Privacy Policy

1. Who we are

Vibrez is operated by VIBREZ UNIVERSE PTE. LTD., a Singapore company with Unique Entity Number 202614401D. The company is responsible for the personal data described in this policy.

Privacy questions and requests can be sent to privacy@app.vibrez.com.

2. Scope

This policy applies to the Vibrez iOS and Android applications, the Vibrez web application, the app.vibrez.com website and the vibrezhq.dev website it replaces — both serve the same Vibrez service and are covered identically — and related support communications. It covers authentication, guest sessions, profiles, community spaces, live Moments, games, leaderboards, maps, and notifications.

Apple, Google, app stores, and other third parties may process data under their own privacy policies when you use their services.

3. Data we handle

Depending on how you use Vibrez, we handle the following categories:

• Guest and game data: an anonymous member identifier, guest status, game progress, and leaderboard scores. Some game progress is stored on your device and some is stored by Vibrez.
• Account and authentication data: email address, email-verification state, password hash, account and session identifiers, and sign-in-provider account information. Vibrez does not store your plaintext password.
• Sign-in provider data: Google or Apple account identifier, verified email, optional name, and Apple provider credentials needed to disconnect Apple access if you delete your account.
• Profile data: display name, biography, status, theme choices, avatar, the original image used to crop an avatar, and crop settings.
• Community activity: buildings you create or operate, Moment metadata, notifications, and contributions to live sessions.
• Live-session data: audio, video, chat, reactions, and shared route information processed while you host or join a live Moment. Vibrez does not store live audio, video, or chat in its application database after the session, although Moment metadata may remain.
• Map and route data: addresses or coordinates you submit for route calculation. These inputs may be sent to Google's routing service through the Vibrez API.
• Precise device location: if you grant permission in Roadtrip, your current position is used to calculate and periodically refresh guidance to the selected checkpoint. It is processed for the route request and not retained by Vibrez as location history.
• Device and feature-flag data: device platform information and an opaque Vibrez member identifier supplied to PostHog for feature-flag evaluation when that integration is enabled. Vibrez also receives an opaque installation identifier, the device's language region, app version, app-open timestamps, foreground duration and coarse lifecycle heartbeats to show aggregate usage in the administrator dashboard. This is not precise location, account identity, session replay, or message content.
• Product analytics data: records of how Vibrez is used, sent to PostHog. Each record carries your numeric Vibrez member identifier, the same one used for feature flags, or a random identifier created on your device before you sign in. The apps record the screens you view; when the app is installed, updated, opened, or moved to the background; and actions in the account flow, links, notifications and shares, Moments, Roadtrip lobbies, live publishing and playback, direct messages, posts, stories, comments, likes, and follows. The Vibrez API records account creation, email verification, and sign-in with the method used (email, Google, or Apple); Moments created and ended, with their type, identifier, end reason, and duration; Roadtrip teams joined and left; starting and stopping live publishing in a Moment; broadcasts going live or becoming unavailable; a viewer joining a broadcast, at most once per member for each Moment every 10 minutes; and real-time media access being granted, recording only the role. It also sends counts of push-notification batches, rate-limited and load-shed requests, and content that passed without an automated moderation check because the check was unavailable. Records hold counts and metadata, for example a Moment type, the identifier of a Building, Moment, or post, a duration, or an error code, plus device and app details such as platform, device model, operating-system version, app version, language, and time zone. PostHog also keeps a profile under your identifier with facts such as your app language, when your account was created, how you signed up, and the app versions and platforms you use. Records do not include your email address, handle, display name, password, or tokens, or the content of your messages, posts, stories, or comments. Session replay and automatic capture of taps and clicks are off. For records of your own actions, PostHog receives the IP address of your device or request and uses it to estimate an approximate location at country, region, or city level; other records from the Vibrez API are sent with that lookup turned off.
• Technical and security data: network and request metadata, IP-derived abuse-prevention information, security logs, and error information needed to operate and protect the service.
• Communications: messages you send to support or privacy contacts and transactional emails such as verification and password-reset messages.

The Vibrez web application stores Vibrez session tokens in browser local storage, and PostHog keeps its identifier there and in a first-party cookie. Native applications use secure device storage. The legal pages themselves contain no analytics, tracking scripts, or cookies.

