1. Scope and contact
VibeVariant is operated by Anass Lahlal as an individual. References to “VibeVariant,” “we,” “us,” or “our” in this policy mean Anass Lahlal.
This policy describes data handling by the VibeVariant website, Chrome extension, and related API and AI services. For privacy questions, access requests, corrections, or deletion requests, contact hello@vibevariant.com from your account email. We may need to verify account ownership before acting on a request.
2. Information we process
Account data includes your email address, account identifier, name when provided by your sign-in provider, authentication session, plan, and credit usage. If purchases are enabled, we also process payment-provider identifiers, subscription status, order records, and receipts. Payment details are handled by the payment provider.
To create and verify a variant, we process your prompts, conversation history, JavaScript and CSS, selected elements, page URLs and titles, and page context requested by the assistant. That context can include DOM structure, visible text, element attributes, layout and computed styles. Images and other attachments you submit are also processed. Page context, including text and URLs, can contain personal or confidential information.
For visual verification against a reference image, the extension can capture up to three viewports of the active preview page after you grant temporary access by clicking its toolbar icon on that tab. It may temporarily scroll to the changed region. These screenshots can include surrounding visible text and images, including personal or confidential information; sensitive visible content is not automatically redacted. Captures pass through our API to OpenAI for immediate comparison with your uploaded reference. Ordinary measurement-only verification does not capture screenshots.
Operational records include request, conversation, run and account identifiers, timestamps, error codes, model usage, credit transactions, and queue and worker diagnostics. Hosting providers may also process connection information such as IP addresses and user agents when serving requests.
If you enable Share error reports in the extension, we send limited diagnostics to PostHog: account or anonymous diagnostic identifiers, release and component versions, operation and error codes, request/run references, and application stack locations. These reports exclude page content, verification screenshot pixels, prompts, generated code, and raw provider error messages. You can turn this off in Settings; the preference applies to this browser. We also use server diagnostics to operate the service.
When server log export is enabled, we send limited operational summaries to PostHog for reliability and troubleshooting. These include stable event names, severity, service and release versions, request, account, run and order references, status codes, timings, and retry counts. Exported logs exclude free-text log messages, raw errors, prompts, code, website addresses, page content, names, emails, and credentials. Server logs are controlled separately from optional extension usage analytics and error reports.
If you enable Share usage analytics, we send explicit extension feature events and related service outcomes to PostHog, including pseudonymous account or anonymous identifiers, event times, versions, project and conversation references, feature choices, credit amounts, and purchase outcomes. Usage events exclude names, emails, prompts, code, website addresses, page content, and Support messages. Usage analytics is off by default and controlled separately from error reporting and Support. Signed-in preferences apply to your account, including backend events; the signed-out preference applies to this browser. We do not link anonymous history to an account. Turning sharing off stops future collection; it does not erase previously collected events.
When available, in-app Support sends your messages to PostHog, together with your account email, account name when available, verified account identifier, and extension session context. It also sends any additional contact details you provide in chat. Do not include passwords, access tokens, or sensitive page content. Support works independently of optional error reporting; session replay is disabled.
3. Why and when we use information
We use this information to sign you in, save your projects and variants, carry out your AI requests, inspect and verify the selected page, maintain previews, account for credits, provide support, and keep the service secure and reliable.
The extension checks page URLs to match your project targeting and maintain previews you started. Page inspection supports your variant workflow; VibeVariant does not send a general browsing-history feed to the AI provider. Previews may resume on matching pages while your preview session is active. Stop the preview or close its workspace to end that session, unless you explicitly kept it for a demo.
Before submitting a request, check the page and any attachments for information you should not share. Do not use the assistant on sensitive pages or submit passwords, access tokens, payment information, or content you are not authorized to disclose. Inspection safeguards cannot remove every sensitive detail from visible text or page attributes.
4. Service providers and sharing
VibeVariant sends the conversation, relevant page context, code, and attachments needed for a request to OpenAI to generate and review suggested changes. Supabase provides authentication and private storage for compressed reference images attached to prompts. Account records, attachment metadata, and application records are stored in our configured database. Original image files are processed in your browser and are not uploaded. Uploaded references remain with their chat until its parent data is deleted; storage deletion is retried by our background cleanup. For reference-image verification, OpenAI also receives the transient rendered-page captures described above. Comparison requests disable response storage and do not use provider conversation or response chaining. Provider retention controls still apply; disabling response storage does not guarantee zero retention by the provider. Infrastructure providers process data to host the website, API, database, and background jobs. If billing is enabled, Polar processes checkout, subscription, and payment events. PostHog provides optional extension error reporting, server error monitoring and operational logs, optional product usage analytics, and in-app Support when those features are enabled, using our EU project. Support processing can also create conversation events and notification previews containing message content and customer contact details.
Provider processing can take place outside your country. Their own terms and privacy policies also apply: OpenAI, Supabase, and Polar, and PostHog.
We do not sell user data or use website context for personalized advertising. We use and transfer information received through Chrome APIs in accordance with the Chrome Web Store User Data Policy, including its Limited Use requirements. Human access to that data is limited to your consent for specific support, security investigations, legal requirements, or aggregated and anonymized internal operations permitted by that policy.
5. Storage and retention
The extension stores authentication state and preferences in your browser. Learning preferences are stored per account locally. Preview sessions and design baselines use extension session storage. Signing out clears the active session; removing the extension clears its browser storage.
Verification screenshot pixels are processed in browser and API memory for the immediate comparison and are not written by VibeVariant to databases, image buckets, files, browser storage, background-job payloads, events, logs, diagnostic exports, or conversation history. Image references are released when the attempt ends. Textual comparison findings, capture coverage, the assessed code revision, and usage records may be retained; findings can describe page content. User-uploaded reference images have the separate chat-linked storage and deletion lifecycle described above. These statements about VibeVariant storage do not override provider retention practices.
Saved projects, variants, conversation history, and credit records remain in the service until deleted or removed through an account request. You can delete projects and variants from the extension. Database diagnostics are configured for seven-day retention, with periodic cleanup. This period does not describe conversation history, hosting logs, provider records, or backups.
For account deletion and access to stored account data, email the contact above. Some payment, fraud-prevention, or legally required records may need to be retained. Backups and provider-held copies follow their own retention and deletion processes. PostHog diagnostics, optional usage events, Support messages, and notification copies follow the configured provider retention settings; the seven-day database diagnostic period above does not apply to them. Account deletion requests include these provider-held records where applicable. Deletion from the active application does not immediately erase every such copy.
6. Website storage and sign-in returns
The public website keeps interactive demo state in browser memory. Its application code does not include advertising trackers or a separate analytics service. Infrastructure providers may retain request logs.
The email sign-in return page passes callback credentials to the installed extension for session validation. It removes credentials from the address bar and keeps them in memory for the handoff; the website does not create a separate signed-in session. Google or email authentication and any future checkout can involve provider-managed cookies or storage.
7. Your choices and updates
You can stop previews, revoke website access in Chrome, disable Allow User Scripts, sign out, delete projects or variants, or uninstall the extension. Reference-image screenshot comparison requires the active preview tab and temporary access granted through the toolbar icon; you can choose not to use that workflow. These actions do not by themselves delete your server account. Depending on applicable law, you may have rights to access, correct, delete, restrict, or object to processing of personal information; contact us to make a request.
We will update this page when our practices change and communicate material changes through the service or account email where appropriate.