Privacy Policy

1. Who we are

ViberCodify ("ViberCodify", "we", "us") is operated by YOXON DEV LLC, a company formed in Wyoming, United States, with its registered address at [To be confirmed: registered business address]. YOXON DEV LLC is responsible for the personal information described in this policy.

Questions about this policy or your information can be sent to [To be confirmed: privacy contact email].

Effective date: [To be confirmed: effective date].

2. Scope

This policy covers the ViberCodify website at vibercodify.io, the ViberCodify web application, the ViberCodify Agent API and MCP server, and the ViberCodify command-line interface (together, the "Service"). It does not cover third-party services you connect to the Service, such as GitHub, which have their own policies.

3. Information we collect

We collect only what we need to provide the Service:

• Account information. When you sign in with GitHub, we receive your GitHub user identifier, name, email address and profile image. We do not receive your GitHub password.
• Repository information. When you install the ViberCodify GitHub App and connect a repository, we access the repositories you select. We store repository metadata (such as names, branches and commit identifiers), the file tree, and the contents of supported source files. We do not store files that our checks identify as likely to contain secrets, or files that are binary, oversized or in unsupported encodings. Secret detection is automated and cannot be guaranteed to catch every secret.
• Derived analysis data. From that repository content we create and store text excerpts ("chunks"), numerical representations used for search ("embeddings"), technology-stack fingerprints, audit findings, Ship Scores, remediation prompts, remediation plans and project memory.
• Usage information. We record the actions you take in the Service, such as analyses run, prompts generated and daily usage counts against plan limits. For Agent API and MCP use, we record the operation, result category, workspace and project, and the token used. Agent API tokens are stored only as a one-way hash, and we cannot recover the full token.
• Feedback. Any feedback, ratings or messages you choose to submit.
• Billing information. If you subscribe to a paid plan, payments are processed by Stripe. We store your Stripe customer identifier, subscription status, plan and billing-period dates. We do not receive or store your full card number.
• Technical information. Our hosting provider processes standard request information, such as IP address, browser user agent and request times, to deliver and secure the Service.

4. How we use information

We do not sell personal information, and we do not use your repository content for advertising.

• To provide the Service: authenticate you, connect repositories, run analyses, calculate scores, generate remediation prompts and keep project memory.
• To enforce plan limits, prevent abuse and keep the Service secure.
• To process subscriptions and payments.
• To respond to your requests and send service messages, such as security or billing notices.
• To diagnose problems and improve the reliability and accuracy of the Service.
• To comply with legal obligations.

5. AI processing of repository content

Parts of the Service use third-party machine-learning services. To build search indexes and rank relevant code, excerpts of your stored repository content are sent to Hugging Face. Only the content needed for the specific task is sent.

The Service supports an optional AI reasoning provider for AI-assisted findings. It is currently disabled: no repository content is sent to an AI reasoning provider, and analyses state that AI-assisted checks were unavailable. We will update this policy before enabling one.

ViberCodify does not train its own models on your code. How these providers handle submitted content: [To be confirmed: what the AI providers do with submitted content (retention/training), per their current terms].

Findings produced with AI assistance are labelled as model inference and are not presented as confirmed vulnerabilities.

6. Service providers we share information with

We share information only with providers that help us run the Service, and only for that purpose:

• Vercel: application hosting and request handling.
• Neon: database hosting.
• GitHub: sign-in and access to the repositories you authorize.
• Hugging Face: embedding and ranking of repository excerpts.
• Stripe: payment processing and subscription management.

7. Legal disclosures

We may also disclose information if required by law, to protect the rights, safety or property of our users, ourselves or others, or in connection with a merger, acquisition or sale of assets. In a merger, acquisition or sale, this policy would continue to apply to your information.

8. Cookies

We use only cookies that are strictly necessary to sign you in and keep your session secure, such as session and request-forgery protection cookies. We do not use advertising or cross-site tracking cookies.

9. Retention and deletion

• When you delete a project in the Service, its analyses, findings, remediation prompts, memory and feedback are deleted from our active database immediately. Repository snapshots are deleted when no other project in your workspace still uses that repository.
• Account and workspace data are kept for [To be confirmed: retention period for account and workspace data].
• Database backups are kept for [To be confirmed: database backup retention period], after which deleted data is no longer recoverable.
• Hosting and request logs are kept for [To be confirmed: hosting/request log retention period].
• To delete your account, contact [To be confirmed: privacy contact email]. We will complete the request within [To be confirmed: time to complete account deletion requests], except where we must keep information to meet legal obligations.
• You can disconnect the GitHub App at any time in the Service or on GitHub. Disconnecting stops further repository access.

10. Security

We protect information with encryption in transit (HTTPS), least-privilege repository access through the GitHub App, hashed API tokens, workspace-level access controls and automated exclusion of secret-bearing files. No system is completely secure, and we cannot guarantee absolute security.

11. Where information is stored

Information is stored and processed in the United States: our database is hosted in AWS us-east-1 (Virginia) and our application servers run in Vercel's Washington, D.C. region. Our service providers may process information in other countries where they operate.

12. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal information, and to object to or restrict certain processing. [To be confirmed: which privacy laws are honoured (e.g. GDPR/UK GDPR/CCPA) and how]

To make a request, contact [To be confirmed: privacy contact email]. We may need to verify your identity before acting on it.

13. Children

The Service is not directed to anyone under [To be confirmed: minimum age to use the service], and we do not knowingly collect personal information from them.

14. Changes to this policy

We will post any change to this policy on this page and update the effective date. If a change is material, we will notify you by email or in the Service before it takes effect.

15. Contact

YOXON DEV LLC, [To be confirmed: registered business address]. Email: [To be confirmed: privacy contact email].