Last updated 16 August 2026.
The short version. We store your email, your name, your picture and what you rank. We log IP addresses to stop abuse. Your mood searches and your ranked titles are sent to Anthropic to generate recommendations and your taste summary. Nothing is sold, and there are no advertising or analytics trackers.
Because you gave it to us: your email address, your display name, your profile picture if you add one, and your password, hashed with scrypt, never stored in a form we can read.
Because you used the app: what you rank and in what order, how you felt about it, your watchlist, who you follow, who follows you, who you tag as having watched something with you, and what you recommend to whom.
Automatically, for security: your IP address, kept against failed sign-in attempts and against rate limits so one person can't lock others out or run up costs. Sign-in records expire, and rate limit counters are cleared on a rolling basis.
When something breaks: the error and the address of the request that caused it, so it can be fixed. These can contain what you typed into a search.
There are no cookies except the one that keeps you signed in. No advertising networks, no analytics, no third-party trackers, no location data.
If you use "Find friends from contacts": your device's phone numbers and email addresses are checked against Vibra accounts to find matches. Contact names are never read. Nothing from your address book is stored on our end; the list is checked and discarded in the same request.
Anthropic receives your mood search text, and, for your taste summary, the titles, scores and sentiment of up to 40 things you've ranked. It does not receive your email, your name or your account id. This is the one place your ranking data leaves our server.
TMDB, Open Library, Apple and YouTube receive your search terms when you look something up, because the results come from them. They don't receive anything about who you are.
Resend handles password reset email, so it sees your email address.
That's the complete list. We don't sell personal information, we don't share it for advertising, and we don't do anything that counts as "selling" or "sharing" under California law.
Your display name, picture, rankings and scores are visible to people using the app. Your scores count toward an item's average. Your email address is never shown to anyone.
Get a copy: My information, then Download my data, gives you everything as a JSON file.
Delete it: My information, then Delete my account. It is immediate and permanent, and takes your rankings, watchlist, follows and tags with it. We keep nothing afterwards except aggregate counts that can't identify you.
Correct it: change your name or picture any time.
Depending on where you live you may have further rights: access, correction, deletion, portability, objection, and to complain to a regulator. The two buttons above cover most of them directly, and you can ask for anything else.
Your account data stays until you delete it. Sign-in sessions expire after 30 days. Password reset links expire after an hour and work once. Backups are kept for up to 30 days, so deleted data can persist in a backup for that long before ageing out.
On a server in the United States. If you're elsewhere, your data is transferred and stored there.
Passwords are hashed with scrypt. Sessions are random tokens that can be revoked, not signed blobs. Traffic is encrypted. Failed sign-ins are throttled. But no service is perfectly secure, this one is new, and it hasn't had a third-party audit. Don't reuse a password here that protects something important elsewhere.
Not for under-13s, and we don't knowingly collect their data. If you believe a child has an account, contact us and we'll delete it.
If this policy changes we'll say so in the app. Questions go to dantusjosh@gmail.com.
whatsthevibe.me · Privacy · Terms · Support