Privacy Policy

1. Introduction & Operator Identity

This Privacy Policy explains how [PLACEHOLDER: VibeShield Open Source Contributors] ("VibeShield", "we", "us", or "our") handles information in connection with the VibeShield static security scanner CLI, GitHub Action, pre-commit hook, and the website located at https://rajviyash9136freefr-tech.github.io.

Our fundamental design principle is zero data exfiltration. Unlike cloud-based code review platforms, VibeShield is engineered as an offline-first tool that analyzes code directly inside your local environment without network transmission.

2. How Source Code and Data Are Handled

Based strictly on our codebase architecture:

• Local Analysis (CLI, npm launcher, pre-commit hook): The Go binary compiles rule packs directly into the executable. Scanning consists entirely of in-memory abstract syntax tree (AST) traversal and regular expression pattern matching. The scanner links no HTTP networking client for outbound code transfer.
• CI/CD Mode (GitHub Action): The action executes entirely within your self-hosted or GitHub-hosted runner. Findings are posted directly as a review comment on your own pull request using your repository's native GITHUB_TOKEN. No findings or code snippets are transmitted to VibeShield.
• Automatic Secret Redaction: When a potential credential or API key is detected, VibeShield automatically redacts the secret string, retaining only four characters on each side, prior to printing to console or PR comments.
• The --online Flag: This CLI flag is currently reserved for future package registry lookups. In the current release (v3.0.0), it prints an informational message and performs the scan entirely offline.
• No AI Model Training: Because no code or prompts are transmitted to us, your proprietary source code, secrets, and repository structure are never stored, logged, or used to train AI models.

3. Website Information Collection

Our public website is hosted as a static site via GitHub Pages:

• Forms & Sign-ups: The site contains zero forms, newsletter sign-ups, waitlists, account registrations, or payment portals.
• Analytics & Tracking: We do not use Google Analytics, PostHog, Plausible, tracking pixels, or cross-site fingerprinting scripts.
• Local Storage: Our client scripts do not write to or read from localStorage or sessionStorage.
• Hosting Server Logs: As with standard web traffic, our hosting provider, GitHub Inc. (88 Colin P Kelly Jr St, San Francisco, CA 94107, USA), processes standard web server access logs (such as visitor IP addresses, browser types, referring pages, and access timestamps) to deliver the site and maintain infrastructure security in accordance with the GitHub Privacy Statement.

4. Cookies & Tracking Technologies

VibeShield sets zero first-party cookies and loads no third-party marketing or advertising cookies. Because we do not use non-essential cookies, no cookie consent banner is required or presented.

5. Third-Party Services

We minimize external dependencies to the absolute bare minimum:

• Google Fonts (CDN): The site requests web fonts (Outfit and Plus Jakarta Sans) from Google CDN (fonts.googleapis.com and fonts.gstatic.com). Your browser transmits your IP address and standard HTTP request headers to Google to fetch font stylesheets.
• GitHub: Used for repository hosting, documentation hosting, issue tracking, and release binary downloads. Interactions on GitHub are governed by GitHub's Terms of Service and Privacy Statement.

6. Legal Basis for Processing

To the extent any technical data (such as server IP addresses in hosting logs) constitutes personal data under applicable laws:

• Legitimate Interests: Processing is strictly necessary for our legitimate interest in providing reliable open-source software, protecting website security, and maintaining site availability.
• Contract Performance / Consent: Where you voluntarily open a GitHub issue or contact us via email, processing of your correspondence is based on your explicit request and communication.

7. Data Retention

VibeShield maintains no central database or user accounts. We retain zero personal data, source code, or scan telemetry. Any communications sent to our contact email or posted publicly to our GitHub repository remain visible or archived in accordance with standard communication records or until you request deletion.

8. Your Privacy Rights

Depending on your jurisdiction, you have specific statutory rights regarding personal data:

A. Republic of India (Digital Personal Data Protection Act, 2023 - DPDP)

Under the DPDP Act 2023, data principals have the right to:

• Obtain a summary of personal data processed (noting that VibeShield processes zero personal data through its tools).
• Seek correction, completion, or erasure of personal data provided in direct communications.
• Nominate another individual in the event of death or incapacity.
• Access grievance redressal mechanisms by contacting our Grievance contact at [PLACEHOLDER: legal@vibeshield.dev].

B. European Union & United Kingdom (GDPR / UK GDPR)

Under Articles 15–22 of the GDPR, European residents have the right to request access to, rectification of, or erasure of their personal data; object to processing; and lodge a complaint with their local supervisory authority.

C. California & United States Residents (CCPA / CPRA)

Under the California Consumer Privacy Act (CCPA):

• We do not "sell" or "share" personal information or sensitive personal information.
• You have the right to know what personal information is collected, request deletion, and not be discriminated against for exercising privacy rights.

9. Children's Privacy

VibeShield is a developer security utility intended for software engineers and IT professionals. It is not directed at or marketed to children under 18 years of age (under the India DPDP Act) or children under 13/16 years of age under US COPPA and GDPR. We do not knowingly collect personal data from minors.

10. International Visitors

The operator of VibeShield is based in India ([CONFIRM: Republic of India, jurisdiction of courts in New Delhi, India]). Website hosting infrastructure is provided by GitHub Inc. in the United States. If you access our site from outside these jurisdictions, note that technical connection data is transferred internationally in accordance with standard internet routing.

11. Changes to this Policy

We may update this Privacy Policy from time to time to reflect operational or legal updates. When changes are made, the "Last updated" date at the top of this document will be updated. Continued use of the software or site following an update indicates acceptance of the revised terms.

12. Contact & Grievance Officer

For questions, requests, or privacy inquiries regarding this policy:

• Legal / Contact Email: [PLACEHOLDER: legal@vibeshield.dev]
• Operator: [PLACEHOLDER: VibeShield Open Source Contributors]
• Physical Address: [PLACEHOLDER: New Delhi, India]
• Public Issues: https://github.com/rajviyash9136freefr-tech/vibeshield/issues