Türkçe · English

Privacy Policy

Last updated: 12 October 2026

1. Data Controller and Contact

VYBE. is operated by an independent individual developer, who is the data controller for the data processed within this App (the "Developer", "we"). There is no incorporated company.

For all privacy-related questions and requests: velalabss@gmail.com

2. What Data We Collect, and Why

a. Anonymous device identifier

When you first open the App, a random identifier (UUID) is generated on your device and stored in your device's secure storage (iOS Keychain / Android Keystore). This identifier does not reveal your name, your email address or the identity of the person using the device; it is used only to apply the one free generation each device receives, to prevent abuse, and to recognise your optional subscription.

b. Screenshots you upload

The screenshot you select for analysis is sent, via our servers, to our AI service provider (Anthropic) for the purpose of generating reply suggestions. The image is held in memory for the duration of the request and is not stored permanently on any of our servers.

c. Subscription status

To verify whether you are a VYBE. Premium subscriber, your anonymous device identifier is sent to our subscription infrastructure provider, RevenueCat, with each suggestion request. When you make a purchase, the product identifier, the purchase/expiry dates and the subscription status are stored on RevenueCat's side. Your card or payment details never reach us or RevenueCat; that information is processed directly by Apple/Google.

d. Notification token (optional)

If you grant notification permission, a notification token specific to your device is stored on our server together with your anonymous device identifier.

e. Usage analytics

The App includes an analytics infrastructure capable of collecting anonymous usage statistics for product-development purposes (for example, which tone was selected, or whether an operation succeeded). This feature is currently disabled; even when enabled, no message content, screenshot or suggestion text is sent — only anonymous interaction metadata is collected.

f. IP address (abuse protection)

When the App sends a request to our servers — for reply suggestions, to refresh your usage count, to register a notification token or to delete your data — the IP address the request comes from is temporarily recorded together with a request count, to block automated and bulk requests and to limit how many reply suggestions one address can receive per day. These records are kept for a maximum of 3 days and then deleted automatically; they are not linked to your device ID or to any content.

g. Data that stays on your device and never reaches us

The following information is stored only on your device and is never sent to our servers: the character profile you optionally provide (age range and style preference — these are sent to the server, only with your permission and together with the single relevant request, solely to produce more personalised suggestions), your language preference, and whether you have seen the onboarding screen.

Data we do not collect

We do not collect your name, email address, phone number, location, contacts or social media accounts. We have no access to your messaging apps; we process an image only when you select and upload a screenshot yourself.

3. Who We Share Your Data With

Your data is shared with the following service providers, only for the purposes stated:

• Anthropic (USA) — AI analysis service. Data shared: the screenshot you upload, the tone/mode you select, and your character profile preferences if any.
• RevenueCat (USA) — subscription management. Data shared: the anonymous device identifier; product and subscription information if you have made a purchase.
• Supabase (EU — Frankfurt) — server and database infrastructure. Data shared: the anonymous device identifier, the notification token, timestamps.
• Expo (USA) — notification delivery infrastructure. Data shared: the notification token.
• Apple / Google — app store, payment, and notification delivery. Data shared: purchase transactions, payment information (this does not reach us).
• PostHog (not active) — product analytics. No data is currently sent.

We do not sell or rent your data to third parties for marketing purposes under any circumstances.

4. How Long We Keep Data

• Usage records: Two records, neither of which contains any content. (1) An abuse-prevention counter consisting only of the device identifier and a timestamp, kept for at most 30 days and then deleted automatically. (2) A single timestamp recording that this device has used its one free generation. Because deleting that timestamp would hand the same device another free generation, it is kept for as long as the free-trial rule applies rather than being purged after 30 days. Neither record is linked to your identity or to any message content.
• Notification token: Kept for at most 30 days and deleted automatically; it can be deleted immediately via "Delete my data" (see Section 6).
• Screenshots: Never stored permanently; erased from memory once processing is complete.
• Deletion-request record: A record with no content, showing when a "Delete my data" action was performed, is kept for at most 30 days.
• IP address records: kept for a maximum of 3 days, deleted automatically.

5. Where Your Data Is Stored

Our server infrastructure is hosted in the European Union (Frankfurt, Germany). Some of our service providers — such as Anthropic, RevenueCat and, when enabled, PostHog — are located in the United States; when your data is transmitted to these providers it may leave the EU. Such transfers are carried out on the basis of appropriate safeguards, such as Standard Contractual Clauses (SCCs), under Article 46 of the GDPR.

Data processing agreements are in place with all of these providers, requiring them to process your personal data only on our instructions and for the purposes described in this policy, not to use it for their own purposes, and not to train artificial intelligence models on it. We confirm that each provider affords the same or equivalent level of protection as committed to in this policy.

6. Your Rights

Under Article 11 of the KVKK and Articles 15–22 of the GDPR, you have the right to: learn whether your data is being processed, access the data being processed, request the correction of data processed incorrectly, request the erasure of your data, object to processing, and — for processing that relies on consent — withdraw your consent.

• In-app deletion: Settings → "Delete my data" immediately removes this device's notification token from the server and deletes the character profile stored on your device. Two records are not deleted by this action, neither of which contains any content: the anonymous abuse-prevention counter (device identifier + timestamps; retained for at most 30 days on legitimate-interest grounds to prevent abuse), which erases itself when its retention period expires; and the single timestamp recording that this device has already used its one free generation, which is kept for as long as the free-trial rule applies, because deleting it would hand the same device another free generation.
• Deleting the App: Removing the App from your device deletes your device identifier and character profile from your device; server-side records are deleted automatically within the periods stated above.
• Direct request: You can send any request regarding your data to velalabss@gmail.com; we respond to requests within 30 days at the latest.
• Right to complain: You have the right to lodge a complaint with the Personal Data Protection Authority in Türkiye, or with the competent data protection authority of your country of residence in the European Union.

7. Children's Privacy

VYBE. is not designed for or directed at anyone under the age of 18. We do not knowingly collect data from a user under 18. If we become aware of such a case, we will delete the relevant data immediately.

8. Changes

We may update this policy from time to time. We will announce significant changes within the App; the current version is always available in this document and on the Privacy screen within the App.

9. Contact

For questions: velalabss@gmail.com