Privacy notice — Vibe Coder verification service
How this service handles what you send it. Last updated 2026-08-04.
What this covers
This notice is for the Vibe Coder verification service: the certificate pages, the public directory of verified apps, the badge images, the free tools, the form that asks an app owner for a report, and the form that challenges a verdict.
It does not cover the Vibe Coder Playground desktop app. That runs on your own computer and keeps its own data there, under the notice shipped inside it.
Who is responsible
The controller is Vibe Coder Playground LLC, 7901 4th St N, STE 300, St. Petersburg, FL 33702, USA.
Write to contact@vibecoderplayground.ai about anything on this page, including asking us to delete something you sent. There is one address and a person reads it.
The short version
Three things can put personal data into this service, and only two of them are stored at all:
- A report request you send to an app owner — stored, passed to that owner, and deleted after 90 days.
- A dispute you file about a certificate — stored, because the history of a certificate is the point of it.
- Anything you paste into a free tool — read, measured, answered, and never written down.
This service sets no cookies. We run no analytics script, no advertising network and no tracking pixel of our own on any of its pages, and nothing here follows you between pages — nothing here can tell one visit from another.
One exception, and it is the only one: an app owner on an enhanced listing can point at images hosted on their own server. Your browser fetches those from that server, which means that server can see your IP address and that we cannot see what it does with it. We ask your browser not to tell it which page you came from, and we host nothing else off our own domain.
Report requests: the form that asks an owner for the full report
The form on a certificate page collects your name (up to 80 characters), a way to reach you (up to 160 characters — an email address or a link), and an optional message (up to 800 characters). We also record which certificate you asked about, whether you asked for the standard report or the acquisition report, and the time you sent it.
Why we collect it: the form exists to hand an introduction to the app's owner. That is all it is for. You are not added to a mailing list, because there is no mailing list.
Who sees it: the owner of that certificate, and whoever operates this service. Your details are not shown on the certificate page, and are not in the public directory, the public record data, the sitemap or the revocation list.
How long we keep it: a queued request is deleted 90 days after you send it, whether or not the owner ever collects it. Owners can also clear their queue when they collect it, which deletes it sooner. Only the most recent 200 requests on a certificate are held.
Once an owner has collected your note, they hold their own copy under their own arrangements. We cannot reach into it. If you want that copy deleted, ask them — and tell us, so we can tell you who they are.
We do not store the owner's email address here either. Owners collect their requests from us; we send no mail on anyone's behalf.
Disputes: challenging a verdict
Anyone can challenge a certificate, not just its owner. The form takes the text of the challenge (up to 2,000 characters) and a contact (up to 160 characters), because a dispute nobody can reply to cannot be resolved.
What becomes public: nothing, when you file it. A dispute is reviewed first, and appears on that certificate page only once it has been accepted for review — with its state, its date, and our written resolution once there is one. It then stays visible whether or not it went your way. Your contact detail is never published; only the issuer sees it.
How long we keep it: the dispute, its dates and its outcome are part of that certificate's record and are kept for as long as the certificate exists. The contact detail does not need to be: once a dispute is closed, ask us and we will erase it and leave the rest.
The free tools: pasted pages and pasted source code
The free tools work on text you paste — the HTML of one page, or one source file. One run accepts up to 64 KB of request, and your paste travels inside that request: plain English or ASCII source fits up to roughly 65,000 characters, and fewer if it contains accented letters, emoji or anything else that takes more than one byte to send. Anything larger is refused outright and told so — it is never quietly cut short and measured anyway.
What happens to it: it is read in memory, measured, and the answer is returned to your browser. It is never written to any store, never published, never shown to anyone else, and never sent to a third party or to an AI model. A free tool makes no outbound network request at all, and the build fails if anyone adds one.
Because nothing is stored, there is nothing here to erase. If you paste a password or a key by accident, the useful response is to rotate it — not to write to us, because we have no copy to delete.
