Privacy in VibeEcho

This notice describes VibeEcho and its service, including the 2.1 private beta. Erman Akar is responsible for the personal data processed to operate the app. For privacy requests, use the contact details below.

What the app processes

• The public Instagram handles you request, public profile details, captions, photos, video links, comment samples and available engagement counts.
• Writing directions, optional notes and any photo you choose to include in a draft or review.
• A Firebase account identifier and, if you choose Sign in with Apple, an Apple-provided identity used to recover your wallet. VibeEcho requests no name or email scope and never requests your Instagram password.
• Apple-signed purchase identifiers, product, purchase/refund status, credit grants, completed-task debits and account ownership needed for delivery and recovery. Apple processes payment details; VibeEcho does not receive your card number.
• App attestation and basic operational request information, including IP address and user agent in hosting logs, to authenticate requests, prevent abuse and diagnose failures. Rate limits use a daily changing IP digest.
• Optional product analytics, if enabled in Account: feature usage, purchase events, basic app/device information and approximate region derived from a masked IP address through Firebase Analytics. Advertising storage, advertising data sharing and ad personalization are disabled. Analysis text, media and provider credentials are not included in these events.

Who receives data

Before the first live analysis, the app asks for permission and explains the following processing:

• Apify retrieves the public profile and post/comment sample for the account you request.
• OpenAI receives the necessary public evidence and your writing instructions for briefs, drafts, comparisons, comment reviews and photo reviews. For a 2.1 profile brief this includes selected public photos and sampled carousel slides automatically. An optional draft photo or selected review image is included when relevant.
• Google Gemini receives a selected short public video and associated context automatically for a 2.1 profile brief (up to its first 60 seconds, sampled at two frames per second), or when you request a separate video review.
• Google Firebase and Google Cloud provide authentication, attestation, secure result and wallet storage, hosting, and optional analytics.
• Apple provides sign-in, purchase verification and purchase/refund notifications.

Media previews connect to the original image/video host. Providers may process information outside your country under their applicable data-processing and international-transfer arrangements. Their retention and processing terms also apply: OpenAI, Gemini API, Firebase, Apify, and Apple. We do not sell personal data, show advertisements or use cross-app advertising tracking.

Why we process it

We process requested analyses, account recovery and purchases to provide the service you request. We ask for your consent to send content to AI providers and to enable optional analytics; you can withdraw consent in Account. Necessary security and limited operational records protect the service against fraud and abuse. Financial records may be retained where required by law.

Storage and retention

• Your device keeps saved briefs, drafts, reviews and local edits until you clear them or remove the app.
• Server copies of completed results are scheduled for deletion after 30 days. Automatic storage cleanup can take additional time. Wallet recovery returns a bounded set of recent finished results; export important work before changing devices.
• Shared public-profile samples expire after one hour; rate-limit records after one or two days. Automatic cleanup may lag expiry.
• Wallet and purchase records remain while your account is active. Minimal transaction records are retained after deletion to prevent duplicate purchase claims, handle refunds and meet applicable recordkeeping obligations.
• Operational logs are normally retained for 30 days. AI providers handle their own operational retention under their published terms.

Your controls and rights

Decline AI sharing to use the offline example and saved work. Withdraw future AI sharing or analytics consent in Account. Account → Manage my data lets you clear the local Library, remove associated server results/history while keeping credits, or delete an Apple-linked account and remaining credits after confirming your identity. Clearing the local Library alone does not delete the server copy. Public posts remain with their original publisher.

You may request access, correction, deletion, restriction or portability, or object to processing where applicable, by contacting legal@shopofluba.de. You may complain to a data protection supervisory authority, including the authority in your place of residence or the North Rhine-Westphalia authority in Germany. Withdrawing consent does not affect processing already carried out. Contact us if an earlier credit balance cannot be recovered; the app preserves its local migration backup.

Children and content

VibeEcho is intended for people aged 16 and over. Only submit content you have permission to use. Do not include confidential or sensitive personal information in notes or media. AI output can be incorrect and should be checked before sharing.