Privacy Policy

1. Who we are

Vibrez is operated by VIBREZ UNIVERSE PTE. LTD., a Singapore company with Unique Entity Number 202614401D. The company is responsible for the personal data described in this policy.

Privacy questions and requests can be sent to privacy@vibrezhq.com.

2. Scope

This policy applies to the Vibrez iOS and Android applications, the Vibrez web application, the vibrezhq.dev website, and related support communications. It covers authentication, guest sessions, profiles, community spaces, live Moments, games, leaderboards, maps, and notifications.

Apple, Google, app stores, and other third parties may process data under their own privacy policies when you use their services.

3. Data we handle

Depending on how you use Vibrez, we handle the following categories:

• Guest and game data: an anonymous member identifier, guest status, game progress, and leaderboard scores. Some game progress is stored on your device and some is stored by Vibrez.
• Account and authentication data: email address, email-verification state, password hash, account and session identifiers, and sign-in-provider account information. Vibrez does not store your plaintext password.
• Sign-in provider data: Google or Apple account identifier, verified email, optional name, and provider credentials where the existing Apple browser sign-in flow issues them.
• Profile data: display name, biography, status, theme choices, avatar, the original image used to crop an avatar, and crop settings.
• Community activity: buildings you create or operate, Moment metadata, notifications, and contributions to live sessions.
• Live-session data: audio, video, chat, reactions, and shared route information processed while you host or join a live Moment. Vibrez does not store live audio, video, or chat in its application database after the session, although Moment metadata may remain.
• Map and route data: addresses or coordinates you submit for route calculation. These inputs may be sent to Google's routing service through the Vibrez API.
• Device and feature-flag data: device platform information and an opaque Vibrez member identifier supplied to PostHog for feature-flag evaluation when that integration is enabled. Vibrez does not use PostHog session replay or general app-lifecycle analytics.
• Technical and security data: network and request metadata, IP-derived abuse-prevention information, security logs, and error information needed to operate and protect the service.
• Communications: messages you send to support or privacy contacts and transactional emails such as verification and password-reset messages.

The Vibrez web application stores Vibrez session tokens in browser local storage. Native applications use secure device storage. The legal pages themselves contain no analytics, tracking scripts, or cookies.

4. How we use data

We use personal data to:

• provide accounts, guest sessions, profiles, communities, live interactions, games, maps, and notifications;
• authenticate users, link sign-in methods, secure accounts, and prevent abuse;
• process live media and real-time messages for the participants in a Moment;
• operate feature flags and staged product rollouts;
• respond to support, safety, and privacy requests;
• maintain service reliability and investigate technical problems; and
• comply with legal obligations and protect users, Vibrez, and others.

Where EEA or UK data-protection law applies, our legal bases may include performing our agreement with you, our legitimate interests in operating and securing Vibrez, compliance with law, and consent where required for optional device access or processing. A camera, microphone, or photo permission granted through your device is a technical permission and is not treated by itself as consent for every purpose under privacy law.

5. Google account data

If you choose Google sign-in, Vibrez receives Google's stable account identifier, your verified email address, and an optional profile name. We use this information only to authenticate you, link the Google identity to your Vibrez account, and seed an empty display name when available.

6. Sharing and service providers

We share data only as needed to operate Vibrez, comply with law, or protect the service. Providers include:

• Google and Apple for account authentication;
• Google for map display and route calculation;
• LiveKit for real-time media and data transport;
• PostHog for native feature-flag evaluation when enabled;
• Brevo for transactional email;
• hosting, database, cache, object-storage, deployment, and operational service providers; and
• Apple App Store and Google Play, which process distribution data independently.

We may disclose information when required by law, to respond to valid legal process, to protect people or the service, or as part of a corporate transaction subject to appropriate confidentiality and legal safeguards. We do not sell personal data and do not currently serve targeted advertising.

7. What other members can see

Vibrez is social. Depending on the feature, other members may see your display name, avatar, biography, status, building ownership, leaderboard entry, live video, audio, chat, reactions, or route contributions. Do not share information that you do not want the relevant audience to receive.

8. International processing

VIBREZ UNIVERSE PTE. LTD. is based in Singapore. Vibrez and its service providers may process data in Singapore and other countries where they operate. Data-protection rules may differ from those in your country. We preserve rights and safeguards that applicable law requires and do not use this policy to remove mandatory local rights.

9. Retention and deletion

Account, profile, score, notification, and content records are generally retained while your account exists or while they are needed to operate and protect Vibrez. Short-lived OAuth state, handoff codes, and session credentials expire automatically.

Live media and chat are not retained in the Vibrez application database after a live session, but Moment metadata may remain. Replaced avatar objects are removed from active storage on a best-effort basis, while downloaded or cached copies may remain temporarily. Operational and provider logs may remain for limited security, troubleshooting, or legal purposes.

To request access, correction, or account and data deletion, email privacy@vibrezhq.com. Deletion is handled manually, and we may ask you to verify control of the account email. Shared content, deidentified records, and records needed for safety, dispute resolution, or legal compliance may be retained where permitted by law.

10. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, restrict, or receive personal data; object to certain processing; withdraw consent; and complain to a privacy regulator. Singapore law also provides rights concerning access, correction, and withdrawal of consent in applicable circumstances.

Send a request to privacy@vibrezhq.com. We will verify and respond to requests as required by applicable law. Withdrawing consent does not affect processing already carried out lawfully and may prevent an optional feature from working.

11. Security

We use technical and organizational safeguards intended to protect personal data, including hashed passwords, restricted service credentials, encrypted network transport, short-lived authorization values, and access controls. No system is perfectly secure, so we cannot guarantee that unauthorized access or loss will never occur.

12. Age requirement

Vibrez is for adults aged 18 and over. We do not knowingly permit anyone under 18 to create an account or use the service. If you are a parent or guardian and believe a minor has supplied personal data, contact privacy@vibrezhq.com so we can investigate and take appropriate action.

13. Changes and contact

We may update this policy as Vibrez or applicable requirements change. We will publish the revised policy at this address and update the date above. Material changes may also be communicated through Vibrez or another appropriate channel.

Questions and privacy requests can be sent to privacy@vibrezhq.com. You can also read our Terms of Service.