Last updated: October 3, 2026
This Privacy Policy explains what personal data we collect when you use VibeX, why and how we process it, and the rights you have. VibeX is a trust product: our goal is to process your photos only to create the result you asked for, and to keep you in control of your data. The policy applies to our users everywhere and uses the EU General Data Protection Regulation (GDPR) as its baseline; you'll find extra information for where you live in section 12.
VibeX is a mobile app for iPhone and iPad (an Android version is planned), built and operated by Mustafa Evleksiz, who is the data controller under this policy (the person who decides why and how your data is processed). Use the contact address below (support@vibexapp.com) for any privacy question or request.
We collect only what we need to provide the service:
Laws such as the GDPR require every use of personal data to rest on a legal basis (a lawful reason that permits it). Here is the basis we rely on for each purpose:
When you upload a photo, processing happens over our secure servers (Supabase Edge Functions), and the photo is sent to the AI model (Google's Gemini vision model) to create the output. The AI key never lives on your device. Under its paid-service terms, Google keeps these requests for 55 days, solely to detect and prevent abuse and to meet legal obligations.
Beautify Me: when you use this feature, the photo you choose is sent through OpenRouter to OpenAI's image model to create the retouch, and the result comes back to you. We tell you this and ask for your permission before sending it. Under its API terms, OpenAI does not use this data to train its models; it may keep it for up to 30 days to monitor for abuse. For retouch suggestions, a crop of your face is sent to Google Gemini (the terms above apply). The areas you don't select come from your original photo on your phone.
Your creations, the original (“before”) photos they were made from, and your profile photos (avatar and identity photos) are stored in a private cloud space that belongs to you, for history and cross-device sync. Server copies of results made for delivery are deleted automatically after 7 days. You can delete them at any time.
Profile Pack (batch creation): a copy of the photos sent for a pack (your avatar and, if you have them, your angle shots and full-body photo) is kept, while the pack is being prepared, in a separate area that only our servers can access, and is deleted once the pack is complete, within 24 hours at the latest. The images are created with Google Gemini: the photo copies uploaded to Google's batch processing service and the batch job are deleted as soon as creation finishes; if for any reason they cannot be deleted, Google deletes those photo copies on its own within 48 hours. The 55-day period above applies to the records Google keeps to prevent abuse. Server copies of the pack's images made for delivery are deleted automatically 7 days after they are added to your History, or 30 days after the pack is complete if they never are.
Your photos are NEVER used to train any AI model. A content-safety filter is applied, and we obtain explicit consent for processing.
Face scan (optional): the 3D face model (mesh) is created and stored only on your device and is never uploaded. The photos you keep from the scan (your avatar, left/right angle shots and an optional full-body photo) are stored in your private cloud space for sync and sent to the AI model (Google Gemini) as identity references when you create images. Delete the profile in the app to remove them.
We do not process your photos to recognize who you are or to verify your identity, and we do not extract or store a face-recognition template (a biometric template) from them; the 3D model from a face scan never leaves your device either. The face comparisons we do make serve only to get the result right: on your device, the app calculates the score showing how much a result looks like you and, in Together mode, checks that the same person hasn't been added twice (the data created for these checks is not stored); the AI model also compares a result with your original photo and rates its realism and likeness (these scores are stored with usage events while analytics is on). We ask for your explicit consent to process your photos on the consent screen shown before you add a photo, and you can withdraw it at any time: when you delete your photos, profile or account, that processing stops.
The community gallery is entirely optional: you can only share a scene with explicit consent — either by confirming (checkbox) that your face may be visible, or by using quick share, where your face is automatically removed before sharing. We keep a record of that consent (scene, time, consent version). Every share goes through moderation review before it appears, and you can remove your share at any time or contact us to have it removed.
