Privacy Policy

1. Who we are

VibeAd (www.vibead.ai) is operated by Gaurav Wasan, sole trader, Australia (“VibeAd”, “we”, “us”).

Privacy contact: admin@vibead.ai

This policy explains what information VibeAd collects, why, and the choices you have. It covers the VibeAd command-line launcher (the “CLI”), the website www.vibead.ai and the VibeAd backend services.

2. What VibeAd is, in one paragraph

VibeAd is for everyone who uses AI agents, and for advertisers of every kind. The CLI is a local launcher for terminal AI agents such as Claude Code, Codex and OpenCode. If you turn ads on (with vibead enable, which asks before changing anything), it shows one short sponsored line in the agent’s status line or notification area while the agent works. Every sponsored line is labelled [Ad]. VibeAd does not change what you send to the AI agent or what the agent sends back.

3. What we never collect

VibeAd does not collect:

• your prompts, or anything you type into the AI agent;
• your code, files or project contents;
• the AI agent’s responses or your conversation content.

We do not need this information to show ads, and the CLI is not designed to send it to us.

4. What we collect without an account

Install key. When you set VibeAd up, the CLI creates a random install key and keeps it on your device. Our servers store only a one-way hash of that key, never the key itself. It does not contain your name or email, but because it identifies one install over time, we treat it, and anything linked to it, as personal information.

Impression and click events. When a sponsored line is shown, the CLI reports it and we record:

• a pseudonymous install hash (derived from your install, not the key itself);
• the ad id;
• the name of the AI agent being used (for example, “Claude Code”);
• the placement (where the line appeared);
• a timestamp.

When you click a sponsored line, we record the click against the ad, the AI agent and the time; that click record does not include your install key, install hash or IP address. If the click is billed and the link was shown to your install, we also add it to your install’s running total (see section 11) and add your install hash to that day’s list of installs for the ad, which is deleted automatically after about 90 days. To spot repeat clicks, we briefly keep counters keyed by hashes of your install and your IP address, which expire about a day after the click. You can stop the CLI reporting impressions with vibead telemetry off.

IP address and browser details. Like any online service, our servers see your IP address when the CLI or your browser contacts them. We treat it as personal information. We do not store raw IP addresses: they are left out of our request logs and our records. Our hosting provider’s firewall uses them briefly to block floods of requests. To spot repeat clicks, the click service keeps a salted, shortened hash of your IP address that changes every day; these entries are set to expire about a day after the click and are then deleted automatically. When you click, we also check your browser’s user agent to spot bots, without storing it.

We handle the install key, the install hash, the events linked to them and IP addresses as personal information under the Privacy Act 1988 (Cth) and the GDPR and UK GDPR, in line with this policy.

5. What we collect if you create an account

Accounts are optional; you can use VibeAd without one. If you create one, you sign in with GitHub. Email-code and Google sign-in are not available yet. Sign-in is run on Amazon Cognito. With an account, we store:

• your email address;
• a display name (you choose it; it does not need to be your real name);
• your country;
• whether you have opted in to marketing emails (a separate choice, off unless you turn it on). We do not send marketing emails today.

We do not ask for your postal address, phone number or real name.

If you sign in with GitHub, we ask GitHub for your account’s verified primary email address. Your account keeps only that email address and GitHub’s numeric identifier. While the sign-in is completing, our sign-in service also holds your GitHub username and profile name, together with that email address and identifier, in short-lived sign-in records. Those records can be used only within 5 minutes of being created and are then deleted automatically, normally within a few days; backup copies are purged within 30 days. We do not store your GitHub picture, and the access GitHub gives us is revoked as soon as you are signed in. If your GitHub account has no verified primary email address, the sign-in is refused. If you already have an account with the same verified email address, the GitHub sign-in is linked to it, so you keep one account.

We send you no email today: you sign in with GitHub, and email-code sign-in is not available yet. If you send us the sponsor form (below), we send one email with its details, through Amazon Web Services email services, to our own inbox (admin@vibead.ai), not to you or anyone else. It includes your account’s verified email address, in the message and as its reply-to address, so that we can answer you from that inbox.

