Privacy Policy

This Privacy Policy explains how VibeChat (“we”, “us” or “our”) collects, uses, stores and deletes personal data when you use the VibeChat application and website. VibeChat is a general social and creator platform, and some features have additional age restrictions as described below. Our Terms of Service set out the contract between you and us; this policy describes how we handle your data.

1. Data we collect

We collect the following categories of data:

• Account data: email address, a securely hashed password, username, display name, optional profile picture and bio, optional date of birth (used for age verification on restricted features), and creator/channel settings.
• Content you create: posts, comments, direct messages, reactions, favorites, blocks, mutes, follows, channel activity, and content you mark as paid/locked.
• Media files: photos, videos, audio and other files you upload, including files you mark as paid/locked (stored with our media provider, Cloudinary, or on our own servers).
• Moderation and report data: reports you submit (including the reason, details and any evidence you voluntarily provide, such as screenshots where the reporting feature supports them), the content associated with reports, account information associated with reports, moderation decisions and actions, and other safety-related records.
• Video chat metadata: when you use Random 1-on-1 Video Chat we record session metadata (participants, start/end time, and the reason the session ended). Video calls themselves are not recorded or stored. Your camera and microphone stay off until you enable them.
• Financial demo data: a demo wallet balance and demo transaction history. These are demonstration funds with no real cash value and are not real financial accounts. VibeChat does not currently process real-money deposits, withdrawals, creator payouts or other real-money financial transactions through this demo wallet.
• Technical data: for guests and for security, we may collect IP address and user-agent strings. We do not collect precise device advertising identifiers.

2. How we use your data

• To provide and operate the app: feed, posts, comments, direct messaging, channels, video chat, favorites and notifications.
• To keep the community safe: content moderation, reviewing reports and voluntarily submitted evidence, handling blocks and mutes, spam prevention, and enforcing our Community Guidelines.
• To comply with legal obligations, including child-safety standards and the removal of illegal content.
• To maintain and improve the service and to respond to support requests.

3. Third-party services

We use the following third-party services. Where they may process personal data, we describe what is shared below. We do not sell your personal data and we do not serve advertising.

• Cloudinary – media files you upload (posts, messages, avatars and report evidence) are sent to Cloudinary for storage, processing and/or delivery where applicable. Uploaded media may therefore be processed by Cloudinary as a third-party service provider. If Cloudinary is unavailable or not configured, media is stored on our own servers instead. After account or content deletion, media may be purged from Cloudinary on a delayed schedule.
• Pusher – Pusher provides real-time messaging and notifications. When you use real-time features, event payloads are transmitted through Pusher’s infrastructure to deliver them to your devices. These payloads may include message content (such as message text, file names and the sender’s username), conversation identifiers, notification text and message status updates. Access to these channels is authenticated and restricted to the relevant participants.
• GIPHY – when you search for GIFs or stickers, your search query is transmitted (through our servers) to GIPHY to perform the search, and the results are shown in the app. Your messages and other personal information are not sent to GIPHY.
• STUN / TURN (WebRTC video chat) – Random 1-on-1 Video Chat uses WebRTC. To set up a connection, STUN servers (Google’s STUN servers by default) and, optionally, TURN relay servers are used for network discovery and connectivity. Only network-level information needed for connectivity (such as IP addresses and connection candidates) is processed by this infrastructure. The contents of video calls are not recorded or stored and are not sent to Google; where TURN is enabled, encrypted media packets may be relayed through our TURN servers as a fallback. Screen sharing is not supported.
• Bunny Fonts – we load web fonts from the fonts.bunny.net CDN; your IP address may be transmitted to that CDN when pages are loaded.
• Email delivery – we may send account-related email messages (such as password reset codes) using our configured email delivery service, which may process the recipient’s email address and the message content.

4. Age restriction

VibeChat is a general social and creator platform. Some features have additional age restrictions. In particular, Random 1-on-1 Video Chat is restricted to users who are 18 years of age or older, and users under 18 must not be permitted to access it. We apply age restrictions where required and verify age (for example, by date of birth) before allowing access to restricted features. VibeChat is not directed toward children for age-restricted features. If you believe that personal data has been provided to us in connection with an age-restricted feature by someone under the applicable age, please contact us using the details below.

5. Retention and deletion

Retention periods depend on operational, safety, security and legal requirements. In general:

• Active account data is retained while your account is active so we can provide the service.
• User-generated content is retained while your account is active or as long as needed to operate the service.
• Moderation and report data is retained for as long as needed for safety, moderation, dispute resolution and legal obligations.
• Video-chat metadata is retained for safety and security purposes; video calls are not recorded or stored.
• Demo wallet and transaction data is stored as part of the application’s functionality.
• Uploaded media may be purged on a delayed schedule after account or content deletion, including media hosted with third-party providers.
• Backups and caches may persist briefly for technical reasons; we do not promise instant deletion from every backup.

You can delete your account at any time from Profile → Settings → Delete Account (password confirmation required). Deletion removes or anonymizes personal data where applicable, while certain information may be retained where necessary for legal obligations, fraud prevention, security, safety reports, moderation, dispute resolution, or legitimate accounting/transaction requirements. See our Account Deletion page for details, including how to reach us to request deletion.

6. Your rights

Depending on where you live, you may have rights to access, correct, export or delete your personal data, and to object to or restrict certain processing. You can exercise most of these directly in the app, or by contacting us below. We will respond to legitimate requests as required by applicable law.

7. Security

We use industry-standard safeguards including encrypted transport (HTTPS), hashed passwords, and restricted access to production data. No method of transmission or storage is 100% secure.

8. Changes to this policy

We may update this Privacy Policy from time to time. The “last updated” date above reflects the most recent change. Continued use of the app after changes means you accept the updated policy.

9. Contact us

Questions about this policy, data deletion requests, abuse reports and child-safety concerns can be sent to our support team at support@vibechat.co.ke, or via our Contact & Support page. For child-safety matters, our point of contact is the same address.

Our published standards against child sexual abuse and exploitation are set out in our Community Guidelines and Terms of Service.