Answers are not cached, so one visitor's result can never be handed to another.
The only thing kept is the rate-limit counter described below, and it holds a count, not your paste.
What app owners publish about themselves
A certificate page shows what an owner chose to publish about their own software: the app's name, the verdict, the score, counts of findings, hashes of the code that was audited, dates, and any profile text on an enhanced listing. If an owner puts a personal name into one of those fields, it is public because they published it. An owner can withdraw a certificate at any time.
An enhanced listing can also carry up to eight images and six links the owner supplies as addresses on their own servers. We do not host or copy them, which is why the paragraph above says your browser fetches them from somewhere that is not us.
Addresses, rate limits and logs
Your IP address is used in two ways, and neither of them is tracking.
It is the key for the in-memory counters that stop the forms being flooded. Those counters hold a number and an expiry time and nothing else, and they clear themselves — after 60 seconds for the report form and the free tools, and after 5 minutes for the dispute form.
It also appears in the service's ordinary request log alongside the URL and the response, which is what makes it possible to fix a fault or notice an attack. That log is written and held by the platform this service runs on, and trimming it is a setting on that platform — no code in this service deletes it. So we are not going to tell you the log is already gone on a schedule we cannot show you: our target is 30 days, and until that trim is configured on the host we make no promise about how long the platform keeps it. Write to contact@vibecoderplayground.ai and we will tell you what it is set to today. Either way, the request log is not used to profile anyone or to follow a visitor from page to page.
Why we are allowed to do this
Where a lawful basis is required, we rely on two. Your own request, for anything you type into a form and send: you asked us to pass a note on, or to look at what you pasted. And our legitimate interest in keeping the service standing up, for the rate limits, the logs and security.
There is no advertising and no profiling here, so there is no consent for you to give or to manage. If you are in the EU, the UK, or anywhere with equivalent law, the rights below apply to you wherever we happen to be.
Where your data goes
The service runs on servers in the United States, so anything you send is transferred there. A report request is then passed to the app owner who published that certificate, and that owner may be anywhere in the world — passing it to them is the entire purpose of the form.
Nothing here is sold, and nothing is shared with an advertising network, because there is no advertising on this service.
Your rights, and how to use them
You can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, or object to what we are doing with it. Write to contact@vibecoderplayground.ai.
To make that quick, include the certificate id — the code in the page address — and the name or contact you used. There is no account here to look you up by, so without those we may not be able to find your request among everybody else's.
We answer within 30 days. It costs nothing, and you do not need an account.
If you think we have handled this badly you can complain to your data protection authority. We would rather you told us first and gave us the chance to fix it.
Children
None of this is aimed at children. We do not knowingly collect anything from anyone under 16. If you believe we have, write to us and it will be deleted.
Security, plainly
Traffic is served over HTTPS. Publishing or collecting requests needs a secret token, and a token only reaches the certificates it owns. The report queue on a certificate is capped and expires on its own.
What we will not claim is that nothing can go wrong. This is a small service. If data of yours is exposed, what we can honestly offer is to tell you, and to say what happened.
Automated decisions
The verdicts here are produced by automated audits of software against a published rubric. They are decisions about code, not about people. Nothing on this service profiles a person or decides anything about one.
How long everything is kept
- A report request you sent — 90 days, or sooner if the owner clears their queue.
- A dispute, its dates and its outcome — as long as that certificate exists.
- The contact detail on a dispute — the same, unless you ask us to erase it once the dispute is closed.
- Anything pasted into a free tool — not kept at all.
- Rate-limit counters — 60 seconds, or 5 minutes for the dispute form.
- Request logs — a target of 30 days, which the hosting platform would apply and this service does not. Not configured yet, and the paragraph on logs above says so rather than leaving you to assume it.
Changes, and the law that applies
If this notice changes, the date at the top changes with it, and a change that affects you will be noted on the certificate pages.
This notice is governed by the laws of the State of Florida, USA, without prejudice to rights you have under the law where you live.