4. How we use data

We use personal data to:

• provide accounts, guest sessions, profiles, communities, live interactions, games, maps, and notifications;
• authenticate users, link sign-in methods, secure accounts, and prevent abuse;
• process live media and real-time messages for the participants in a Moment;
• operate feature flags and staged product rollouts;
• understand how Vibrez is used, measure reliability and streaming quality, and improve features, including with aggregate dashboards of active members, retention, regions, and usage by app version;
• respond to support, safety, and privacy requests;
• maintain service reliability and investigate technical problems; and
• comply with legal obligations and protect users, Vibrez, and others.

Where EEA or UK data-protection law applies, our legal bases may include performing our agreement with you, our legitimate interests in operating and securing Vibrez, compliance with law, and consent where required for optional device access or processing. A camera, microphone, or photo permission granted through your device is a technical permission and is not treated by itself as consent for every purpose under privacy law.

5. Google account data

If you choose Google sign-in, Vibrez receives Google's stable account identifier, your verified email address, and an optional profile name. We use this information only to authenticate you, link the Google identity to your Vibrez account, and seed an empty display name when available.

6. Sharing and service providers

We share data only as needed to operate Vibrez, comply with law, or protect the service. Providers include:

• Google and Apple for account authentication;
• Google for map display and route calculation;
• LiveKit for real-time media and data transport;
• PostHog, on PostHog's EU cloud, for feature flags and product analytics;
• Brevo for transactional email;
• hosting, database, cache, object-storage, deployment, and operational service providers; and
• Apple App Store and Google Play, which process distribution data independently.

We may disclose information when required by law, to respond to valid legal process, to protect people or the service, or as part of a corporate transaction subject to appropriate confidentiality and legal safeguards. We do not sell personal data and do not currently serve targeted advertising.

7. What other members can see

Vibrez is social. Depending on the feature, other members may see your display name, avatar, biography, status, building ownership, leaderboard entry, live video, audio, chat, reactions, or route contributions. Do not share information that you do not want the relevant audience to receive.

8. International processing

VIBREZ UNIVERSE PTE. LTD. is based in Singapore. Vibrez and its service providers may process data in Singapore and other countries where they operate. Data-protection rules may differ from those in your country. We preserve rights and safeguards that applicable law requires and do not use this policy to remove mandatory local rights.

9. Retention and deletion

Account, profile, score, notification, and content records are generally retained while your account exists or while they are needed to operate and protect Vibrez. Short-lived OAuth state, handoff codes, and session credentials expire automatically.

Live media and chat are not retained in the Vibrez application database after a live session, but Moment metadata may remain. Replaced avatar objects are removed from active storage on a best-effort basis, while downloaded or cached copies may remain temporarily. Operational and provider logs may remain for limited security, troubleshooting, or legal purposes. Product analytics records are kept in PostHog, and deleting your account does not remove them automatically.

To request access, correction, or account and data deletion, including your product analytics records, email privacy@app.vibrez.com. Deletion is handled manually, and we may ask you to verify control of the account email. Shared content, deidentified records, and records needed for safety, dispute resolution, or legal compliance may be retained where permitted by law.

10. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, restrict, or receive personal data; object to certain processing; withdraw consent; and complain to a privacy regulator. Singapore law also provides rights concerning access, correction, and withdrawal of consent in applicable circumstances.

Send a request to privacy@app.vibrez.com. We will verify and respond to requests as required by applicable law. Withdrawing consent does not affect processing already carried out lawfully and may prevent an optional feature from working.

11. Security

We use technical and organizational safeguards intended to protect personal data, including hashed passwords, restricted service credentials, encrypted network transport, short-lived authorization values, and access controls. No system is perfectly secure, so we cannot guarantee that unauthorized access or loss will never occur.

12. Age requirement

Vibrez is for adults aged 18 and over. We do not knowingly permit anyone under 18 to create an account or use the service. If you are a parent or guardian and believe a minor has supplied personal data, contact privacy@app.vibrez.com so we can investigate and take appropriate action.

13. Changes and contact

We may update this policy as Vibrez or applicable requirements change. We will publish the revised policy at this address and update the date above. Material changes may also be communicated through Vibrez or another appropriate channel.

Questions and privacy requests can be sent to privacy@app.vibrez.com. You can also read our Terms of Service.