Last updated 6 November 2026.
The short version. We store your email, your name, your picture and what you rank. We log IP addresses to stop abuse. Your mood searches and your ranked titles are sent to Anthropic to generate recommendations and your taste summary. Nothing is sold, and there are no advertising or analytics trackers.
Because you gave it to us: your email address, your display name, your profile picture if you add one, and your password, hashed with scrypt, never stored in a form we can read.
Because you used the app: what you rank and in what order, how you felt about it, your watchlist, who you follow, who follows you, who you tag as having watched something with you, and what you recommend to whom.
Automatically, for security: your IP address, kept against failed sign-in attempts and against rate limits so one person can't lock others out or run up costs. Sign-in records expire, and rate limit counters are cleared on a rolling basis.
When something breaks: the error and the address of the request that caused it, so it can be fixed. These can contain what you typed into a search.
There are two cookies. One keeps you signed in. The other remembers which website or link sent you here for 30 days, and is saved with your account if you sign up. Visits are also counted by the site that sent them, as a plain number with nothing that says who you are. No advertising networks, no outside analytics, no third-party trackers, no location data.
If you use "Find friends from contacts": your phone numbers and email addresses are checked against Vibra accounts to find matches, and a one-way fingerprint of each is kept so we can tell you when one of them joins later. Contact names never leave your phone.
If you use "Text a friend": you pick a contact on your phone and Messages opens to send them your invite. The number you picked is sent to us once and kept for 30 days only as a one-way fingerprint, so that when they join with that number we can connect the two of you. The message itself goes from your phone, not from us.
What you search for: we keep the words you type into search and vibe search, so we can see what people are looking for and what Vibra doesn't have yet. Nobody else sees them.
If you got Vibra from an App Store ad: when you sign up in the iPhone app, it asks Apple whether an Apple ad led to the download. If one did, we keep which ad campaign and search word it was, so we can tell which ads bring people who stay. Nothing about you is sent to Apple, and it isn't used to follow you across other apps or websites.
Anthropic receives your mood search text, and, for your taste summary, the titles, scores and sentiment of up to 40 things you've ranked. It does not receive your email, your name or your account id. This is the one place your ranking data leaves our server.
TMDB, Open Library, Apple and YouTube receive your search terms when you look something up, because the results come from them. They don't receive anything about who you are.
Resend handles password reset email, so it sees your email address.
That's the complete list. We don't sell personal information, we don't share it for advertising, and we don't do anything that counts as "selling" or "sharing" under California law.
Your display name, picture, rankings and scores are visible to people using the app. Your scores count toward an item's average. Your email address is never shown to anyone.
Get a copy: My information, then Download my data, gives you everything as a JSON file.
Delete it: My information, then Delete my account. It is immediate and permanent, and takes your rankings, watchlist, follows and tags with it. We keep nothing afterwards except aggregate counts that can't identify you.
Correct it: change your name or picture any time.
Depending on where you live you may have further rights: access, correction, deletion, portability, objection, and to complain to a regulator. The two buttons above cover most of them directly, and you can ask for anything else.
Your account data stays until you delete it. Sign-in sessions expire after 30 days. Password reset links expire after an hour and work once. Backups are kept for up to 30 days, so deleted data can persist in a backup for that long before ageing out.
On a server in the United States. If you're elsewhere, your data is transferred and stored there.
Passwords are hashed with scrypt. Sessions are random tokens that can be revoked, not signed blobs. Traffic is encrypted. Failed sign-ins are throttled. But no service is perfectly secure, this one is new, and it hasn't had a third-party audit. Don't reuse a password here that protects something important elsewhere.
Not for under-13s, and we don't knowingly collect their data. If you believe a child has an account, contact us and we'll delete it.
If this policy changes we'll say so in the app. Questions go to support@whatsthevibe.me.
whatsthevibe.me · Pricing · Privacy · Terms · Refunds · Support