vibey
Back to home

Privacy Policy

Last updated: October 13, 2026

This privacy policy covers the Vibey app and the website vibey-app.com. We built Vibey to collect as little data as possible: there is no account, no login, no ads and no tracking.

1. Controller

Niklas Rachow
Bauernweg 17
19071 Dalberg-Wendelstorf
Germany
Email: [email protected]

2. The short version

3. Data processing in the app

3.1 Photos for AI effects and templates

When you use an AI effect or a template, we process the photo you pick or take for it. The app first scales it down to at most 1,536 pixels on the long edge and sends it over an encrypted connection to our server. The server runs on Supabase in a data center in Frankfurt am Main, Germany. From there, the photo and the chosen style are sent to Google's Gemini API. For templates, the template photo is sent as well. The finished image goes straight back to your device.

We do not store your photo or the result on our servers. We have turned off Google's storage of requests for follow-up conversations. According to Google, inputs and outputs may be kept for up to 55 days solely to detect and prevent abuse. This data is not used to train general AI models.

Photos contain faces. We only use facial features so the AI can create your image, not to recognize or uniquely identify anyone. Your photo is not matched against other photos or databases.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract for using the app).

Please only upload photos that show you or for which you have the consent of everyone shown.

3.2 Free filters and editing

The filter editor (filters, adjustments, intensity) works entirely on your device. No photos are sent to us or to third parties.

3.3 Random device ID and usage counter

On first launch, the app creates a random ID (for example "3f9a..."). It contains neither your name nor your Apple ID nor other device data. We use it to

For this, our server stores the ID, the date and the number of AI images per day, plus, for each request, the chosen style, whether it worked, how long it took and any technical error message. These entries are deleted automatically after 30 days.

Legal basis: Art. 6(1)(b) GDPR and, for troubleshooting and abuse prevention, Art. 6(1)(f) GDPR (our legitimate interest in a stable and secure service).

3.4 Technical server logs

With every request to our server, our hosting provider Supabase processes technically necessary data such as IP address, time and size of the request to provide and secure the service. These logs are kept only for a limited time. Legal basis: Art. 6(1)(f) GDPR.

3.5 Subscriptions and in-app purchases

You make purchases directly with Apple. Apple is responsible for processing your payment and account data under its own privacy policy. We do not receive any payment data.

To check whether your subscription is active, we use RevenueCat (RevenueCat, Inc., USA). RevenueCat receives the random device ID, Apple's purchase receipts and transaction data, and technical information such as app version, operating system, device country and language, and IP address. Legal basis: Art. 6(1)(b) GDPR.

3.6 Data on your device

Your results, original photos for the before/after comparison, favorites and settings are stored only on your device. If you choose "Reset app" in settings or delete the app, this data is gone. We have no access to it.

3.7 Permissions

The app only asks for camera and photo library access when you want to take, pick or save a photo. You can change these permissions at any time in iOS Settings.

3.8 Contact by email

If you email us, we process your email address and message to handle your request. Legal basis: Art. 6(1)(b) or (f) GDPR. We delete the message once it is resolved, unless statutory retention periods require otherwise.

4. Website

Our website is hosted by Cloudflare, Inc. When you visit it, Cloudflare processes technically necessary data such as IP address, date and time, the page requested and browser information to deliver the site and protect it from attacks. Legal basis: Art. 6(1)(f) GDPR.

The website sets no cookies, uses no analytics or advertising tools and loads no fonts or content from third parties.

5. Recipients and processors

We only share data where it is needed to run Vibey. We have data processing agreements under Art. 28 GDPR with the following providers, or have accepted their corresponding terms:

Apple processes purchase and account data as an independent controller.

6. Transfers outside the EU

Google, RevenueCat, Supabase and Cloudflare are based in the USA, so data may be transferred to the USA. Where a provider is certified under the EU-US Data Privacy Framework, we rely on the European Commission's adequacy decision. Otherwise, we use the European Commission's Standard Contractual Clauses under Art. 46(2)(c) GDPR.

7. Retention

8. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21).

Because we do not know names or email addresses, we can only find your data via the device ID. You can find it in the app under Settings. Send it with your request to [email protected].

You also have the right to lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of Mecklenburg-Western Pomerania.

9. Children and teens

Vibey is intended for people aged 13 and older. If you are under 16, please only use the app with your parents' permission. We do not knowingly collect data from children under 13.

10. No automated decisions

We do not make automated decisions within the meaning of Art. 22 GDPR and do not create profiles about you.

11. Changes

We update this privacy policy when the app or the law changes. The version published here applies. If the German and English versions differ, the German version prevails.