Sponsor accounts. The same account can be a user account, a sponsor account or both. If you sign in to become a sponsor, we record the sponsor role on your account and set up a sponsor record for it, owned by your account, with its status (for example, pending review) and the date it was created. If you then send us the short sponsor form, we store what you enter: your company or brand name, its website, a budget range if you choose one, and your message, with the time you sent it. The details are linked to your account (and so to its email address), but the email address itself is not stored with them. We use this only to contact you about advertising with VibeAd and to set up your ads. We also email these details to admin@vibead.ai, our own inbox, so we can reply within 1 business day. A sponsor account’s details and balance are shown only to that sponsor, and its reports only through its private report link (see section 8); one sponsor never sees another’s.

6. Payment details (not collected yet)

Earnings tracking and payouts open soon.

Until then, we do not collect bank, tax or other payment details. When that launches, the payment provider we use will collect the details it needs, such as your real name, bank details and tax details. We will update this policy before it launches, so you can see what is collected and by whom before you sign up.

7. Why we use your information

We use the information above to:

• show sponsored lines;
• count impressions and clicks, and show you your tracked views;
• detect and exclude repeat clicks and bot clicks (these are not billed to advertisers);
• protect the service from abuse, fraud and attacks;
• give advertisers reports about their ads (see section 8);
• run your account, if you have one;
• handle the sponsor form: store it, email its details to our own inbox, reply to brands that ask to sponsor VibeAd, and set up their ads;
• meet our legal obligations.

For users in the EU and UK (GDPR and UK GDPR): our legal bases are:

• legitimate interests for showing sponsored lines and measuring them (counting impressions and clicks, excluding invalid clicks, advertiser reports), and for security and fraud prevention. Ads are opt-in, you can turn them off at any time, and we never use your prompts, code or conversations;
• performing our agreement with you for running your account, and taking the steps you ask for before an advertising agreement when you send us the sponsor form;
• legal obligations where the law requires us to keep or disclose information.

You can object to processing based on legitimate interests by contacting us, or simply by turning ads off with vibead disable.

8. What advertisers receive

Advertisers receive reports about their own ads only: totals of impressions and clicks (for example by day and by AI agent), an estimate of how many installs saw an ad, and an export listing each impression or click with its time, ad, type, AI agent and whether it was billed. These reports never include your install key, install hash, IP address, email, account details or any of your content.

9. Who else we share information with

We do not sell your personal information. We share it only:

• with Amazon Web Services, which hosts and runs VibeAd (including CloudFront, AWS WAF, API Gateway, Lambda, DynamoDB, Cognito and SES), under its contractual terms;
• with GitHub, to the extent needed when you choose to sign in with GitHub;
• with our email hosting provider, which hosts the admin@vibead.ai inbox, when you send us the sponsor form or email us;
• if required by law, or to protect our rights, users or the public;
• with a buyer or successor if VibeAd is sold or restructured, subject to this policy.

10. Where your information is stored

We store VibeAd data in AWS’s Sydney region, in Australia. Requests reach us through AWS CloudFront’s global network, and the firewall in front of it runs globally, so information in transit, such as your IP address, may be processed briefly outside Australia. If you sign in with GitHub, GitHub handles its part of that sign-in under its own terms. Where personal information is processed outside Australia, we take reasonable steps so it is handled consistently with the Australian Privacy Principles.

