certifications. Explanations are a learning aid, not a security audit. See the terms for the AI limitations disclaimer.