Privacy Policy
Vibemap keeps your vibes on your phone. This policy explains what the app stores, what leaves your phone when you ask the AI to read something, who handles it, and the choices you have.
Contents
- The short version
- Who we are (data controller)
- What stays on your phone
- What is sent when the AI reads something
- Who handles it
- What our server keeps
- Voice, photos, notifications, Face ID and updates
- Purchases
- Why we use data, and on what basis
- How long data is kept, and deleting it
- Sending data abroad
- Your rights
- Children
- Security
- Changes to this policy
- Contact
01The short version
- No account, no login, no ads and no tracking. The app has no advertising or analytics SDKs and never asks to track you across apps.
- Your stories, readings, Book, saved bets and everything Vibemap learns about you are stored only on your iPhone.
- AI reading needs your permission first. When you tap send, what you wrote (and any screenshots you picked) goes through our server to the AI and the answer comes back. We do not store or log that content.
- Our server keeps only daily usage counters under a random install ID, and they expire after about 36 hours.
- You can turn AI off in You → AI & privacy and erase everything with You → Your data → Delete all data.
02Who we are (data controller)
Vibemap is published by Coldter (“we”, “us”), based in Thailand. We are the data controller under Thailand’s Personal Data Protection Act B.E. 2562 (2019) (“PDPA”) for the limited data described in this policy. For privacy questions and requests, write to nitiszaza27@gmail.com. Support: https://vibemap.coldter.com/support.
03What stays on your phone
Vibemap has no accounts and no server that holds your history. The following is stored in the app’s own storage on your iPhone:
- Your vibes: the stories you write, the readings (emoji, feeling line and place on the map), where you nudged them, and your Book.
- Vibe Bet: the bets you choose to save, with the chat text you typed or pasted. The screenshots themselves are never kept, only how many there were.
- What it learned about you: how your feelings tend to differ from its first guess (calibration) and the feelings you land on most.
- Settings: your onboarding answers, language, reminders, haptics, your AI choice, the Face ID lock switch and your Vibemap+ status.
We cannot see or retrieve any of this. You → Your data → Delete all data erases it, and deleting the app removes everything the app stored. If you back up your iPhone with iCloud or a computer, Apple may include the app’s data in that backup, under your Apple settings.
04What is sent when the AI reads something
Reading a vibe and Vibe Bet use AI. Before the first one, Vibemap asks for your permission on an in-app consent screen. Nothing is sent until you allow it, and then only when you tap send. Each time, the app sends:
- Reading a vibe: the story you wrote (up to 4,000 characters) and your language. So it can learn how you feel, it also sends a few of your recent stories (each cut to 200 characters) with the readings you settled on, and your calibration numbers. When you nudge a reading, it sends the current reading and the spot you pointed at.
- Vibe Bet: the chat text you pasted, your question and up to 3 screenshots you picked (as JPEG images). Chats and screenshots can contain other people’s messages, names and pictures, so share only what you have the right to share (see the Terms of Use).
- With every request: a random install ID made by the app (not linked to your name, Apple ID or any advertising ID) and the app version.
Bets never feed what Vibemap learns about you. We do not send your whole Book, your contacts, your location, your photo library or any advertising identifier.
What you write about your feelings can reveal sensitive things (for example about your health, relationships or beliefs). That is why we ask for your explicit consent before anything is sent, and why nothing you send is stored by us.
05Who handles it
- Our server is a small service (“vibemap-api”) that runs on Cloudflare Workers. It checks limits, passes your request to the AI and sends the answer back. It does not save the content of your stories, chats, screenshots or the AI’s answers, and never writes them to its logs. Its log lines hold only technical facts such as the request ID, route, status, timing, text length, token counts and the app version.
- The AI is Claude, a model by Anthropic, reached through the Anthropic API. Under Anthropic’s commercial terms, inputs and outputs sent through the API are not used to train its models by default, and are kept only for a limited time, for example for trust and safety. See Anthropic’s privacy policy.
- Switching models: we may switch the AI to a model that runs on Cloudflare Workers AI in our Cloudflare account. While that model is in use, Cloudflare processes your request instead of Anthropic. Cloudflare states that it does not use Workers AI customer content to train models (Workers AI data usage). Only one model is used at a time.
- Abuse prevention: we pass the AI provider a one-way hash of your install ID, never the ID itself or anything that identifies you, so it can spot abuse from a single install.
- Cloudflare, which hosts our server, keeps standard request logs (IP address, time and request details such as the path and status, not the content) for security and operations, for a short period. See Cloudflare’s privacy policy.
We do not sell your data, share it for advertising, build profiles from it or use it to train AI models.
06What our server keeps
To keep costs fair and stop abuse, our server keeps a few small entries in Cloudflare KV, and nothing else:
- Daily usage counters: how many AI reads an install made that day (UTC), stored under the random install ID, plus how many requests the AI declined that day. They expire after about 36 hours. If the install ID is missing, a one-way hash of the IP address is used instead, never the IP address itself.
- Rate limits: short-lived per-minute counts kept by Cloudflare’s rate limiting, keyed by the install ID or IP address.
No stories, chats, screenshots, answers, names or accounts are stored on our server.
07Voice, photos, notifications, Face ID and updates
- Voice input: when you tap the mic, Vibemap uses Apple’s speech recognition to turn your words into text. The microphone is on only while you are recording. Apple may process the audio under Apple’s privacy policy. We never receive the audio, only the text if you then send it.
