The short version
We collect only what it takes to run your blog: your sign-in email, your content, and the minimum technical data to keep the service secure and reliable. We do not sell data, we do not run ads, and your posts belong to you. Reader analytics on hosted blogs use no cookies and store no visitor identifiers.
What we collect
- Account. The email address you sign in with, used to send one-time sign-in codes. When Google or GitHub sign-in is configured and you use it, we store what that provider returns to sign you in and link the account to your email: your account ID there, your name and profile image, and the sign-in tokens it issues.
- Sessions. Signing in to the app sets an essential session cookie. Each session records the IP address and browser user agent it started from.
- Workspace content. Your blog’s posts, media, settings, version history, and activity log.
- Access tokens. API and MCP tokens are stored only as hashes. Full tokens are shown once at creation.
- Billing. Payments are processed by Polar. At checkout we pass Polar your email, name, and workspace ID. We never see or store your card number.
- Operations. Request logs from our hosting provider for security and debugging.
What we never do
- Sell, rent, or broker your data.
- Load advertising networks or third-party trackers on the app or marketing site.
- Read your content to train models. Agents you authorize access it over scoped tokens; their changes appear in your activity log.
Reader analytics on your blog
Hosted blogs count page views so you can see what resonates. A page view records the site, the post, and the hostname of the referring site. It stores no IP address, cookie, or visitor identifier. Browsers sending Do Not Track or Global Privacy Control are not counted.
Reads by AI agents and crawlers are counted separately, on the server. Each count records the agent name or category from the user agent, the page or feed requested and its format (HTML, Markdown, XML, or text), whether a Signature-Agent header is present, and the blog’s hostname. Requests for feeds, the sitemap, robots.txt, llms.txt, and Markdown versions of posts count here whoever makes them. This count stores no IP address or reader identifier, so it does not check Do Not Track or Global Privacy Control.
Newsletter signups are opt-in. We store the email address, the page it came from, the consent wording shown, and keyed hashes of the IP address and user agent. Blogs set no cookies; reader preferences such as light or dark mode stay in the reader’s own browser storage.
AI and your posts
Your posts can be written by you, by your agent, or both. vibecms never sends them to an AI model: we store, check, and publish them. The SEO and AI-answer checks are plain code that runs in our own service. What your agent sends to its own AI provider is between you and that provider.
Providers
The service runs on Cloudflare: compute, database, and media storage, Cloudflare Email Sending for sign-in codes. Polar processes payments. Each provider processes data only as needed to deliver the service.
Your content and your exits
You own everything you publish. Your posts and media are readable back through the same typed API and CLI your agents use, so leaving is a read operation, not a negotiation. Ask us to delete a workspace and we remove its content. Our database provider’s point-in-time recovery can hold earlier copies until they age out.
Early access
vibecms is in public early access, and this policy will mature with the product. If a change materially expands what we collect, we will announce it on the site before it takes effect.
Contact
Questions or requests about your data: support@vibecms.dev.