[LEGAL REVIEW PENDING] Version: 1.0.0 Effective date: to be set on launch
This Privacy Policy explains how Vibz ("we", "us") collects, uses, and shares information when you use the Vibz mobile apps, website, and related services (the "Service").
We do not sell your personal information.
We rely on the following legal bases under GDPR / UK-GDPR: contract performance (operating your account), legitimate interests (security, abuse prevention, product improvement), legal obligation, and your consent (for tracking, marketing, optional integrations).
We share information with:
We do not share your contact list or message contents with third parties for advertising.
- Private groups are end-to-end encrypted and are not discoverable in search, discovery, or recommendations. The per-message content key is wrapped to each eligible current member's device so only those members can decrypt; Vibz holds ciphertext only. Restricted accounts (under 18) cannot join or access private groups. - Public groups (and public groups that require admin approval to join) are encrypted in transit (HTTPS / TLS 1.2+) but are not end-to-end encrypted. Vibz stores public-group content in server-readable form so we can moderate it (CSAM detection, abuse review, copyright takedowns), support discovery and search, enforce the Community Guidelines, and keep the Service safe. Anyone may join public groups, including restricted accounts, subject to our safety rules.
We keep your information only for as long as we need it. Indicative retention:
| Category | Retention |
| Active account | Until you delete the account |
| Deleted account | Anonymized within ~30 days; full purge of derived data within 90 days |
| Direct messages and private-group messages (E2EE ciphertext) | Deleted from active servers within 24 hours after delivery and recipient-device sync, unless reported or preserved for legal, safety, or security reasons |
| Message metadata and tombstones | Up to 13 months where needed for delivery, abuse prevention, edits, reactions, deletions, safety, and legal compliance |
| Encrypted message key-delivery records for private groups | Kept with message metadata/tombstones where needed to deliver, sync, recover, or troubleshoot encrypted group messages; these records are wrapped to recipient devices and do not contain plaintext message content |
| Signal device public keys and one-time prekeys | Kept while the device/account is active; claimed one-time prekeys are pruned after about 90 days by default; old signed prekeys may be kept in limited history so delayed messages can still decrypt |
| Optional encrypted key-recovery backup | Kept until you replace it or delete your account; the backup is encrypted before upload and is used to restore access to encrypted messages still available to your account |
| Public posts | Until you delete or your account is deleted |
| Public-group messages | Until deleted by the sender, removed by moderation, or the account/group is deleted |
| Moderation reports + decisions | 90 days after action; CSAM evidence as required by law |
| Server access logs | 30 days |
| Security audit logs | 13 months |
| Backups | 35 days rolling |
Important encryption-retention note: deleting an encrypted message body from active servers does not immediately delete every supporting key or device record. Vibz keeps some encrypted key-delivery records, device public keys, prekey history, and optional encrypted key-recovery backups longer than 24 hours so the Service can deliver delayed messages, support multi-device sync, recover encrypted messages that are still available to an account, prevent abuse, and troubleshoot encryption failures. These records are not plaintext message content.
Your device may keep decrypted message bodies, media files, and media decryption keys in local app storage after the server copy is purged. You can remove that local copy by deleting the message, deleting the conversation, deleting your account, or clearing/removing the app data from your device.
Depending on where you live (GDPR/UK-GDPR, CCPA/CPRA, etc.), you may have the right to:
To exercise any right not directly available in the app, email privacy@marketvibz.com.
The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn we have collected such information without verifiable parental consent, we will delete it. Some jurisdictions set a higher minimum age (e.g. 14, 15, or 16) — those minimums are enforced where they apply.
For users between 13 and 17, we apply additional safety defaults: private profile by default, restricted DM and calling, limited discoverability, no private-group access, public-group access only where allowed by our safety rules, no public livestreaming, no token / subscription purchases, no paid subscription channels, and no view-once or time-expiring secure media. Teen accounts do not receive adult-oriented recommendations.
Adults may enable Filter messages from strangers so direct messages from people they do not follow land in a separate Message Requests inbox without a notification or badge. From there, the adult can accept the conversation into the main inbox or decline it and delete the request.
We are based in the United States. If you use the Service from outside the US, your information will be transferred to and processed in the US (and possibly other countries where our service providers operate). Where required, we use the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework.
We use industry-standard administrative, technical, and physical safeguards. No system is 100% secure; we encourage you to use a strong, unique password (or biometric / phone-based authentication) and to enable two-factor authentication when we offer it.
If we discover a security incident affecting your information, we will notify you and the appropriate regulators as required by law.
The current categories of third parties that process data on our behalf include:
A list of specific named subprocessors will be published at https://app.marketvibz.com/legal/subprocessors before launch.
We may update this Policy. When we do, we will bump the version, post the updated version at this URL, and notify you in-app. For material changes affecting your rights, we will require you to accept the new policy before continuing to use the Service.
This is a v1 draft modeled on best-practice social-media privacy policies (TikTok, Snapchat) customized to Vibz's data flows. The retention table, list of subprocessors, legal bases and dispute clauses must be reviewed and finalized before public launch.