We don't profile you.

This site's analytics

One thing, and it stores nothing on your device - no cookie, no local storage, nothing to consent to:

• A first-party beacon to our own server - us, not a third party - fired once when you arrive from somewhere else. It records the page you landed on, the channel you came from (search, social, an AI tool like ChatGPT, or direct), any utm_* tags, and a coarse country and device class. No identifier, no account, nothing that follows you between visits.

Being straight about IP addresses, because most policies fudge this: your IP reaches our server, because it reaches every server you connect to - that is how the internet works. We use it to derive the country and then drop it. It is never written to the database and never linked to anything else.

What we do keep lives in a Cloudflare D1 database we run, and is deleted after 180 days. Any tracker-blocker stops it, and the site works fine without it. No Google/Facebook/LinkedIn/Hotjar scripts, no ads, no forms, no signup; fonts are self-hosted.

Every field, spelled out

Rather than describe this in the abstract, here is the actual list. The beacon sends exactly five values, and nothing else:

• Referrer - where you came from, if anywhere. The browser sends the full address, but our server keeps only the site name from it (reddit.com, chatgpt.com) and throws the rest away, so the specific page or search that sent you is never written down. If you came from somewhere on this site it is discarded entirely.
• Path - which page of ours you landed on. The path only, never the query string.
• utm_source, utm_medium, utm_campaign - campaign tags, and only if a link you followed had them.

Two more values are worked out at our server from the request itself and kept: a coarse country (country level, never a city or precise location) and a device class (roughly "phone" or "desktop"). Three things arrive with any web request, get used for exactly that, and are then dropped rather than written down: your IP address, your User-Agent (the string your browser sends naming itself and your operating system), and the timestamp.

And the other direction, the things people usually assume: no name, no email, no account, no cookie, no device or advertising ID, no fingerprint, no precise location, no scroll or mouse recording, no heatmaps, no session replay, no cross-site tracking, no data broker, no ad network, no mailing list, and nothing sold or shared. There is no login on this site at all.

One exception, so the sentence above stays honest. The documentation sidebar remembers which page you were last on, in your browser's own session storage, for one reason: to slide the highlight from that entry to the new one instead of making it jump. It is a single address, it never leaves your browser, it is not analytics, and your browser throws it away when you close the tab. Nothing else on this site writes to your device.

Third parties, and what they see

We use as few as we can get away with, but "few" is not "none", and the two below see things we do not control:

• Cloudflare hosts this site, our hub, and our database, which makes them a processor acting on our instructions. Like any host they log the connection metadata every web request carries: IP address, User-Agent (so, browser and operating system), the URL and method, response status and size, timestamp, TLS version, and your network provider and approximate region. Their edge also runs bot and abuse protection, and browsers may report failed connections to them automatically. We did not switch that on and cannot switch it off; it is how the network works. Their handling is covered by Cloudflare's privacy policy.
• GitHub (owned by Microsoft) sees you on our home page only. It shows a live star count, and your browser fetches that number from GitHub directly, which means your IP address and User-Agent reach them. No other page does this, and clicking any GitHub link obviously takes you to them too. Their handling is covered by the GitHub privacy statement.

That is the complete list for this website. Installing the software brings its own, and they are all ones you chose: your package manager or registry sees your IP and which package you asked for, and the model providers behind your coding CLIs see whatever you send them. More on that below.

Where our responsibility starts and stops, since it is not the same for all of them. Cloudflare handles data on our instructions, so we stay accountable for that and are not trying to sign it away. Everyone else on this page - GitHub, your registry, your model providers, whoever wrote a flow you installed, and any site you reach by following a link from us - decides for themselves what they collect and what they do with it. We don't direct them, we can't audit them, and their own policies govern. If you need to exercise a right against one of them, it has to go to them.

None of that is us dodging the data protection duties we do have, which are set out in full further down. It is the practical limit of what any small project can promise about infrastructure it does not run. The liability side of the same point lives in our Terms.

