Legal

Privacy Policy

Last updated 30 September 2026

In short: we use your data to run your Vibbi and nothing else. We don’t sell it or use it for advertising. Abilities such as web access, computer access, and Google connections stay off until you turn them on. You can see, correct, export, or delete your data at any time. Your chats are encrypted in transit and on our servers, but they are not end-to-end encrypted: Vibbi’s AI reads the messages it answers (see section 9).

• Who we are
• What we collect
• How we use it
• AI providers
• Google data
• Who we share with
• How long we keep it
• Your rights
• Security and encryption
• Cookies
• Contact

1. Who we are

Vibbi (“Vibbi”, “we”, “us”) is provided by Z.A.G Holdings LTD, Cyprus. We are the controller of the personal data described here for the Vibbi website (vibbi.world), your Vibbi account, and the Vibbi desktop app. Contact us about privacy at contact@zag.holdings.

2. What we collect

Data you give us

• Account: your email address (used to sign in with a one-time code), your @username, your Vibbi’s name and avatar, and the name you ask Vibbi to call you.
• Conversations: the messages you send Vibbi and her replies. Vibbi keeps a short summary of durable facts you share (her “memory”), the last few messages, and any notes you choose to save.
• Reminders: what to remind you about, when, and your time zone.
• Vibbi network: invitations you send or receive, and messages in shared conversations with other worldmates.
• Creations: descriptions of images or videos you ask for, and the resulting files.
• Voice: when you use the microphone, a short recording of what you say. It is turned into text and is not stored by us.

Data from your use of Vibbi

• Devices: the name and platform of each connected computer, the app version, when it last checked in, and your country as estimated from your IP address (used to make web results local). We store a scrambled (hashed) version of each device’s access token, never the token itself.
• Activity: a log of the actions Vibbi takes for you (for example a search, a page she read, a file she opened after you clicked, or an email you sent), shown to you under Abilities and used for daily limits.
• Brain map and expressions: Vibbi’s brain map is drawn from her memory summary. While she works on a message we store only which areas are active and a mood, never message text. The brain map is an artistic picture, not a medical or psychological assessment.

Data from abilities you turn on

• Web: the searches Vibbi runs and the public pages she reads.
• Your computer: when you ask, the desktop app looks for files and apps by name in your Desktop, Documents, Downloads, Pictures, Music, and Videos folders. Names, folders, dates, and sizes are sent to answer you. File contents never leave your computer.
• Websites: while Vibbi works in her browser window, the text and buttons of the pages she is on are sent to answer you. She never types passwords or payment details; you enter those yourself, and they are not sent to us.
• Google Calendar and Gmail: see section 5.

We do not ask for special categories of data (such as health information) and Vibbi is instructed not to save passwords, one-time codes, payment details, or sensitive health information in her memory.

3. How we use it, and our legal bases

We do not sell your personal data, use it for advertising, or use it to make decisions that have legal or similarly significant effects on you.

4. AI providers

Vibbi’s replies, searches, voice, and creations are produced by AI services acting on our behalf. The message you send, relevant memory, and any results Vibbi gathered are sent to the provider chosen for that function, currently from: DeepSeek, OpenAI, and Anthropic (conversation and search), Brave Search (web search), OpenAI (listening and Vibbi’s voice), and OpenAI or Runway (images and video). We use their paid developer APIs, not consumer apps. Under their API terms, OpenAI and Anthropic do not use API data to train their models by default. Each provider may keep request data for a limited period under its own policy, for example to prevent abuse. Only the admin-chosen provider for each function receives data. AI answers can be wrong; please check anything important.

5. Google user data

If you connect Google Calendar or Gmail, Vibbi asks Google only for:

• Google Calendar (calendar.events): to list your upcoming events and, after you click Add to calendar, create an event.
• Gmail (gmail.readonly, gmail.send): to search and read emails when you ask, and, after you click Send email, send the email you reviewed.

