Privacy & data
VibeSitter is built like a babysitter: it watches, it reports, and it never touches your stuff.
Scan results
Scan snapshots are kept for 90 days by default so we can compare fixes over time. Finding history may be kept longer to show fix progress.
Security tokens
Supabase OAuth tokens are encrypted at rest with a separate application secret. We never log tokens, keys, or connection strings.
What we never scan
VibeSitter runs metadata and configuration checks only. We never scan payloads, PII, or the contents of your tables or files.
Deleting your data
Disconnect your project and we delete your data on request within 7 days. Deleting your account removes projects, scans, and findings.
Anonymity
Anonymous free scans are rate-limited by IP in memory. We don't store the IP with the scan result. The full report is email-gated.
Cookies
We use essential cookies only: an encrypted session cookie and a short-lived OAuth PKCE cookie. No advertising or analytics cookies.
Alerts and digests go to the email on your account. You can change it in Account, or unsubscribe from the footer of any email.
Questions: hello@vibesitter.app · See also the access summary.