Privacy Policy

1. Data controller

The data controller is Daniele Bonalberti, reachable at privacy@vibestapp.com. VIBEST is a social platform dedicated to makers and professionals.

2. Data collected

We collect the following categories of data:

• Registration data: email address, username (case-sensitive), date of birth, profession, city of residence.
• Profile data: profile photo, cover photo, biography, verification level (Bronze/Silver/Gold/Purple), content in Vibe Posts (JPG/PNG photos, MP4/MOV videos, MP3/M4A/AAC audio).
• Activity data: likes, comments, follows, @mentions (users you tag and who tag you), listings, items for sale.
• Presence data: timestamp of the last access, used for the online/offline dot visible to other users.
• Day Vibe data: stories published, viewers, likes. Day Vibes expire after 24 hours.
• Team Vibe data: collaborations created or joined, roles, feedback outcome (by mutual agreement / no reason given), medals given and received.
• Technical data: push notification tokens, approximate geographic coordinates computed from the city the user declares in the profile (used for distance search and nearby listing notifications). VIBEST does not use the device GPS and does not request that permission.
• Communication data: text, voice, photo and video messages in 1-to-1 private chats, Team Vibe group chats and listing chats.

2b. Technical logs, analytics and tracking tools

To keep the service working, the technical infrastructure records logs needed for debugging, security and performance monitoring (e.g. response times, server errors, anomalous requests). These logs are not used to profile user behaviour.

VIBEST does NOT use:

• Advertising analytics tools (Google Analytics, Facebook Pixel, etc.).
• Advertising or marketing profiling tools.
• Third-party tracking cookies.

What is in place:

• Basic crash reporting: automatic trace of serious errors, sent by email to the developer solely for bug fixing.
• Server-side technical logs: kept by the provider Supabase under its own policies and only for as long as necessary.
• Traffic statistics on vibestapp.com via GoatCounter (goatcounter.com): anonymous, aggregated page views, IP anonymised server-side, no cookies, no fingerprinting, no identifiable personal data. Used only to know how many people visit the showcase website. No information is shared with third parties.
• Language preference on the website: the website stores in your browser (localStorage) only the language you chose. It is strictly functional technical storage: not a tracking cookie, it contains no personal data and is not sent to anyone.

The vibestapp.com website does not install any cookies. For this reason there is no cookie consent banner: under the Italian Data Protection Authority guidelines (10 June 2021), the banner is required only where cookies or non-technical tracking tools are present, which this website does not use.

None of this data is sold or shared with advertisers, data brokers or third parties for commercial purposes.

3. Purposes and legal basis

Data is processed for the following purposes:

• Provision of the service (art. 6.1.b GDPR — performance of a contract): account management, social features, Day Vibe, Team Vibe, chat, marketplace, listings.
• Push notifications (art. 6.1.a GDPR — consent): notifications about activity on the app. Consent can be withdrawn at any time from the device settings.
• Distance search (art. 6.1.b GDPR — performance of a contract): computing the distance between users based on the city declared in the profile, to show geographically relevant content and listings. No active GPS geolocation.
• Content moderation (art. 6.1.f GDPR — legitimate interest): review of reports and protection of the community.
• Security and fraud prevention (art. 6.1.f GDPR — legitimate interest): protecting the integrity of the platform.
• Promotion of the Platform on VIBEST's official social channels (art. 6.1.f GDPR — legitimate interest): reposting public content with the author's username, skill and location, always with attribution. You can object at any time by writing to privacy@vibestapp.com.

For purposes based on legitimate interest, VIBEST has carried out a balancing test (Legitimate Interests Assessment) between the Platform's interests and users' fundamental rights and freedoms, concluding that such processing is necessary, proportionate and does not override users' interests.

4. Data processor — Supabase

Data is stored and managed through Supabase Inc. (San Francisco, USA), with application servers physically located in Europe (EU) for application data. Supabase acts as a data processor under art. 28 GDPR.