Your Google sign-in is stored encrypted on our servers and is never stored on your computer. Email and calendar content is read only to answer your request, is passed to the AI provider for that answer, and is not stored by us apart from the conversation itself. You can disconnect each service under Abilities, and revoke access in your Google Account at any time.

Vibbi’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, do not let people read it except with your permission, for security, or where the law requires, and do not use it to train AI models.

6. Who we share data with

We share personal data only with service providers that process it for us under contract (data processing agreements):

• Supabase: database, sign-in, encrypted secrets, and file storage.
• Vercel: website and server hosting.
• Resend: sign-in codes and reminder emails.
• AI providers listed in section 4, and Google when you connect it.
• GitHub: hosts the desktop app download (it sees your IP address when you download).
• Google Firebase Cloud Messaging: delivers notifications to the Android app. A notification can include who wrote and the start of the message, unless you turn notifications off on your phone.

Other worldmates who look up your @username, and your Vibbi Friends, see your @username, the name you set under “Your name” (if any), your selected Vibbi’s name and picture, and what you write in shared conversations you accept. We may disclose data if the law requires it or to protect people’s safety. Some providers are located outside the European Economic Area, including in the United States (and DeepSeek in China). Where required, we rely on appropriate safeguards for these transfers, such as the European Commission’s Standard Contractual Clauses or an adequacy decision.

7. How long we keep it

• Account, profile, memory, notes, reminders, creations, and activity: while your account exists. You can clear Vibbi’s memory at any time.
• Your chat with Vibbi: until you delete a message, clear the chat, or delete your account.
• Shared conversations: until the messages are deleted or the conversation is removed. Messages you wrote are deleted when you delete your account.
• Paused steps while Vibbi works on your computer or in her browser: deleted after use, and at most after 10 minutes.
• Voice recordings: not stored by us.
• Google connections: until you disconnect them or delete your account.
• When you delete your account, we delete your personal data within 30 days, except what we must keep by law.

8. Your rights

Under the GDPR and similar laws you can ask to access, correct, delete, or receive a copy (portability) of your data; object to or restrict processing based on legitimate interests; and withdraw consent at any time. Write to contact@zag.holdings; we answer within one month. You can also complain to a data protection authority: our lead authority is the Commissioner for Personal Data Protection in Cyprus (dataprotection.gov.cy), or the authority where you live or work. Many controls are built in: edit your profile on the dashboard, clear memory, turn abilities off, disconnect Google, and change cookie choices.

Vibbi is not meant for children under 16. If you believe a child has given us data, contact us and we will delete it.

9. Security and encryption

How your conversations are protected, and who can read them:

• In transit: everything between the Vibbi apps, our servers, and our providers travels over encrypted connections (HTTPS/TLS).
• At rest: your messages, memory, and files are stored encrypted on our database and storage provider’s disks. Secrets such as Google sign-ins and provider keys are additionally encrypted.
• Not end-to-end: Vibbi’s replies are made on our servers, so our servers can read your conversations. They are not end-to-end encrypted.
• Your chat with Vibbi: for each reply, your message, relevant memory and notes, and anything Vibbi gathered for you are sent to the AI provider chosen for conversation (section 4).
• Shared conversations with other worldmates: stored and protected the same way. When Vibbis take part, or when you ask your Vibbi to draft a message, the shared messages they can see are sent to the AI provider for that reply. Vibbis in a shared chat never see private chats, memory, notes, photos, or files.
• Our access: we look at conversations only to run the service, to deal with a problem or abuse reported to us, to keep Vibbi secure, or when the law requires.

We also use strict database access rules and short-lived links for your creations. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.

10. Cookies

We use only the cookies below. Necessary cookies don’t need consent; anything optional is off until you allow it. Cookie settings

The desktop app stores your settings and an encrypted device token on your computer; these are not cookies and never leave your device except to sign in.

11. Changes

If we change this policy in a meaningful way, we will tell you on the website or by email before the change takes effect.

12. Contact

Questions or requests: contact@zag.holdings. See also our Terms of Service.