Privacy Policy

• Account details. Your email address, and your name and profile photo if you sign in with Google or GitHub. If you pay without signing in, we create your account with the email you pay with, so you can always get back to what you bought.
• What you type. The app idea you scan, your answers to clarification questions, your preferred tech stack, and any tweak instructions.
• Generated specs. The PRD, schema, agent instructions, task plan and decision log we create for you.
• Purchase records. The plan you bought, the amount, the email used at checkout, and our payment processor's checkout reference. Card details go directly to the payment processor; we never see or store them.
• Usage analytics, only if you allow it. Pages visited, clicks (without their text), and basic device and browser information. Payment and sign-in codes and blueprint links are removed from page addresses before anything is recorded. See “Cookies, browser storage and your choices” below.

When you scan an idea, generate a pack, or tweak a spec, the text you entered (and, for tweaks, the existing spec) is sent to a third-party AI model provider, solely to produce your result. It is processed under that provider's API terms, and may be processed on servers outside your country.

In the guided build, what you paste (your AI builder's replies, error messages and your notes) is sent the same way, to explain it and suggest a next step.

We do not use your prompts or generated specs to train or fine-tune any model. Please don't include passwords, API keys, or other secrets or personal data about other people in your idea descriptions.

• To generate, store and show you your specs.
• To create and secure your account.
• To process payments, unlock what you bought, send receipts, and manage a subscription if you have one.
• If you allow analytics, to understand which parts of the product are used, so we can improve it.
• To prevent abuse and keep the service running reliably.

We share data only with the providers that run parts of the service, each for its own job:

• Sign-in and database — your account, and storing your specs.
• Payment processing — checkout and refunds.
• AI model provider — generating your results, as described above.
• Email delivery — receipts, sign-in links and links to the blueprints you buy.
• Product analytics — how the site is used, only if you allow it.
• Usage limits — such as how many ideas can be scanned per hour, which work from your IP address.
• Domain and email routing — our domain, and forwarding the email you send to our support address.
• Website hosting — serving the website.

Each provider may use your data only to provide its service to us. Want to know which company handles a given kind of data? Contact us and we'll tell you.

• Your account and specs are kept while your account is active, so you can come back to them.
• Specs generated while signed out are kept so they can be attached to an account if you sign in later.
• What you paste in the guided build is kept with that blueprint's build history, so you can reread it, until you delete the blueprint.
• You can delete any blueprint from your dashboard. Its idea, files, decisions and history, including its guided build and what you pasted, are deleted straight away; we keep only a record that it existed and how it was paid for.
• When you ask us to delete your account, we delete your account details and specs within 30 days.
• Purchase records are kept as long as tax and accounting rules require, even after account deletion.

Your browser keeps some things for VibeToSpec. Most of it is essential: without it you couldn't stay signed in, keep your work while you go, or pay. Analytics is optional, off until you allow it, and turning it down doesn't limit anything you can do here. We don't use advertising cookies, and we never sell your data.

Your choice. The first time you visit, we ask whether you allow analytics. Choose Accept or Reject, or open Cookie settings for the details. Until you choose, analytics stays off. Change your mind any time with Cookie settings: it's in the footer of every page, in your account menu under My projects, and at the bottom of the sign-in pages. We remember your choice for six months, then ask again.

Essential storage (always on)

• Your cookie choice (VibeToSpec, local storage vts_consent): whether you allowed analytics, and when. Kept six months.
• Staying signed in (Google Firebase Authentication, browser databasesfirebaseLocalStorageDb and firebase-heartbeat-database): your sign-in session, until you sign out. The second is the sign-in software's own record of the days it ran, which it sends to Google with sign-in requests.
• Finishing a sign-in link (VibeToSpec, local storagevts_sign_in_email): the address a link was sent to, so the link opens without asking again. Removed once you're signed in.
• Blueprints made before signing in (VibeToSpec, local storagevts_pending_project_pack_ids): up to 20 references, so those blueprints join your account when you sign in. Removed once they have.
• Your work in progress (VibeToSpec, session storage vts:wizard-draft:v2 and vts:guide-paste:…): your idea and choices in the scanner, and text you're about to paste in the guided build, in that browser tab only. Gone when you close the tab; the scanner's draft also ends after a day, or once your blueprint exists.
• Your project folder (VibeToSpec, local storage vts:folder:…): the folder path you type in Start building, so you don't retype it. Kept until you clear the field or your browser's site data.
• Checking out (VibeToSpec, cookie vts_checkout_…): ties a payment to the browser that started it, so the purchase lands in the right place. Expires after 24 hours.
• Payment security (Stripe, cookies __stripe_mid, __stripe_sid and m on stripe.com): Stripe's fraud checks. Set only once you open checkout or confirm a card. In our checks they lasted one year, 30 minutes and about 13 months.

Analytics (only with your permission)

PostHog, our analytics provider, counts the pages you visit and the steps you take, so we can see what helps and what gets in the way. It stores an identifier in a cookie (ph_…_posthog, kept up to one year) and in local and session storage (keys starting ph_). It never records your idea, your blueprint, anything you paste, or your payment details: click text and attributes are masked, page addresses lose payment and sign-in codes and blueprint links, and session recording is off.

Turning analytics off. Open Cookie settings, switch Analytics off and save. Analytics stops straight away, and we remove PostHog's identifiers from your browser. What was already sent stays with PostHog until it's deleted: email support@vibetospec.com and we'll ask PostHog to delete it.

You can ask us for a copy of your data, to correct it, or to delete it. Email support@vibetospec.com from the address on your account and we'll respond within 30 days.

VibeToSpec is not intended for anyone under 16.

If we change this policy in a way that matters, we'll update the date above and, for significant changes, notify you by email. Questions? Email support@vibetospec.com. See also our Terms of Service.