11. How long we keep it

• Raw IP addresses: not stored by us (see section 4). The daily IP hashes used to spot repeat clicks are set to expire about a day after the click.
• Daily usage records are stored against a pseudonymous hashed install ID, not your account, and deleted automatically after 90 days. A running total of credited views and billed clicks per hashed install ID is kept so earnings can be credited. It does not expire automatically: it is deleted when that install’s install key is revoked, or when you delete your account if the install is linked to it. Uninstalling the CLI does not delete it. A billed click on a link shown to an install is added to that install’s running total, and its install hash is added to that day’s list of installs for the ad, which is deleted automatically after about 90 days. You can also ask us to delete an install’s records sooner (see section 13).
• Advertiser event records (which hold no install key, install hash or IP address): deleted automatically after about 400 days.
• Account information: while your account is open. When you delete your account, your personal data is deleted immediately and copies in backups are purged within 30 days (see section 12).
• Sponsor role and sponsor record: stored with your account and deleted with it, in the same way. Sponsor form details: they expire 24 months after they were last updated and are then deleted automatically, normally within a few days; they are deleted straight away when you delete your account; copies in backups are purged within 30 days. The email copy of a sponsor form in our inbox is kept while we deal with your enquiry and any advertising agreement that follows, then deleted; you can ask us to delete it sooner.

12. Your choices and controls

• Turn ads off. Run vibead disable at any time. It turns ads off and restores your previous settings.
• Stop impression reporting. Run vibead telemetry off.
• Uninstall. vibead uninstall removes VibeAd’s changes and its data from your device. It does not delete data held on our servers; see section 11.
• Delete your account. You can delete your account yourself (this calls our account deletion endpoint, DELETE /api/account). You can also email a deletion request to admin@vibead.ai. When your account is deleted, your personal data is deleted immediately and your sign-in tokens are revoked at once. Install keys linked to your account are revoked too, so those installs can no longer report to us. If a step cannot be completed, your account is not deleted and you can try again. Any copies in our backups are purged within 30 days.

13. Your privacy rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you;
• correct it;
• delete it;
• object to or restrict certain uses, or withdraw consent;
• receive a copy in a portable format;
• complain to a regulator.

Australia: you can ask to access or correct your information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. If you are unhappy with how we handle a complaint, you can contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

EU and UK: you can complain to your local data protection authority or, in the UK, the Information Commissioner’s Office (ICO).

California: you have the right to know what personal information we collect, to delete it, to correct it, and not to be discriminated against for using these rights. We do not sell personal information, and we do not give advertisers information that identifies you.

To make a request, email admin@vibead.ai. We may need to verify your request. Because using VibeAd without an account involves only a pseudonymous install key, we may not be able to link a request to a specific install unless you give us that key.

14. Our website, cookies and analytics

Our website (www.vibead.ai) is a static site served through AWS CloudFront. As checked on 22 October 2026, the website:

• does not set cookies;
• does not use analytics or tracking scripts;
• does not load scripts, fonts, images or videos from third parties. Links to X, LinkedIn and GitHub are plain links, and nothing is loaded from those sites unless you click them.

The sponsor report page (www.vibead.ai/report) contacts our own servers only when a sponsor opens it with their private report key. The public publisher demo sends what you enter to our servers and shows it to anyone who opens the demo, so do not enter personal information there.

The sign-in page (www.vibead.ai/login) talks only to our own servers and our sign-in service, Amazon Cognito. It keeps sign-in tokens in memory and uses your browser’s session storage only briefly while you sign in with GitHub. GitHub sign-in passes through our sign-in domain, auth.vibead.ai, which is run on Amazon Cognito and may set cookies that are strictly needed for signing in, and then through GitHub’s own sign-in page, which is covered by GitHub’s terms and privacy policy.

As with any website, our hosting provider’s servers receive your IP address and browser details when you visit, for delivery and security.

If we add optional analytics in future, we will ask for your consent first and update this policy.

15. Security

We use reasonable technical and organisational measures to protect information, including firewall and abuse protection and storing only hashes of install keys. No system is perfectly secure, and we cannot guarantee security.

16. Children

VibeAd is only for people aged 18 or over. It is not directed at anyone under 18, and we do not knowingly collect their personal information. If you think someone under 18 has given us information, contact us and we will delete it.

17. Third-party AI agents and websites

VibeAd is not affiliated with Anthropic, OpenAI or any other AI agent provider. Your use of those tools is covered by their own terms and privacy policies, not this one. If you click a sponsored line, the advertiser’s website is covered by its own privacy policy.

18. Changes to this policy

We may update this policy. If changes are significant, we will give notice, for example on our website or in the CLI. The “Last updated” date shows the latest version.

19. Contact