Privacy Policy

Vibe is a crowd-powered event music platform operated at aivibe.space. This policy covers the website, the API, and the Vibe iOS and Android apps. Questions, requests, or complaints: privacy@aivibe.space.

If you just join a party (no account): the display name you type, a random guest ID stored on your own device, the music taste you pick or sync, and the votes, reactions and boosts you send during that event. No email, no phone number, no contacts, no location, no advertising identifier.

If you create an account: our identity provider, Clerk, holds your email address and whatever your chosen sign-in service passes on — with Sign in with Apple that can be a relay address that never reveals your real one, and we work fine with that. We additionally store, under your account: your auto-blend consent setting, one encrypted access grant per streaming service you link, and the taste profile derived from it (artist and genre names, nothing else).

If you link a streaming service: we request read-only scopes and use them for exactly one thing — reading your top artists so a room can blend your taste in. We never read your listening history, never modify your library or playlists, and never play anything on your account. Last.fm links store only your public username, because their API needs no secret at all.

Automatically: your IP address is used transiently for rate limiting (to stop one device flooding a party). It is held in a counter that expires within minutes and is never attached to your account or your votes.

To run the product, and nothing else. Taste data feeds the matching engine that builds a room's queue. Your display name shows on the host screen when your dedication plays. Account data exists so you don't have to reconnect your streaming service at every party door. Rate-limit counters keep parties up.

Where the GDPR applies, our lawful bases are performance of a contract (running a party you joined), consent (linking a streaming account and the auto-blend switch, both revocable at any time), and legitimate interests (abuse prevention).

• We do not sell or rent your data. There is no price at which we would.
• We run no analytics SDK, no ad network, no tracking pixels, and no cross-app or cross-site tracking whatsoever.
• We do not build advertising profiles or share data with data brokers.
• We do not read, store, or transmit your listening history.
• We do not access your contacts, photos, microphone, or location.

The camera is used for one purpose — scanning a party's join QR code — and frames are processed on your device and discarded.

Streaming access grants are encrypted at rest with AES-256-GCM under a server key, and are decrypted only for the moment it takes to refresh your top artists. Traffic is HTTPS end to end.

• Party data(your guest entry, name, votes, reactions, the room's queue) is deleted automatically 24 hours after the event ends. Venue records expire on a 48-hour window.
• Account data (links, grants, cached taste) lives as long as the account is in use, and is deleted automatically after 365 days of complete inactivity.
• Rate-limit counters expire within minutes.
• Unlinking a streaming service deletes its grant and its cached taste profile immediately.

You can delete your account from inside the app — Account → Delete account — or on the web at aivibe.space/account. No email, no support ticket, no waiting.

Deletion is immediate and permanent. It erases your sign-in identity, every linked streaming grant, and your cached taste profile. One honest caveat: a party that is live at that moment keeps your guest entry (your display name and votes) until that event ends and expires on the schedule above — parties are short-lived by design and carry their own deletion clock.

Deleting your Vibe account does not revoke the grant on the streaming provider's side, though it makes ours unusable. To revoke it there too, visit your account settings at Spotify, Google, Amazon, Apple, or Last.fm.

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to withdraw consent, and to object to or restrict processing. Deletion and consent withdrawal are self-service (above). For anything else, email privacy@aivibe.space and we'll respond within 30 days. We will never charge you or degrade your service for exercising a privacy right.

We use a small number of service providers, each contractually limited to processing data on our instructions:

• Clerk — authentication and identity (your email and sign-in method).
• Vercel — application hosting and request delivery.
• Upstash — the Redis datastore holding live parties and account records.
• Apple, Google, Spotify, Amazon, Last.fm — only when you choose to sign in with them or link them, and only within the read scopes you approve.

Data may be processed in the United States. Where required, we rely on Standard Contractual Clauses for international transfers.

Vibe is not directed to children under 13, and we do not knowingly collect personal data from them. If you believe a child has given us data, email privacy@aivibe.space and we will delete it.

If we change what we collect or why, we will update this page and move the date at the top. Material changes will be surfaced in the app before they take effect.