Privacy Policy

This Privacy Policy explains what personal data VYBE (“VYBE,” “we,” “us”) collects when you use the VYBE app and website (the “Service”), why we collect it, who we share it with, and the choices and rights you have over it. It applies to everyone who creates a VYBE account or otherwise uses the Service.

1. Information we collect

Account information you provide directly:

• Email address and password (or, if you sign up with Google, your Google account identifier and the name/email Google shares with us — we never see or store your Google password).
• Phone number, if you sign up or sign in with phone verification (used only to send and verify a one-time code).
• Display name, username, age, and the city/country you tell us you're based in.
• Anything you choose to add later — a profile photo, a short bio.

Content you create: reviews, ratings, photos, posts, comments, messages to other users, saved places and collections, and reservation requests (which also include the name, phone, and/or email you enter for that specific booking).

Location: if you tap “Enable location” (in onboarding or in Settings), your device shares your precise GPS coordinates with us so we can show you nearby places. We never request this automatically — it only happens after you explicitly tap that button, and you can revoke it at any time from Settings or your device's system settings. If you don't enable it, you can still set your city manually.

Push notifications: if you tap “Enable notifications,” your browser or device generates a push subscription (an endpoint and encryption keys, not tied to any personal account with us) that we store so we can deliver notifications about messages and activity. Like location, this is only ever requested after an explicit tap, never automatically.

Conversations with the “Ask VYBE” AI assistant: the text of what you type into Ask VYBE is used to search for and explain relevant places. When VYBE's AI mode is active (as opposed to its rule-based fallback), that text is sent to our AI provider, Anthropic, to help interpret your request — see Section 3.

What VybeBot remembers, and your feedback: when you are signed in and tell VybeBot something lasting about your own taste, budget, diet or allergies, or usual area or occasions, it can save a short note (for example “Vegetarian”) to give you better suggestions. We do not store health conditions other than dietary needs and allergies, or religion, politics, sexuality, ethnicity or identifiers. You see every note under Profile → VybeBot memory and can delete any of them, or all, at any time; they are included in “Download my data” and erased when you delete your account. If you tap “Helpful” or “Not helpful” on an answer, or open a place it suggested, that adjusts your own taste profile — it is not used to train any model.

Automatically collected data: standard technical data every app collects — device/browser type, IP address, pages and features used, timestamps, and crash/error logs — used to keep the Service working and secure.

2. How we use your information

• To create and maintain your account and let you sign in.
• To operate core features: search, recommendations, reviews, saved places, messaging, and reservations.
• To personalize what you see — VYBE builds a rolling “affinity profile” from your onboarding answers and activity (searches, saves, reviews) to shape recommendations. This profile is derived data, never sold, and only used inside the Service.
• To show you nearby results, once you've enabled location.
• To send notifications you've opted into.
• To pass your reservation request's contact details to the business you're booking with, so they can confirm or reach you.
• To keep the Service safe — detecting spam, abuse, and violations of our Terms of Service, including account bans where warranted.
• To fix bugs, understand feature usage in aggregate, and improve the Service.

We do not use your data to serve third-party advertising, and we do not sell your personal data to anyone.

3. Who we share information with

We share data only with the service providers that make the Service work, each acting under its own privacy commitments, and never for their own marketing purposes:

• Supabase — hosts our database and handles authentication. Nearly everything described above passes through Supabase's infrastructure to operate the Service at all.
• Anthropic — powers the “Ask VYBE” AI assistant when AI mode is active. Only the text of your chat messages (not your account identity) is sent, solely to generate a response.
• Google — if you choose “Continue with Google,” Google handles that sign-in. Google Places data is also used to source and keep business listings accurate.
• Push notification services (e.g. the browser/OS vendor's push relay — Google, Mozilla, Apple) — deliver the notifications you've opted into, using only the anonymous subscription endpoint described in Section 1, never your account details.
• WhatsApp (Meta) — only if you choose to interact with VYBE via WhatsApp, in which case Meta processes that conversation as your messaging provider.
• The business you reserve with — your reservation's contact name, phone/email, and party details are shared with that specific business so they can honor the booking.
• Other users, for content you choose to make visible — your username, public reviews, posts, and public profile info are visible to other users by design; direct messages are visible only to their recipient.
• Law enforcement or legal process — only where we're legally required to, or to protect the rights, safety, or property of VYBE, our users, or the public.

We do not sell your personal data, and we do not share it with data brokers.

4. Your rights and choices

Wherever you are, you can at any time, from Settings:

• Access and download your data — “Download my data” exports everything tied to your account as a JSON file.
• Correct your data — edit your display name, bio, and profile fields directly.
• Delete your account — “Delete account” permanently removes your personal identifiers (email, name, photo) from your account and disables sign-in; content you've posted stays attributed to “Deleted user” rather than being stripped out of other people's conversations or a business's review history.
• Withdraw location or notification permissions — toggle either off in Settings, or from your device's own permission settings, at any time.

If you are in the European Economic Area, the UK, or Switzerland, you additionally have rights under the GDPR/UK GDPR to: access, rectify, erase, restrict, or object to our processing of your data, and to data portability — all of which the self-service tools above are built to satisfy directly; contact us at the address below for anything they don't cover.

If you are a California resident, you have rights under the CCPA/CPRA to know what personal information we collect, request its deletion, and opt out of its “sale” or “sharing” — we don't sell or share personal information as those terms are defined by the law, so there is nothing to opt out of, but you can still exercise the access/deletion rights above.

5. Data retention

We keep your account data for as long as your account is active. If you delete your account, we anonymize your personal identifiers immediately and keep a minimal record that a deletion occurred (for legal accountability) — we don't keep a recoverable copy of your personal data beyond that. Aggregated, de-identified data that can no longer be tied to you may be retained indefinitely for analytics.

6. Children's privacy

VYBE is not directed at children and is not intended for anyone under 13 years old; we don't knowingly collect personal data from anyone under 13. If you believe a child has created an account, contact us at the address below and we'll remove it.

7. Security

We use industry-standard safeguards — encrypted connections (HTTPS/TLS), database-level access controls that restrict every user's data to that user alone, and hashed passwords — but no method of transmission or storage is 100% secure, and we can't guarantee absolute security.

8. International data transfers

Our service providers may process data outside your own country. Where that involves transferring personal data out of the EEA/UK, we rely on the safeguards those providers offer (such as Standard Contractual Clauses) to protect it.

9. Changes to this policy

We may update this Privacy Policy as the Service evolves. Material changes will be reflected by a new version date at the top of this page.

10. Contact us

Questions, requests, or complaints about this policy or your data: vybe.eats@gmail.com.