Privacy Notice

The data controller for personal data processed through Vibecoders.md and VibeCody is:

For questions regarding personal data protection, exercising statutory data rights, or requesting erasure, you can reach out directly via email or Telegram.

We adhere strictly to data minimization. We only process data necessary to deliver our educational content, community, and technical companion tools.

When you ask a question to VibeCody, your question is evaluated and processed through an external AI model provider (OpenAI):

• Zero Application-Side History: VibeCody does not save your questions or generated AI answers in our database, files, or application logs.
• Provider-Side Storage Setting (store: false): API calls specify that completions must not be retained on the provider platform for conversational continuation. Disabling storage is distinct from Zero Data Retention: Zero Data Retention is a separate OpenAI account-level control available to eligible API customers and is not assumed to be enabled for VibeCody.
• Provider Abuse Logs: Default OpenAI API processing may retain prompts and responses in secure abuse-monitoring logs for up to 30 days under standard data controls before deletion, subject to account-specific settings.
• Model Training: OpenAI states that data submitted via its API is not used to train or improve its models unless the account explicitly opts in.

Telegram is an independent platform and data controller operated by Telegram Group Inc. / Telegram FZ-LLC. When you interact with the Vibecoders community or VibeCody:

• Telegram manages your user profile, username, phone number, and cloud chat history under its own privacy policy and terms of service.
• Immediate Hard Deletion of State: Using the /delete_mecommand in VibeCody immediately and permanently deletes all identifiable learner records (such as bookmark positions, settings, and project state) from VibeCody's database.
• 35-Day Pseudonymous Tombstone: Following deletion, a pseudonymous HMAC cryptographic hash of the Telegram user ID is recorded in the learner_deletions table and retained for up to 35 days. It contains no message text, names, or plain IDs. Its narrow purpose is abuse prevention and ensuring that deletion cannot be weaponized to bypass cost controls or usage limits (working lawful basis: Legitimate Interests under Art. 6(1)(f) Law 195/2024). It expires and is purged automatically after 35 days.
• Scope Boundary: /delete_mecannot and does not delete Telegram's own cloud copies of your messages, OpenAI provider-side abuse logs, or infrastructure backup rotation.

In accordance with Article 5 and Article 6 of Law No. 195/2024 on personal data protection, we process data under the following legal bases:

Under Moldovan Law No. 195/2024 (transposing the European GDPR standard), you have specific statutory rights regarding your personal data:

• Right of Access (Art. 15): Request confirmation and details of personal data held about you.
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete data.
• Right to Erasure (Art. 17):Request deletion of your personal data ("right to be forgotten").
• Right to Restriction (Art. 18): Request restriction of processing under applicable statutory conditions.
• Right to Data Portability (Art. 20): Receive your personal data in a structured, machine-readable format.
• Right to Object (Art. 21): Object to processing based on legitimate interests.

If you have concerns about how your personal data is handled, you have the right to lodge a complaint with the national data protection supervisory authority of the Republic of Moldova: