VibesX Privacy Policy

Last updated: October 6, 2026

Notice: This document is an informational translation provided for convenience. The original, legally binding, and prevailing version is the Spanish version. In the event of any conflict, discrepancy, or inconsistency between this translation and the Spanish version, the Spanish version shall prevail to the extent permitted by applicable law.

This Privacy Policy describes how VibesX ("the App", "we", "us") collects, uses, stores, and protects the personal information of users ("you", "the user") of the VibesX application, available on Android, iOS, and as a progressive web application (PWA) at vibesx.app.

1. Data Controller

2. What is VibesX

VibesX is a location-based social discovery app for events and plans. It allows users to:

3. Data We Collect

3.1 Registration and Profile Data (Delegated Authentication)

VibesX does not store or manage passwords directly. User login is delegated to third-party identity providers via OAuth:

Upon signing in, we receive from your chosen provider the basic information you authorize (typically your name, email address, and profile photo, if applicable), which we use to create your internal VibesX profile (internal user ID, display name, avatar, and account role). You can also use the App as a guest user, with limited functionality and without creating an identified account.

3.2 Location

We request permission for precise and approximate location (GPS) while you are using the App in the foreground, in order to:

VibesX does not collect location in the background: we do not request background location permissions and your location is only accessed while the App is in active foreground use.

3.3 Camera, Microphone, Photos, and Videos

With your explicit permission, we access your device's camera, microphone, and media gallery so you can:

Text recognition, entity extraction, code scanning, and language detection/translation are processed locally on your device using offline machine learning libraries; images are not sent to external servers for this purpose. Photos and videos you decide to publish to a Vibe or Flare are uploaded to our cloud storage so other participants can see them.

3.4 User-Generated Content and Communications

3.5 Device and Application Information

We collect basic technical data (device model, operating system version, App build version) to:

3.6 Notifications

3.7 In-App Rewards

VibesX includes an internal reward balance ("Embers") earned by participating in the App. This balance and transaction history have no monetary value and cannot be redeemed for real money. Currently, the App does not process real-money transactions or in-app purchases. If paid features are introduced in the future, this policy will be updated and users will be informed beforehand.

3.8 Data We Do NOT Collect Directly

We do not request or store your password (authentication is handled by Google, Apple, or Facebook) nor payment card data, as the App currently processes no financial transactions.

4. Purposes of Processing

We process the data described above to:

  1. Create and manage your account and public profile (User ID, QR code).
  2. Deliver the App's core functionality: map, discovery of Vibes/Flares, chat, friends, and squads.
  3. Apply account tier limits (guest, registered user, PRO or business account), such as daily post limits, discovery radius, or video upload limits.
  4. Send you relevant notifications regarding your App activity.
  5. Detect, diagnose, and resolve technical bugs, maintaining platform security.
  6. Comply with legal obligations when required.

We process your personal data on the following legal bases: (a) performance of the contract / terms of service for providing the App, (b) your explicit consent for permissions such as camera, microphone, location, or push notifications, and (c) our legitimate interest in maintaining platform security, reliability, and functionality.

6. With Whom We Share Data

We do not sell your personal data.

Visibility of your profile to other users: Only your internal User ID, username, nickname, and avatar are displayed. Your email address and full name are never visible to other users or unauthenticated visitors. If someone searches for you by email or name, they only receive your public profile without revealing those underlying details.

We share data only with:

Our database, authentication, and file storage infrastructure are hosted on Supabase in the European region, under a Data Processing Agreement (DPA) pursuant to Article 28 GDPR. Identity providers (Google, Apple, Facebook) may process authentication data outside the European Economic Area as independent controllers, subject to their own privacy policies and appropriate international transfer safeguards (Standard Contractual Clauses or other valid GDPR mechanisms).

7. Data Retention

We retain your data as long as your account remains active. Vibes and Flares with an expiration time (such as short-lived Flares) are automatically hidden or deleted once expired. If you delete your account, we delete or anonymize your personal data within a reasonable timeframe, unless legal obligations require retention.

8. Your Rights

If you reside in the European Economic Area (or jurisdictions with equivalent rights), you may exercise your rights of access, rectification, erasure, objection, restriction of processing, and data portability, or withdraw your consent (e.g. revoking camera, location, or notification permissions in your device settings) at any time. To exercise these rights, email us at support@vibesx.app. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) or your competent national supervisory authority.

Delete Your Account

You can delete your account and all associated data at any time directly within the App: Settings → Delete account and data. Upon confirmation, your profile, Vibes, Flares, friendships, squads, notifications, and auth credentials are permanently erased. If you cannot access the App, contact support@vibesx.app from the email address linked to your account; we will process your request within one month. Backup snapshots are permanently purged according to our infrastructure provider's retention schedule.

9. Minors

VibesX is not intended for individuals who do not meet the legal age required in their country of residence to consent to personal data processing without parental consent. In Spain, this age is set at 14 years (Article 7 LOPDGDD); under GDPR it is generally 16 unless reduced by a Member State (never below 13).

This restriction applies regardless of whether the App contains mature content: VibesX involves real-time location sharing, open chat with other users, and in-person social meetups, which present inherent safety risks for minors. If you become aware that a child under the legal age has provided personal information to us, please contact us so we can delete it immediately.

10. Security

We implement reasonable technical and organizational measures (role-based access control, database row-level security policies, and TLS encryption in transit) to protect your data against unauthorized access, loss, or alteration. No system is 100% secure; we strongly recommend securing your login credentials on your identity provider account.

11. Device Permissions and How to Revoke Them

You can grant or revoke permissions for camera, microphone, location, storage, and notifications at any time in your device's operating system settings. Revoking permissions may limit corresponding App features (e.g. proximity discovery without location, or media uploads without camera/gallery permissions).

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our App or applicable regulations. We will publish the updated version on this page along with its effective date. Your continued use of the App following an update constitutes acceptance of the changes.

13. Contact

For any questions regarding this Privacy Policy or data processing, please contact us at support@vibesx.app.

See also the Terms of Service of VibesX.