Privacy Policy

1. Who We Are

CheckMyVibeCode ("we", "us", "our") is a community platform for showcasing AI-generated software projects, accessible at checkmyvibecode.com. This Privacy Policy explains how we collect, use, and protect your personal data.

The controller is Mihailo Lalic, Hauptstraße 53, 52399 Merzenich, Germany. For privacy-related questions, contact support@checkmyvibecode.com.

2. What Data We Collect

Account data — When you sign up or log in via Google or GitHub OAuth, we receive your email address, name, and profile picture from the respective provider. We store this data to identify your account.

User-generated content — Projects you submit, comments you post, and upvotes you cast are stored in our database and visible to other users.

Optional measurement — Only with your separate permission for the relevant purpose, Google Analytics processes usage events, online identifiers and device/network information, or X processes advertising measurement data. These data may be personal data; they are not described as anonymous.

Technical data — Standard server logs (IP address, browser type, referrer) may be recorded automatically. These are used for security and debugging purposes only.

3. How We Use Your Data

• To provide and maintain the platform (authentication, displaying your projects and profile)
• To allow other users to interact with your content (upvotes, comments)
• To analyze how the platform is used and improve it (analytics, only with consent)
• To protect the platform from abuse and ensure security

Account, content and payment processing needed to provide the service is based on Art. 6(1)(b) GDPR. Security and abuse prevention rely on Art. 6(1)(f) GDPR, with the legitimate interest of protecting the service and its users. Statutory record keeping relies on Art. 6(1)(c) GDPR. Optional analytics, advertising measurement and newsletter marketing rely on your consent under Art. 6(1)(a) GDPR; access to non-essential information on your device additionally requires consent under § 25(1) TDDDG. Necessary session storage is used under § 25(2) TDDDG. We do not make decisions producing legal or similarly significant effects solely through automated processing.

4. Third-Party Services

Supabase — Provides the database, authentication and uploaded-file storage. Account information and submitted content are processed there. Supabase Privacy Policy

Google Analytics 4 — Loaded only if you enable analytics. Advertising personalization and Google Signals are disabled in our configuration. Google Privacy Policy.

X — Loaded only if you enable advertising measurement, to measure advertising performance. X may associate browser identifiers with its own data. X Privacy Policy.

Replit — Hosts the web application and processes network requests and operational logs. Replit Privacy Policy.

Stripe — Processes payments, subscriptions and fraud prevention. Checkout receives your email address, account identifier, selected product and, for boosts, the project identifier. Card details are entered at Stripe, not stored by this application. Stripe Privacy Policy.

Resend — Delivers service, payment and optional notification emails; email addresses and message contents are transmitted for delivery. Resend Privacy Policy.

International processing — These providers may process personal data outside the EEA, including in the United States. The applicable transfer safeguards and contractual arrangements depend on the provider and service configuration. Contact us for information on the safeguards applicable to your data; the use of a provider does not by itself guarantee EU-only processing.

Google & GitHub OAuth — When you log in via Google or GitHub, their respective privacy policies apply to the authentication process. We only receive and store the data they share with us (email, name, avatar).

5. Cookies

We use the following cookies and local storage:

• Authentication session — Stored in localStorage via Supabase to keep you logged in. Essential for the platform to work.
• Theme preference — We save your dark/light mode choice in localStorage.
• Cookie consent — Analytics and advertising preferences, version and choice time are stored locally for up to 180 days, then requested again. If saving fails, optional tracking is stopped and we attempt to discard the previous consent. An essential first-party cookie (cmvc_consent_denied, value 1, up to 180 days) may preserve the refusal; it contains no identifier and is removed after a successfully saved new choice. Open tabs are notified where supported. If all storage is blocked, we cannot guarantee persistence and ask you to clear website data. Previously saved consent is not used while its storage cannot be updated.
• Google Analytics cookies — Only set if you accept analytics cookies. Used to measure traffic and usage.

The same choice is offered in every country. Google Fonts and the Supabase browser library are served locally; no external IP-geolocation service is used to choose whether to show the banner. External user images and authentication/storage services may still receive network requests necessary to display content or provide the requested service.

Open cookie settings to change your choices at any time. Withdrawal stops future optional tracking and reloads the page to remove loaded tracking code. We remove accessible first-party measurement cookies; third-party cookies and data already held by providers cannot be deleted by this site. Withdrawal does not affect the lawfulness of processing before withdrawal.

6. Your Rights (GDPR)

If you are located in the EU/EEA, you have the following rights regarding your personal data:

• Access — Request a copy of the personal data we hold about you
• Rectification — Request correction of inaccurate data
• Erasure — Request deletion of your account and associated data
• Portability — Request your data in a machine-readable format
• Objection — Object to processing of your data for analytics purposes
• Withdraw consent — Withdraw optional measurement consent using Cookie settings in the footer, and unsubscribe from optional emails using their unsubscribe link.

To exercise these rights, contact support@checkmyvibecode.com. We normally respond within one month; any legally permitted extension will be explained. You also have the right to restriction of processing and to complain to a supervisory authority, including the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW).

7. Data Retention

Public Pro cancellation declarations are stored with the submitted identification and contract details, requested termination date and time of receipt. We use these records to handle and evidence contract termination and related legal obligations (Art. 6(1)(b) and (c) GDPR). Confirmation emails are sent via Resend. Records are accessible only to the operator through the protected administration area and are retained as necessary for processing, legal claims and applicable statutory retention obligations; they are not used for marketing. You can submit a declaration without signing in via Verträge hier kündigen. Receipt of a declaration does not by itself establish the submitter's entitlement to terminate someone else's contract.

Account data and submitted content are retained while needed to provide your account and published contributions. On a justified deletion request, data no longer required are deleted, subject to statutory retention duties and the protection of legal claims. Payment/accounting records are retained for the applicable statutory period. A minimal suppression entry is retained to respect an email opt-out. Provider logs, backups and analytics records follow the applicable provider retention configuration; contact us for details. Cookie choices expire after 180 days.

8. Changes to This Policy

We may update this notice when processing changes. Continued use does not constitute consent to new optional processing; where required, we ask for new consent.

9. Contact

Questions about this Privacy Policy? Email us at support@checkmyvibecode.com