Transfers outside the EU: since Supabase Inc. is a US-based company, administrative access to data may also take place from US territory. Such transfers are governed by Standard Contractual Clauses (SCC) approved by the European Commission and by the further appropriate safeguards provided by art. 46 GDPR, including encryption, access control and auditing.

More information: supabase.com/privacy.

5. Data retention

Data is kept for different periods depending on the category:

• Account data (email, username, profile): for as long as the account is active; deleted within 30 days of the deletion request.
• Published content (posts, listings, shop, chat, Day Vibe): for as long as the account is active; Day Vibes expire automatically after 24 hours; content deleted by the user is removed within 30 days unless legal retention obligations apply.
• Technical logs and crash reports: kept by the provider Supabase for up to 30 days for security and debugging.
• Backups: automatic infrastructure backups may keep technical copies of data for up to 90 days after deletion.
• Data kept for legal obligations (e.g. reports, compliance records): kept for the minimum period required by applicable law.

6. Sharing with third parties

Data is NOT sold, transferred or shared with third parties for commercial or advertising purposes. It may be shared only:

• With technical data processors (Supabase; for the web tools also Anthropic, see sec. 8d) strictly necessary to provide the service.
• With PayPal, only for those who buy a pack of creations in the web tools (sec. 8d): PayPal processes payment data as an independent controller.
• With the competent authorities, where required by Italian or European law.

7. Data subject rights (arts. 15–22 GDPR)

You have the right to:

• Access: obtain a copy of your personal data.
• Rectification: correct inaccurate or incomplete data (through the profile settings).
• Erasure ("right to be forgotten"): delete your account and your data through the "Delete account" function in the app settings.
• Portability: receive your data in a structured, readable format.
• Objection: object to processing based on legitimate interest.
• Restriction: request the restriction of processing in certain circumstances.

To exercise your rights, write to privacy@vibestapp.com. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or with the supervisory authority of your country.

8. Minors and parent-managed profiles

VIBEST is intended for adult users (18+). Some categories (e.g. "Football Prospect", "Sports Prospect") allow profiles for minors managed exclusively by a parent or legal guardian, who takes full responsibility for the minor's profile.

The parent/guardian who creates or manages a profile for a minor:

• Accepts these Terms and this Privacy Policy on behalf of the minor.
• Is responsible for all content published and all interactions of the profile.
• Can request account deletion following the procedure on the Delete account page.

We do not knowingly collect data from minors without the supervision of a responsible adult. If we become aware of an unsupervised registration by a minor, the account will be deleted.

8b. Online presence

VIBEST records the timestamp of the last access to show other users the presence dot (green = online in the last 5 minutes, grey = not active). This data:

• Is not shared with third parties.
• Is an integral part of the service and functional to the social interaction experience.
• Its legal basis is the performance of the contract (art. 6.1.b GDPR): switching it off individually would substantially degrade the platform experience.

For this reason it cannot be switched off individually. A user who does not want this feature can delete their account.

8c. Profile web page

If you enable the "Profile visible on the web" option in the app settings (Privacy section), your public profile is also reachable by people without the app, at vibestapp.com/profilo/…, and can be indexed by search engines. The page shows only data already visible in your public profile inside the app: name, username, profession, location, biography, profile photo and previews of your posts; single posts are reachable the same way at vibestapp.com/post/…. It does not include contacts, email or private data.

• For profiles created from 18 September 2026 the option is on from the start and you can switch it off at any time from the settings.
• For profiles created before that date the option is off until you switch it on.
• The page is shown only if the profile has at least one published post.
• The page disappears when you switch the option off, delete the profile or the profile is suspended. Search engines may keep a copy for some time after deactivation.
• Legal basis: performance of the contract (art. 6.1.b GDPR) for the public profile inside the app; web visibility remains your choice, changeable at any time.

8d. Web tools

The writing tools at vibestapp.com/strumenti are used without an account and are technically separate from the app: they have no access to VIBEST users' data.