We rely on the following providers to deliver the service. Each is subject to its own privacy policy:
These providers process your data on our behalf and on our instructions. Apple (sign-in, payment and push infrastructure), Google (Sign in with Google) and, if you allowed tracking in an older version, Meta (ad measurement; it may also use the data it receives to personalize ads) also process data in those services under their own privacy policies. We never sell your personal data.
Some of the providers above may host servers outside your country (for example in the European Union or the United States). As a result, your data may be processed and stored abroad to the extent necessary to provide the service. These transfers are carried out in line with applicable data-protection rules.
When we transfer data from the European Union/European Economic Area (EU/EEA) or the United Kingdom to a country that has not been recognized as protecting data adequately, we rely on two safeguards. The first is the European Commission's standard contractual clauses (SCCs: a Commission-approved model contract that binds the recipient to EU-level protection); for data from the UK, the UK's addendum to those clauses also applies. The second, where the recipient benefits from one, is an adequacy decision (an official decision that a country or framework protects data adequately): in the United States, it covers companies certified under the EU–U.S. Data Privacy Framework (DPF) and, for UK data, its UK Extension. Provider by provider:
To get a copy of these safeguards, just email support@vibexapp.com.
Transfers out of Türkiye are subject to Article 9 of the KVKK; see our KVKK information notice (in Turkish) at vibexapp.com/tr/kvkk.
We keep your data for as long as your account is active or as needed to provide the service. Usage-event and generation logs (including device ID, device model and country) are deleted automatically after 90 days. When you delete your account, your data is permanently removed; a waiting period of roughly 30 days may apply before you can re-register.
Two summaries derived from usage-event and generation logs are kept longer. The daily usage summary derived from generation logs (per day, account, device and type of operation: numbers of calls and generations, credits spent and cost) is kept for statistics and cost accounting until your account is deleted. The hourly device activity summary derived from the usage events collected while analytics is on (device identifier, hour, number of events, app version and the account seen in that hour) is also kept until your account is deleted; its entries not linked to any account for that hour are deleted after 400 days. For the streak in Quests, the days on which you open the app are kept for 400 days, regardless of your analytics choice. All of these records that are linked to your account are deleted when you delete your account.
After account deletion we keep only: a hashed form of your email for the re-registration waiting period (30 days by default), purchase event records, records of community-sharing consent and of your photo-processing consent (date and text version), and a ban entry if your account or device was banned for abuse. Copies held by our providers (e.g. PostHog, Sentry, RevenueCat) and, if you allowed tracking in an older version, by Meta are deleted under their own retention periods.
Legal retention obligations (for example, purchase records) may require us to keep certain data for as long as necessary.
We apply reasonable technical and organizational measures to protect your data, including encryption in transit and at rest, access controls, and keeping no AI key on the client. No method is 100% secure, but we follow industry standards to protect your data.
Depending on where you live (under the GDPR, the UK GDPR, Türkiye's KVKK, Brazil's LGPD and similar laws), you may have the right to:
To exercise these rights, you can contact us (support@vibexapp.com) or delete your account directly from inside the app.
We reply to requests within one month at the latest (within 30 days for requests under the KVKK). If a request is complex or we receive many, this may be extended by up to two more months as the GDPR allows; if so, we will tell you why within the first month. To avoid handing your data to the wrong person, we may need to verify your identity — for example, by asking you to write from the email address on your account or to give us some additional details about it.
You can turn product analytics off at any time in the app under Settings > Data & Privacy; crash reporting is separate.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. The content-safety filter and usage limits can automatically stop individual generation requests, but a decision to ban an account or device is always made by a person.
VibeX is not directed to children under 13, and we do not knowingly collect data from them. If you believe a child has provided us data, please contact us; when we learn of it, we delete the account and the data concerned.
If you are below the age of digital consent in your country (13–16 in the EU, depending on the country), you need a parent's or guardian's permission.
We may update this policy from time to time. For significant changes we will notify you in the app or on this page. The latest version is always published here.
This section adds to the rest of the policy, depending on where you live.
Questions? Write to us: support@vibexapp.com