Privacy Policy

1. Information We Collect

We collect the following categories of personal information:

• Account information: email address, display name, and (if you choose Google sign-in) your Google account identifier and profile photo URL.
• Authentication credentials: hashed passwords and, if you enroll, biometric passkey public keys. We never see raw passwords or your biometric data — those stay on your device.
• Photos and images: selfies and portrait photographs you upload, and the AI-generated images produced from them.
• Prompt data: the theme, style, or text prompt you select for each generation.
• Purchase and credit data: Stripe payment identifiers, credit balance, and transaction history. We do not receive or store your full card number or CVC — that is handled by Stripe.
• Device and log data: IP address, browser or app version, operating system, and coarse timestamps for security, fraud prevention, and debugging.
• Content reports: if you use the "Report" button on a generated image, we record the reported image, reason, and your account ID so our moderators can review.

2. How We Use Your Information

• To provide the core service: generating AI images from your uploads.
• To operate your account, credit balance, and purchases.
• To secure the Service against abuse, fraud, and unauthorized access.
• To review reported content and enforce our Terms and content policies.
• To comply with legal, tax, and regulatory obligations.
• To communicate service-related notices (e.g. password resets, receipts).

We do not train third-party foundation models on your uploaded photos or generated images. Uploads are sent to our AI generation provider (see Subprocessors) only for the purpose of producing your requested image.

3. How We Share Your Information (Subprocessors)

We share personal data only with the service providers listed below, and only to the extent necessary to operate the Service:

• Lovable Cloud / Supabase — hosting, database, authentication, and encrypted file storage (US / EU regions).
• Fal.ai — AI image generation. Uploaded photos and prompts are transmitted to Fal.ai to render your output.
• Stripe — payment processing for credit purchases and subscriptions.
• Google Play Billing — where required, for purchases made inside the Android app.

We do not sell your personal information. We may disclose data if compelled by valid legal process, or to protect the safety of our users (for example, referring suspected child sexual abuse material to NCMEC as required by law).

4. Data Retention

• Uploaded photos: stored in your private library until you delete them, or until you delete your account.
• Generated images: same as above.
• Account and profile data: retained while your account is active. Deleted immediately when you delete your account (see Section 7).
• Payment and tax records: retained for up to 7 years to comply with financial regulations, even after account deletion.
• Security and abuse logs: retained for up to 90 days.
• Content reports and moderation records: retained for up to 2 years to support enforcement and appeals.

5. Security

We transmit all data over HTTPS/TLS. Uploaded photos and generated images are stored in a private storage bucket accessible only to your account under row-level security. Passwords are hashed using industry-standard algorithms. Payment card data is handled exclusively by Stripe. No system is perfectly secure, so we cannot guarantee absolute security, but we work to protect your data using reasonable technical and organizational measures.

6. Children's Privacy

VibeShift AI is not directed to children under 13 (or under 16 in the EEA/UK where applicable), and we do not knowingly collect personal information from children. If we learn that we have collected personal information from a child, we will delete it. Parents or guardians who believe their child has provided personal information may contact us at privacy@apexloopsystems.com.

7. Your Rights and Choices

Depending on your jurisdiction (including GDPR, UK GDPR, CCPA/CPRA, and similar laws), you have the right to:

• Access, correct, or export the personal data we hold about you.
• Delete your account and associated data — see our account deletion page for in-app and email options.
• Object to or restrict certain processing.
• Withdraw consent for optional processing (e.g. personalized ads) at any time.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, email us at privacy@apexloopsystems.com. We will respond within 30 days.

8. AI-Generated Content

Images produced by VibeShift AI are synthetic and generated by machine learning models. They are not photographs of real events. You are responsible for how you use, share, or publish the generated images. You must only upload photos of yourself or people who have given you explicit permission. You must not use the Service to create sexual content involving minors, non-consensual intimate imagery, deceptive impersonation, or any content that violates our Terms or applicable law. Violations may result in account termination and referral to authorities where required.

9. International Data Transfers

We are based in the United States and our subprocessors operate globally. Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on approved transfer mechanisms such as the EU Standard Contractual Clauses.

10. Cookies and Third-Party Advertising (Google Ads)

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced in-app or by email, and we will update the "Last updated" date above.

12. Contact Us