• The texts you write are not stored by VIBEST. They are sent to the artificial intelligence provider, Anthropic PBC (USA), which acts as a data processor for the sole purpose of processing them and returning the result; under Anthropic's commercial terms they are not used to train its models. The transfer outside the EU takes place on the basis of the safeguards provided by arts. 45-46 GDPR. Do not enter other people's personal data in the tools.
• List tools (hashtags, rates, questions, kit): they do not use artificial intelligence. Our server only receives the trade you choose (or the word you type instead), to return the list and count the day's free lists; the city you may add for the hashtags stays in your browser and is not sent. Lists received stay in the browser's memory until the end of the day.
• Usage limit: to count the daily free creations and prevent abuse we keep a non-reversible fingerprint of your IP address, which changes every day and is deleted after 7 days. The plain IP address is not stored. Legal basis: legitimate interest (art. 6.1.f GDPR).
• Buying creations: payment takes place on PayPal, which processes your payment data as an independent controller under its own policy. VIBEST does not receive card data. We only keep the generated code, the number of remaining creations and the PayPal order identifier, needed to avoid crediting the same payment twice and to handle any claims; through the PayPal account the seller can see the name and email of the payer, as with any PayPal payment. Legal basis: performance of the contract (art. 6.1.b GDPR) and legal obligations. Retention: for the period required by accounting and tax obligations.
• On your device: the draft you are writing stays in the browser tab until you close it; the purchased code stays in the browser's memory until you clear it. They are not cookies and are not used to track you.
• Page visits are counted in aggregate form with the same statistics tool described in sec. 2b.

9. Moderation and reports

VIBEST uses automated moderation tools (including image analysis) and human review to detect content that does not comply with the Terms of Service. Content reported through the "Report" function is reviewed by moderators.

In case of serious reports (safety, crimes, abuse) or legal obligations, VIBEST may access the relevant messages within the limits strictly necessary and proportionate for internal investigations or to comply with requests from the competent authorities under Italian and European law.

10. Security and private communications

We adopt appropriate technical and organisational measures to protect your data:

• Encrypted communications in transit (HTTPS/TLS): all data exchanged between the app and the servers is protected by encryption during transfer.
• Private media storage: photos, videos and audio sent in chats are stored in private buckets with controlled access (temporary signed URLs for conversation participants).
• Row Level Security (RLS): the PostgreSQL database applies per-row access rules, ensuring each user can read only the data they are entitled to.
• Secure authentication with email verification.
• Push tokens uniquely linked to each account and device, revoked on logout.

Private communications — user responsibility

VIBEST does not actively monitor the content of messages exchanged in private chats (1-to-1, Team Vibe groups, listing chats). Such content is communication between users and falls under the exclusive responsibility of whoever publishes it.

Users are fully responsible for the content (texts, photos, videos, voice messages) they send or receive in private chat, including any criminal and civil liability arising from it (defamation, copyright infringement, unlawful content, harassment, violation of third parties' privacy, etc.).

VIBEST reserves the right to access private communications only in the cases provided by law:

• following a formal report through the "Report" function or by email to support@vibestapp.com;
• for security investigations in case of suspected violations of the Terms of Service;
• to comply with legal obligations or requests from the competent Italian and European authorities (art. 17 Legislative Decree 70/2003, Digital Services Act — Regulation (EU) 2022/2065).

Such access is limited to the controller and the strictly necessary technical staff, is logged and follows the principle of data minimisation (art. 5.1.c GDPR). We do not use chat content for profiling, marketing or training automated systems.

The user accepts that, acting as an information society service provider under Directive 2000/31/EC and the Digital Services Act, VIBEST is not subject to a general obligation to monitor the content transmitted or stored by users.

11. Push notifications and tokens

Push notification tokens (Expo Push Token) are linked to the single account and device. On logout, the token is revoked and notifications are disabled for that device. We do not share push tokens with third parties nor use them for purposes other than sending service notifications.

12. Changes to the Privacy Policy

Any substantial changes will be communicated through an in-app notification or email. Continued use of the service after the notification constitutes acceptance of the changes.

13. Contact

For any privacy matter: privacy@vibestapp.com
For general support: support@vibestapp.com