PRIVACY POLICY

Last updated: October 17, 2026

1. Introduction

CodeShant Technologies ("we", "us", "our") operates VibeDoctor. This Privacy Policy explains how we collect, use, and protect your information when you use our Service.

2. Information We Collect

2.1 Information You Provide

• Email address: Required for account creation, scan delivery, and communication
• App/Website URL: Provided for website scanning
• GitHub account connection: OAuth authorization for repository access (read-only)
• Payment information: Processed and stored by Stripe; we do not store card details

2.2 Information Collected Automatically

• IP address: Used for rate limiting and abuse prevention
• Usage data: Scan counts, feature usage, and interaction patterns
• Scan results: Security findings, performance scores, and code quality metrics generated during scans

2.3 GitHub Data

• We access your repositories in read-only mode via GitHub App installation
• We scan a copy of your code and delete that copy automatically
• For our AI-powered features, limited excerpts of your code are sent to our AI provider for analysis as described in the Data Sharing section below; these excerpts are processed transiently and are not used to train any AI models
• We store scan results and reports, including code snippets around each finding

2.4 Code Intelligence Metadata

To provide version-tracked code health monitoring, we store structural metadata extracted from your codebase during scans. This includes:

• File names, paths, and sizes - to identify files and track changes between scans
• Symbol names (function, class, and method names) - to track code structure and map findings to specific code elements
• Module structure and import relationships - to detect dependencies and assess blast radius of changes
• Health scores and finding counts per file and symbol - to track quality trends over time
• Version-to-version diffs - to show what changed, improved, or regressed between scans

This metadata is retained with your account and deleted upon account deletion.

2.5 AI App Connections

You can connect an AI app, such as Claude, ChatGPT, Codex or Claude Code, to VibeDoctor by signing in on agent.vibedoctor.io and approving the app. We then receive only what the app sends to VibeDoctor's tools:

• Code you ask it to check: the files are checked in a temporary folder that is deleted when the check ends; we keep only usage counts
• Questions about your code: answered from your scan results; for AI answers, the question and the relevant scan results are sent to Anthropic as described in Data Sharing below
• Notes on findings: kept with your project so you can review them
• The connection itself: your email address, the app's name, and the access tokens issued to it, which we store only in hashed form

We do not receive your conversations with the AI app, its memory, or any file it does not send to VibeDoctor. You can disconnect an app at any time in Settings, which ends its access immediately.

3. How We Use Your Information

• To provide and maintain the Service (scanning, monitoring, reporting)
• To send scan reports, alerts, and status emails
• To process payments and manage subscriptions
• To prevent abuse, enforce rate limits, and maintain security
• To improve the Service based on aggregated, anonymized usage patterns
• To display anonymized, non-identifying scan statistics (overall score, severity counts, primary language, and approximate country) on public pages such as our live-scan feed - this never includes your email, account identity, repository name, or scanned URL
• To send relevant product updates (you can unsubscribe at any time)

4. Data Sharing

We do not sell your personal data. We share data only with:

• Stripe: Payment processing
• Brevo: Marketing and transactional email delivery
• Resend: Transactional email delivery
• GitHub: Repository access via OAuth
• Google Analytics: Anonymous website usage analytics (loaded only after cookie consent)
• Meta (Facebook): Advertising measurement. Where you have consented to cookies, we share activity and purchase events with Meta so we can understand how our advertising performs. Any identifiers used for this are shared in hashed, irreversible form.
• Crisp: Live chat support
• Anthropic (Claude AI): Powers AI report generation and our AI-powered code analysis. For these features, limited excerpts of your source code - selected files and the code surrounding a specific finding - are sent to Anthropic for analysis. Anthropic does not use this data to train its models.

5. Data Retention

• Scan reports: Retained for the duration of your account
• Source code: Accessed in read-only mode; the copy we scan is deleted automatically
• Code intelligence metadata: Structural metadata (file names, symbol names, health scores, diffs) retained for the duration of your account to enable version tracking; deleted upon account deletion
• Account data: Retained until account deletion
• AI app connections: Access tokens expire on their own and are deleted when you disconnect the app or delete your account
• Payment records: Retained as required by law

6. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encrypted connections (TLS) for all data in transit
• Encrypted storage for sensitive data at rest
• Access controls and authentication for all systems
• Regular security audits of our own infrastructure

7. Your Rights

You have the right to:

• Access: Request a copy of your data
• Deletion: Request deletion of your account and associated data
• Correction: Update inaccurate information
• Portability: Export your scan reports
• Opt-out: Unsubscribe from marketing emails at any time

To exercise any of these rights, contact 911@vibedoctor.io.

8. Cookies and Analytics

We use essential cookies for authentication and session management. We also use Google Analytics to collect anonymous usage data (pages visited, session duration, device type) and the Meta (Facebook) Pixel, which helps us measure how our advertising performs. Both are loaded only after you provide consent via our cookie banner. You can withdraw consent at any time by clearing your browser's local storage. We do not sell analytics data.

9. Children's Privacy

The Service is not intended for use by individuals under 18 years of age. We do not knowingly collect information from minors.

10. Data Location and International Transfers

Our servers are located in Europe. If you access the Service from outside Europe, your data will be transferred to and processed on our European servers. We ensure appropriate safeguards are in place for all international data transfers in compliance with applicable data protection laws.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or prominent notice on the Service.

12. Contact Us

For privacy-related inquiries, contact us at 911@vibedoctor.io.

Operated by CodeShant Technologies(UDYAM-BR-26-0188408)