Privacy Policy

1. The short version

VibeSmith is non-custodial. We never receive your private keys or take custody of your funds. We collect the minimum needed to run the product, we do not sell your data, and we do not use advertising cookies.

2. Scope

This policy covers the VibeSmith website, the Telegram and Discord bots, and the mini app. It explains what we collect, why, how long we keep it, and the choices you have. It does not cover third-party services you reach through VibeSmith, which have their own policies.

3. What we collect

Wallet address: when you connect a wallet, your public address is used to authenticate you and to tie features like your watchlist, alerts, raids, and profile to your account. We never receive your private keys or seed phrase.

Activity you create: tokens you forge, raids you start or join, coins you watch, alerts you set, and reports you submit.

Bot identity: if you use the Telegram or Discord bot or the mini app, your platform user id may be linked to your wallet so notifications, roles, and the mini app work.

Technical and error data: basic request logs, performance metrics, and error reports (including a short error session recording when something crashes) collected to keep the Service reliable and secure.

4. How we use your data

We use the data above to operate core features, authenticate sessions, enforce free-tier limits and prevent abuse, send the notifications you opt into, diagnose and fix errors, and keep the Service secure. We do not use it to build advertising profiles or to sell to third parties.

5. Legal bases (EEA and UK users)

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (to provide features you request), our legitimate interests (to secure the Service, prevent abuse, and fix errors), and your consent (for non-essential telemetry, which you control through the cookie banner). You can withdraw consent at any time without affecting prior processing.

6. Cookies and local storage

We use a small set of browser storage items, not advertising cookies. Strictly necessary items keep you signed in and your wallet connected; a functional item saves your in-progress forge draft; and optional error and performance telemetry helps us keep the Service reliable. Full detail, and how to control the optional telemetry, is in our Cookie Policy.

7. What stays on your device

A short-lived session token (vs_jwt), your wallet connection state, and your in-progress forge draft (vs_forge_draft) are stored in your browser's local storage so you stay signed in and do not lose your work on refresh. You can clear these at any time by clearing site data in your browser.

8. What we never do

We never ask for or store your seed phrase or private keys. We never move funds on your behalf. We do not sell or rent your personal data to advertisers, and we do not run third-party ad tracking.

9. Service providers

We use infrastructure partners to operate VibeSmith, including database and authentication hosting (Supabase), web hosting (Vercel), error and performance monitoring (Sentry), IPFS pinning (Pinata), and Solana RPC and data providers (such as Helius). They process data only to provide their service to us, under their own security and privacy commitments.

10. International transfers

Our providers may process data in countries other than yours, including the United States. Where required, transfers are covered by appropriate safeguards such as standard contractual clauses. By using the Service you understand your data may be processed in those locations.

11. Data retention

We keep account and activity data for as long as your account is active and as needed to provide the Service. Error and performance telemetry is kept for a limited period and then deleted or aggregated. When you ask us to delete your data, we remove it from our systems within a reasonable period, except where we must retain it for legal or security reasons. On-chain data cannot be deleted (see below).

12. Security

We use signed sessions, server-side authorisation checks, rate limiting, and reputable hosting to protect the Service. No system is perfectly secure, so we cannot guarantee absolute security, but we work to protect your data and to respond quickly if an issue arises.

13. On-chain data is public

Transactions you sign (minting, trading, raids) are recorded on the Solana blockchain, which is public and permanent. VibeSmith cannot edit or remove on-chain data, and a deletion request does not affect anything already recorded on the chain.

14. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent. You can disconnect your wallet, clear your watchlist, manage alerts, and unlink the bots yourself. For an export or deletion request, contact us at the address below and we will verify and action it.

15. Children's privacy

VibeSmith is not directed to anyone under 18, and we do not knowingly collect data from children. If you believe a minor has provided us data, contact us and we will delete it.

16. Changes to this policy

We may update this policy as the product evolves. When we make material changes we will update the date above. Continued use after an update means you accept the revised policy.

17. Contact

For privacy questions, or to request access, export, or deletion of your data, email hello@vibesmith.xyz. See also our Cookie Policy and Terms of Use.