Privacy Policy
Last updated: October 15, 2026
1. Who we are
Vibe Coding Plan ("we") provides an AI planning and execution platform, including a marketplace for selling project templates. Contact: [email protected].
2. Information we collect
- Account: name, email, password hash, Google account ID if you sign in with Google, and profile settings.
- Billing: subscription, PAYG, AppSumo, and featured-listing status. Card details are handled by Stripe; we store customer and subscription IDs, not full card numbers.
- Project content: plans, tasks, prompts, context memory, exports, and related files you create.
- Marketplace: listing details, prices, sales, buyer/seller IDs, PayPal email, and Stripe Connect account IDs.
- Integrations: GitHub connection tokens and repo metadata; Vercel deploy hooks; encrypted AI provider API keys; MCP and personal API tokens you create.
- Affiliate and rewards: referral codes, cookie attribution, commission totals, and social-share reward claims.
- Usage: pages viewed, feature use, device and browser data, IP address, and support messages.
3. How we use it
- Provide accounts, plans, AI execution, marketplace checkout, and payouts
- Process payments, refunds, chargebacks, and fraud checks
- Send transactional email (verification, receipts, plan-ready notices) and optional product updates
- Clone a listed project into a buyer's account after a completed purchase
- Show public marketplace, tools, showcases, and affiliate pages
- Measure product usage and marketing performance
- Comply with law and enforce our Terms
4. Marketplace and payouts
If you sell a template, your public listing (title, description, price, seller identity as shown on the page) is visible to anyone. After a sale we share payment details with Stripe or PayPal so you can be paid. Buyers receive a copy of the sold project and tasks. We do not sell your personal information.
5. AI providers
When you generate a plan or run a task, prompt text, project context, and related files may be sent to the AI provider you use (for example Anthropic, OpenAI, Google Gemini, DeepSeek, Moonshot/Kimi, GitHub Copilot, or Cursor). If you use our keys, we send that data as needed to deliver the feature. If you add your own keys, requests go to that provider under their privacy policy. Do not put secrets in prompts that you do not want a provider to process.
6. Third-party services
We share data with processors only as needed to run the Service:
- Stripe — subscriptions, PAYG, marketplace checkout, Stripe Connect
- PayPal — seller payouts if you choose PayPal
- Google — sign-in, reCAPTCHA, and Analytics
- GitHub — OAuth and repository linking
- AI providers listed above
- Email delivery for account and product messages
- Hotjar — session analytics
- X (Twitter) and Reddit ads pixels — marketing measurement
- Databuddy — product analytics
Those companies process data under their own policies. We do not control how they use data once it is sent for the purpose above.
7. Cookies and tracking
We use essential cookies for login and security, a referral cookie (about 30 days) for affiliate attribution, and analytics/ads cookies or pixels in production (Google Analytics, Hotjar, X, Reddit, Databuddy). You can block non-essential cookies in your browser. Blocking some cookies may break login or referral tracking.
8. Sharing and legal requests
We share personal data with the processors above, with a marketplace counterparty only as needed to complete a sale, or if required by law, to protect rights and safety, or as part of a business transfer. We do not sell personal data for money.
9. Security and retention
API keys and similar secrets are stored encrypted. No internet transmission is fully secure. We keep account and billing records while your account is active and as long as needed for legal, tax, and fraud reasons. You can delete your account from your profile; some records (for example completed payments and invoices) may be retained.
10. Your rights
Depending on where you live, you may have the right to access, correct, delete, export, or object to processing of your personal data, and to withdraw consent. Email [email protected]. If we rely on consent (for example some marketing cookies), you can withdraw it. If you are in the EEA/UK, you may also complain to your local data protection authority.
11. Children and transfers
The Service is not for children under 16. We do not knowingly collect their data. We may process data on servers outside your country, including the United States, with processors listed above.
12. Changes
We may update this policy and will change the date above. Material changes will be posted on this page.