The flow hub

Vibestrate has a community flow hub - a place to find and install shared "flows" (run recipes). It's the one part of the software that talks to a server we run, and it only does so when you ask it to. When you search the hub or install a flow, the software calls our hub at vibestrate.com/api/hub. That request:

• Exposes your IP and User-Agent to the hub and to Cloudflare, like any web request. We use it only to return the flow you asked for.
• Carries what you searched for or the flow you chose to install - never your code, prompts, or other projects.
• Needs no cookie and no account to browse or install.

This never happens in the background. Publishing a flow (where enabled) is a separate action: it needs you to sign in, and your publisher handle and the flow you publish become public to everyone, permanently indexable, and copyable by anyone. Read what you are about to publish first - a flow is a recipe you wrote, so it can carry your prompts, internal project names, or anything else you typed into it. Nothing else you do is ever published, and we will take down anything you published on request. Flows you install are third-party content - inspect them before running (see our Terms).

The AI part

Vibestrate's whole job is running AI models over your code, so it is worth being exact about who sees what. Vibestrate is not a model and does not host one. It drives the coding CLIs already installed on your machine - claude, codex, gemini, ollama and friends - and each of those talks to its own provider under its own terms and privacy policy, exactly as it did before you installed us.

• Your prompts and code go to the provider you chose, not to us. Pick a local model like ollama and they go nowhere at all.
• We never train on anything. We have no model to train and no copy of your work to train it on. Whether your provider trains on your prompts is between you and them - check their policy.
• Everything a model writes is machine-generated, including plans, reviews, and the advice Consult gives you. It can be confidently wrong. Vibestrate is built to make models check each other and then stop and ask you, but the last read is always yours.

Vibestrate is a developer tool, not an assistant for personal, medical, legal, or crisis matters, and it is not built or tested for that. If you are struggling, please talk to a person - in the US and Canada call or text 988, in the UK and Ireland call 116 123, and elsewhere findahelpline.com lists local services.

Your data and your rights

Everything we keep is aggregate and not tied to your identity, so - aside from anything you choose to publish to the hub under a handle - there's no profile of you for us to access, export, or delete. We keep this little on purpose.

That is not a way of dodging the question, so here is the full list anyway. Where the GDPR, UK GDPR, Israel's Privacy Protection Law, the CCPA or similar apply to you, you can ask us to show you what we hold, correct it, delete it, hand it over in a portable form, restrict what we do with it, or object to it entirely. We have never sold or shared personal data for advertising and never will, so there is nothing to opt out of. Exercising any of this costs nothing and we will not treat you differently for it.

The honest caveat: for the site beacon there is usually nothing to find, because we hold no identifier that could tie a row back to you. Where that is the case we will say so plainly rather than invent a record. Anything you published to the hub under a handle we can and will remove on request.

To raise any of this, open a GitHub Discussion or email [email protected]. We aim to reply within 30 days, and we would much rather you came to us first, because it is one person reading it and most things are a quick fix. For completeness, the law also gives you the right to take a complaint to your data protection authority - your national supervisory authority in the EU or UK, and in Israel the Privacy Protection Authority.

Hosting and changes

Cloudflare hosts this site and the services we run, and may process the little data above on infrastructure outside your country, including the United States. We are based in Israel, which the European Commission recognises as providing adequate protection for personal data, so data reaching us from the EEA or the UK needs no extra transfer paperwork. Cloudflare's own transfers run on their standard contractual clauses.

We keep the site beacon for 180 days and then delete it. Everything else here is either not stored at all or, in the case of a flow you chose to publish, kept until you ask us to take it down.

We may update this page; with no accounts, there is nobody to email, so the only notice is here with a new date at the bottom, and the project's GitHub, where every change to this page is in the history. This site and the software are meant for developers and are not directed to children. We don't knowingly collect anything from anyone under 16, and there is no signup here that would let us.