Privacy Policy

Vibe Sentinel is built around a single design principle: the less of your data we touch, the less we have to lose. This page documents every byte that does cross a boundary, and the many that don't.

What the App does NOT collect (on your Mac)

• Clipboard content — ever, for any reason, in any form
• Files or folders you scan with the Services menu
• Detected secrets or their original values
• Screenshots, photos, PDFs, QR codes, or barcodes you redact

Optional usage analytics are described below. Nothing leaves your Mac for analytics unless you explicitly enable.

What the App collects (only if you enable analytics)

If you opt in via the first-launch prompt or Settings, the App sends

• Anonymous usage events — e.g. app launched, redaction performed, settings opened. Event names and coarse counts only; never clipboard text, file paths, secret values, or app names
• A random anonymous ID stored in your Mac Keychain, used to deduplicate events.

What this Site does NOT use

• Advertising or remarketing trackers (Facebook Pixel, Google Ads, etc.)
• Session replay, heatmaps, or mouse/scroll tracking
• Canvas, font, audio, or WebGL fingerprinting
• Persistent analytics cookies or cross-session tracking IDs
• Email beyond what you explicitly submit via the download or newsletter form

What this Site DOES collect

Site analytics (automatic, cookieless)

Every page load triggers aggregate analytics via PostHog and Cloudflare Web Analytics. These run in cookieless mode: no persistent cookies, no localStorage tracking entries, no session recording, no autocapture. We receive pageview counts and coarse traffic metrics only. Sub-processors may process connection metadata (such as IP address) under their own privacy policies — we do not store raw IPs in our database.

Email (only if you submit it)

When you request a download or subscribe to the newsletter, we store your email address.

Your email is used for:

• Sending you updates about changes to our Terms of Use and this Privacy Policy
• If you opted in: occasional notifications about security updates, new releases, or relevant supply-chain incidents

Your email is not shared with third parties, sold, or used for advertising. You can have it deleted any time by emailing privacy@vibesentinel.manolus.com or by clicking the unsubscribe link in any email we send you.

Download counts

For each download you complete, we increment a counter associated with your email. This helps us detect abuse. It does not feed any profile or advertising system.

Abuse-prevention hashes (form submissions only)

When you submit the download or newsletter form, we store a SHA-256 hash of your IP address and User-Agent alongside the record. Raw IPs are never written to our database. Your raw IP is also sent to Cloudflare Turnstile during bot verification — that processing happens on Cloudflare's side, not in our storage.

Retention

• Email addresses are kept until you unsubscribe or request deletion
• Analytics events at PostHog/Cloudflare: per those providers' retention settings

Your rights (GDPR, CCPA, LGPD)

You have the right to:

• Access the data we hold about you (email)
• Correct it
• Have it deleted

All requests should be sent to privacy@vibesentinel.manolus.com. We will respond within 30 days.

Sub-processors

The following services process data on our behalf:

• Cloudflare — CDN/hosting, Turnstile bot protection, Web Analytics
• PostHog — cookieless pageview analytics (Site) and optional usage events (App, opt-in only)

All publish DPAs (Data Processing Agreements).

Children

The Site and App are not directed to children under 13, and we do not knowingly collect data from them.

Changes to this Policy

We will update the "Effective" date at the top of this page when we make changes. Material changes (new data categories, new sub-processors) will be announced in the changelog.

Contact

For any privacy question, write to privacy@vibesentinel.manolus.com.