- Photos: Vibe Bet opens the iOS photo picker. The app gets only the screenshots you pick (up to 3) and sends them only when you tap send. It cannot see the rest of your library.
- Notifications: reminders (the daily check-in and a reminder before a free trial ends) are local notifications scheduled on your phone. We run no push server and receive no device token.
- Face ID lock: handled entirely by iOS. The app only learns whether you were recognised. Nothing about your face ever leaves the device or reaches us.
- App updates: when the app starts, it asks Expo’s update service (EAS Update) whether a newer version is available. That request carries a random ID made for updates, the app and runtime version and the platform, and Expo sees the IP address as any web service does. It carries none of your content. See Expo’s privacy policy.
08Purchases
Vibemap+ is sold through Apple’s In-App Purchase. Apple handles the payment; we never see your card details or your Apple ID.
The app checks whether you have Vibemap+ on your phone, using Apple’s StoreKit. We do not run a purchase server and no other company handles your purchases. Purchases are processed by Apple under Apple’s privacy policy.
Apple may give us aggregated, anonymous statistics (sales, downloads and, for people who opted in, crash data) through App Store Connect.
09Why we use data, and on what basis
Under the PDPA (and the GDPR, where it applies) every use of personal data needs a legal basis. These are ours:
- AI reading (vibes and Vibe Bet). Purpose: to give you the reading you asked for. Basis: your explicit consent, given on the in-app consent screen and withdrawable at any time.
- Other people in the chats you share. We process their messages only on your instruction, only to answer you, and keep none of it. You are responsible for having the right to share them.
- Keeping the service safe and fair (usage counters, rate limits, request logs, the hashed ID sent to the AI provider). Purpose: fraud prevention, security and fair use. Basis: our legitimate interest. We keep this data only briefly and use it for nothing else.
- Your purchase (handled by Apple). Basis: performing our contract with you (the Terms of Use).
- App updates (Expo). Basis: our legitimate interest in keeping the app working and secure.
- Answering your messages (e-mails you send us). Basis: taking steps at your request, and our legitimate interest in supporting our users.
We do not use your data for advertising, profiling or decisions about you made only by a machine, and we use or disclose it only where the law requires.
10How long data is kept, and deleting it
- On your phone: until you delete it. You → Your data → Delete all data erases your vibes, Book, saved bets, what the app learned and your settings. Deleting the app removes everything it stored.
- What you send to the AI: not stored by us. The answer is returned to your phone and discarded on our side. Anthropic (or Cloudflare, if that model is in use) keeps it only as its commercial terms allow.
- Usage counters: about 36 hours. Rate limits: about a minute.
- Request logs: kept by Cloudflare for a short period for security and operations.
- E-mails you send us: kept only as long as needed to deal with your request and any follow-up, then deleted.
- Purchases: kept by Apple as its terms and the law require. Deleting the app does not cancel a subscription; cancel it in your Apple ID settings.
11Sending data abroad
Anthropic processes AI requests in the United States, Cloudflare runs our server on its global network, and Expo’s update service is based in the United States. Your data may therefore be processed outside Thailand, including in countries whose data-protection rules may differ from the PDPA. We rely on your explicit consent for AI reading (the consent screen and this policy tell you about the transfer before you choose) and on the data-protection terms these providers offer their customers.
12Your rights
Because your data lives on your phone, you already hold it: you can see it in the app, change it, and delete it as described above.
Under the PDPA you have the right to:
- Withdraw consent at any time, as easily as you gave it, in You → AI & privacy. Nothing is sent from then on. It does not affect what was done before.
- Access the data we hold about you and get a copy.
- Correct data that is wrong.
- Erasure: ask us to delete or anonymise your data.
- Object to our processing of your data, and restrict how we use it.
- Portability: receive your data in a common format.
- Complain to the Personal Data Protection Committee (PDPC) through its office at pdpc.or.th if you think we have broken the PDPA. We would like the chance to put it right first, but you do not have to contact us before you complain.
To use any of these rights, write to nitiszaza27@gmail.com. We may ask you to confirm the request comes from you, and we will reply within 30 days, free of charge. We hold no content and no account for you; our only records are usage counters under a random install ID, which we cannot link to you and which expire within about 36 hours. If you live elsewhere (for example under the EU or UK GDPR or California law) you may have similar rights, and you can also complain to your own data protection authority.
13Children
Vibemap is not directed at children under 13, and we do not knowingly collect personal data from them. If you are a minor where you live (in Thailand, generally under 20), a parent or guardian must consent before you allow AI reading or make a purchase, where the PDPA or other law requires it. If we learn that we hold a child’s data without the consent that is needed, we will delete it. Parents and guardians can contact us at nitiszaza27@gmail.com.
14Security
Requests to our server are sent over HTTPS. Data on your phone sits in the app’s own protected storage on iOS, and you can add the Face ID lock. No method is perfectly secure, so protect your phone with a passcode.
If a data breach is likely to put your rights and freedoms at risk, we will notify the PDPC within 72 hours of learning of it, and tell you directly where the law requires.
15Changes to this policy
We may update this policy. The date at the top shows the latest version. If a change affects what is sent to the AI or who processes it, we will ask for your permission again in the app.
16Contact
- Data controller: Coldter
- Email: nitiszaza27@gmail.com
- Support: https://vibemap.coldter.com/support
- This policy online: https://vibemap.coldter.com/privacy